{ "schema": "sosec.july-2026-cve-census.v1", "edition": "2026-07", "evidence_cutoff": "2026-08-05T00:00:00+08:00", "purpose": "A complete CVE Program datePublished census for July 2026 with one bounded cause review per active record. Inclusion is a disclosure-cohort fact, not proof of exposure, exploitability, or patch priority.", "scope": { "cveProgramDatePublishedStart": "2026-07-01T00:00:00+00:00", "cveProgramDatePublishedEndExclusive": "2026-08-01T00:00:00+00:00", "corpusCount": 9808, "activeCount": 9763, "rejectedCount": 45, "nvdJulyExcludedCount": 111, "cvelistSnapshotCommit": "a373dbeddf97334f61e32d748cc24096303612ab" }, "evidence_receipts": { "nvd": [ { "file": "nvd-00000.json", "timestamp": "2026-08-04T16:13:48.176", "startIndex": 0, "count": 2000, "bytes": 7674554, "sha256": "82bdce58a78192a8091c65e760ad87780bd0bbcc23d6aeb337a37dff08245ad4" }, { "file": "nvd-02000.json", "timestamp": "2026-08-04T16:14:17.252", "startIndex": 2000, "count": 2000, "bytes": 8775776, "sha256": "1ffdde1e961ee49226e4fc1af795f19cbd3e46cff96bed3f7bad67fa7b99e05f" }, { "file": "nvd-04000.json", "timestamp": "2026-08-04T16:15:45.459", "startIndex": 4000, "count": 2000, "bytes": 6688441, "sha256": "861763af1836d1676f660feb35a27649ddda72254c3fc4feb5849ee5b217d5f8" }, { "file": "nvd-06000.json", "timestamp": "2026-08-04T16:16:52.553", "startIndex": 6000, "count": 2000, "bytes": 5741981, "sha256": "1e56d1ed25e0c6a9435378a4364b809d36c63fb47c328d4562d6fe12ea52cd26" }, { "file": "nvd-08000.json", "timestamp": "2026-08-04T16:17:17.935", "startIndex": 8000, "count": 1919, "bytes": 5129856, "sha256": "e4dcddc3bd06874d199f2cd3e31ff8dbea2f35eef63913f867b85134123b1299" } ], "cwe": { "version": "4.20", "date": "2026-04-30", "entryCount": 969, "archiveBytes": 2021351, "archiveSha256": "3976f599e5e5200219a3108bb896d06e2a88fbb293369e1883cb423a5e9d7d50", "member": "cwec_v4.20.xml", "memberSha256": "1f5a78bd62e00f86436b4fe32d5034a57e8f0da88e4063b2072b664ae510912e" }, "epss": { "header": "#model_version:v2026.06.15,score_date:2026-08-04T12:00:14Z", "scoreCount": 355094, "bytes": 2511575, "sha256": "6bb2c86d54ac209b1a8e717370e88bf54b198a8ce6e0c8313804c7bf6fbb158a" }, "cisaKev": { "catalogVersion": "2026.08.03", "dateReleased": "2026-08-03T18:55:09.067Z", "count": 1657, "parsedCount": 1657, "bytes": 1569586, "sha256": "16acee8334e59e44ccbaed4da7d02b409144061542b64ad74a9443fb7842a828" }, "nvdSources": { "timestamp": "2026-08-04T16:27:32.667", "sourceCount": 496, "identifierCount": 799, "bytes": 168587, "sha256": "7c6411b0a26f82d6f251472ca2612bee02b8879639ee39441181ff94606dbb1c" } }, "method": { "cohort_definition": "Records whose CVE Program cveMetadata.datePublished is at or after 2026-07-01T00:00:00Z and before 2026-08-01T00:00:00Z in cvelistV5 commit a373dbeddf97334f61e32d748cc24096303612ab. Current rejection state is retained.", "nvd_comparison": "The NVD API pubStartDate/pubEndDate result is a separate added-to-NVD cohort used for enrichment and boundary comparison; it does not redefine the CVE Program month.", "cause_rule": "The review selects the earliest engineering failure supported by public evidence, records one primary family, and marks UNDETERMINED when only impact or a broad label is public. No exploit reproduction is implied.", "cause_families": { "AUTHORITY_BINDING": "Identity, role, ownership, tenant scope, privilege, object, or action is bound incorrectly.", "CONFIG_UPDATE_DEPENDENCY": "An insecure default, permission, debug path, load path, dependency, build, package, update, or deployment control creates exposure.", "CRYPTO_SECRET": "A credential, signature, certificate, key, nonce, password, token, randomness, encryption, rotation, or revocation rule fails.", "EXPOSURE_OUTPUT": "Protected data reaches a response, log, cache, object, side channel, or observer without the required disclosure boundary.", "FILE_OBJECT_SELECTION": "Attacker-controlled path, name, archive member, link, upload, device, or object escapes the intended namespace.", "HARDWARE_PHYSICAL": "Hardware design, microarchitectural state, a physical interface, fault condition, or side channel is the enabling cause.", "INTERPRETER_BOUNDARY": "Untrusted data crosses into SQL, shell, code, markup, template, serialization, or another interpreted grammar.", "MEMORY_LIFETIME": "A bounds, size, type, initialization, ownership, reference, or lifetime invariant fails before memory access.", "OTHER_SPECIFIC": "The public record gives a concrete engineering cause outside the other families.", "REQUEST_CHANNEL_TRUST": "A host, origin, redirect, request boundary, DNS result, upstream response, or cross-domain channel is trusted incorrectly.", "RESOURCE_CONTROL": "Finite work, memory, recursion, queue, connection, descriptor, retry, or lifetime lacks an effective bound or release.", "STATE_SEQUENCE": "A race, stale state, replay, cancellation, workflow order, or lifecycle transition breaks a multi-step invariant.", "UNDETERMINED": "The public material does not support an engineering cause beyond impact or broad marketing language." }, "precision_levels": { "BROAD_RECORD": "The public material supports only the cause family, not the failing check, parser, state transition, or memory operation.", "DESCRIPTION_SPECIFIC": "The prose states a concrete mechanism while structured CWE data is absent, too abstract, discouraged, or mismatched.", "SOURCE_TRACED": "An official advisory and public source or patch expose the causal check, transition, or lifetime error.", "SPECIFIC_RECORD": "The record contains an allowed Base or Variant CWE and prose supporting that exact mechanism.", "UNDETERMINED": "The public material cannot support a cause classification." }, "score_roles": { "CISA_KEV": "Catalog evidence that exploitation is known; asset match, affected configuration, vendor repair, and incident review still determine the local action.", "CVSS": "Technical severity under the named source's vector and version; source-attributed rows are preserved.", "EPSS": "Probability estimate from the named model snapshot; useful for ordering, not an exposure or exploitation finding." }, "limitations": [ "The census exhausts the named public corpus and snapshots, not private vendor cases, embargoed patches, telemetry, or every later record update.", "A CVE is a record identifier. Shared advisories, duplicate prose, delayed assignment, rejection, and batch publication mean record count is not a count of independent root causes, patches, products, or exposed assets.", "Broad and undetermined reviews preserve public uncertainty; they must not be promoted to source-level root-cause claims.", "Raw descriptions are omitted from this public ledger to avoid duplicating exploit-oriented text. Pinned source references remain attached to each active record." ] }, "counts": { "all_records": 9808, "active_records": 9763, "rejected_records": 45, "reviewed_active_records": 9763, "cause_undetermined": 283, "primary_source_deep_dives": 376 }, "aggregates": { "cause_families": [ { "name": "AUTHORITY_BINDING", "count": 2449 }, { "name": "MEMORY_LIFETIME", "count": 1817 }, { "name": "INTERPRETER_BOUNDARY", "count": 1770 }, { "name": "REQUEST_CHANNEL_TRUST", "count": 761 }, { "name": "RESOURCE_CONTROL", "count": 607 }, { "name": "FILE_OBJECT_SELECTION", "count": 589 }, { "name": "STATE_SEQUENCE", "count": 477 }, { "name": "CRYPTO_SECRET", "count": 310 }, { "name": "EXPOSURE_OUTPUT", "count": 308 }, { "name": "UNDETERMINED", "count": 283 }, { "name": "OTHER_SPECIFIC", "count": 184 }, { "name": "CONFIG_UPDATE_DEPENDENCY", "count": 181 }, { "name": "HARDWARE_PHYSICAL", "count": 27 } ], "precision_levels": [ { "name": "SPECIFIC_RECORD", "count": 5084 }, { "name": "DESCRIPTION_SPECIFIC", "count": 2573 }, { "name": "BROAD_RECORD", "count": 1808 }, { "name": "UNDETERMINED", "count": 283 }, { "name": "SOURCE_TRACED", "count": 15 } ], "confidence_levels": [ { "name": "high", "count": 7291 }, { "name": "medium", "count": 2151 }, { "name": "low", "count": 321 } ], "publishers": [ { "name": "GitHub_M", "count": 1298 }, { "name": "oracle", "count": 1108 }, { "name": "Linux", "count": 837 }, { "name": "VulnCheck", "count": 705 }, { "name": "microsoft", "count": 648 }, { "name": "Chrome", "count": 487 }, { "name": "Patchstack", "count": 481 }, { "name": "Wordfence", "count": 454 }, { "name": "VulDB", "count": 440 }, { "name": "mitre", "count": 299 }, { "name": "WPScan", "count": 222 }, { "name": "apache", "count": 181 }, { "name": "apple", "count": 168 }, { "name": "redhat", "count": 164 }, { "name": "adobe", "count": 107 }, { "name": "Joomla", "count": 106 }, { "name": "ibm", "count": 105 }, { "name": "CPANSec", "count": 77 }, { "name": "mozilla", "count": 71 }, { "name": "TR-CERT", "count": 68 }, { "name": "HCL", "count": 60 }, { "name": "icscert", "count": 57 }, { "name": "CERT-PL", "count": 53 }, { "name": "drupal", "count": 46 }, { "name": "dell", "count": 43 }, { "name": "nvidia", "count": 43 }, { "name": "Gitea", "count": 40 }, { "name": "certcc", "count": 39 }, { "name": "hackerone", "count": 39 }, { "name": "EEF", "count": 38 }, { "name": "GitLab", "count": 35 }, { "name": "ProgressSoftware", "count": 33 }, { "name": "CERTVDE", "count": 31 }, { "name": "XEN", "count": 29 }, { "name": "Foxit", "count": 28 }, { "name": "elastic", "count": 28 }, { "name": "zephyr", "count": 28 }, { "name": "JetBrains", "count": 27 }, { "name": "vmware", "count": 27 }, { "name": "mongodb", "count": 26 }, { "name": "CSA", "count": 25 }, { "name": "wikimedia-foundation", "count": 25 }, { "name": "NLnet Labs", "count": 24 }, { "name": "zdi", "count": 23 }, { "name": "AMZN", "count": 22 }, { "name": "juniper", "count": 22 }, { "name": "eclipse", "count": 21 }, { "name": "suse", "count": 20 }, { "name": "GV", "count": 19 }, { "name": "Rockwell", "count": 19 }, { "name": "SamsungMobile", "count": 19 }, { "name": "cisco", "count": 19 }, { "name": "openjs", "count": 19 }, { "name": "CIRCL", "count": 18 }, { "name": "curl", "count": 18 }, { "name": "WatchGuard", "count": 17 }, { "name": "JFROG", "count": 16 }, { "name": "SolarWinds", "count": 16 }, { "name": "sap", "count": 16 }, { "name": "Mattermost", "count": 15 }, { "name": "DEVOLUTIONS", "count": 14 }, { "name": "INCIBE", "count": 14 }, { "name": "palo_alto", "count": 14 }, { "name": "ASUS", "count": 13 }, { "name": "NCSC.ch", "count": 13 }, { "name": "Absolute", "count": 12 }, { "name": "CyberDanube", "count": 12 }, { "name": "HashiCorp", "count": 12 }, { "name": "fortinet", "count": 12 }, { "name": "jpcert", "count": 12 }, { "name": "cisa-cg", "count": 11 }, { "name": "huawei", "count": 11 }, { "name": "qualcomm", "count": 11 }, { "name": "securin", "count": 11 }, { "name": "@huntr_ai", "count": 10 }, { "name": "DIVD", "count": 10 }, { "name": "TPLink", "count": 10 }, { "name": "twcert", "count": 10 }, { "name": "Google", "count": 9 }, { "name": "Secur0", "count": 9 }, { "name": "imaginationtech", "count": 9 }, { "name": "isc", "count": 9 }, { "name": "lenovo", "count": 9 }, { "name": "ASUSTOR1", "count": 8 }, { "name": "GRAFANA", "count": 8 }, { "name": "OpenVPN", "count": 8 }, { "name": "PostgreSQL", "count": 8 }, { "name": "f5", "count": 8 }, { "name": "MediaTek", "count": 7 }, { "name": "Nozomi", "count": 7 }, { "name": "SRA", "count": 7 }, { "name": "canonical", "count": 7 }, { "name": "jci", "count": 7 }, { "name": "runZero", "count": 7 }, { "name": "sba-research", "count": 7 }, { "name": "siemens", "count": 7 }, { "name": "tenable", "count": 7 }, { "name": "NETGEAR", "count": 6 }, { "name": "SNOWFLAKE", "count": 6 }, { "name": "TML", "count": 6 }, { "name": "blackberry", "count": 6 }, { "name": "hikvision", "count": 6 }, { "name": "hpe", "count": 6 }, { "name": "samsung.tv_appliance", "count": 6 }, { "name": "Deltaww", "count": 5 }, { "name": "Docker", "count": 5 }, { "name": "ERIC", "count": 5 }, { "name": "Sonatype", "count": 5 }, { "name": "WSO2", "count": 5 }, { "name": "airbus", "count": 5 }, { "name": "3DS", "count": 4 }, { "name": "BT", "count": 4 }, { "name": "EDB", "count": 4 }, { "name": "ESET", "count": 4 }, { "name": "Esri", "count": 4 }, { "name": "GitHub_P", "count": 4 }, { "name": "Go", "count": 4 }, { "name": "GoogleCloud", "count": 4 }, { "name": "TQtC", "count": 4 }, { "name": "Tanium", "count": 4 }, { "name": "Zoom", "count": 4 }, { "name": "php", "count": 4 }, { "name": "rami.io", "count": 4 }, { "name": "ABB", "count": 3 }, { "name": "Arista", "count": 3 }, { "name": "Checkmk", "count": 3 }, { "name": "Ciena", "count": 3 }, { "name": "DSF", "count": 3 }, { "name": "Eaton", "count": 3 }, { "name": "Gallagher", "count": 3 }, { "name": "HDFG", "count": 3 }, { "name": "Kong", "count": 3 }, { "name": "OX", "count": 3 }, { "name": "PRJBLK", "count": 3 }, { "name": "PSF", "count": 3 }, { "name": "Tigera", "count": 3 }, { "name": "Zohocorp", "count": 3 }, { "name": "atlassian", "count": 3 }, { "name": "autodesk", "count": 3 }, { "name": "bosch", "count": 3 }, { "name": "checkpoint", "count": 3 }, { "name": "cloudflare", "count": 3 }, { "name": "hp", "count": 3 }, { "name": "libreswan", "count": 3 }, { "name": "schneider", "count": 3 }, { "name": "snyk", "count": 3 }, { "name": "BLSOPS", "count": 2 }, { "name": "BlackDuck", "count": 2 }, { "name": "BombadilSystems", "count": 2 }, { "name": "CERT-In", "count": 2 }, { "name": "Citrix", "count": 2 }, { "name": "Cribl", "count": 2 }, { "name": "Digi", "count": 2 }, { "name": "ENISA", "count": 2 }, { "name": "ExtremeNetworks", "count": 2 }, { "name": "FTI", "count": 2 }, { "name": "Fluid Attacks", "count": 2 }, { "name": "Honeywell", "count": 2 }, { "name": "Meta", "count": 2 }, { "name": "Pega", "count": 2 }, { "name": "Perforce", "count": 2 }, { "name": "alibaba", "count": 2 }, { "name": "arcinfo", "count": 2 }, { "name": "bcorg", "count": 2 }, { "name": "bizerba", "count": 2 }, { "name": "illumos", "count": 2 }, { "name": "ivanti", "count": 2 }, { "name": "seal", "count": 2 }, { "name": "sonicwall", "count": 2 }, { "name": "symantec", "count": 2 }, { "name": "Altium", "count": 1 }, { "name": "Bitdefender", "count": 1 }, { "name": "Caliptra", "count": 1 }, { "name": "Canon_EMEA", "count": 1 }, { "name": "Cato", "count": 1 }, { "name": "Centreon", "count": 1 }, { "name": "Genetec", "count": 1 }, { "name": "LGE", "count": 1 }, { "name": "Milestone", "count": 1 }, { "name": "Mitsubishi", "count": 1 }, { "name": "OAI", "count": 1 }, { "name": "Octopus", "count": 1 }, { "name": "Omnissa", "count": 1 }, { "name": "SICK AG", "count": 1 }, { "name": "SN", "count": 1 }, { "name": "SailPoint", "count": 1 }, { "name": "Silabs", "count": 1 }, { "name": "Spotfire", "count": 1 }, { "name": "Supermicro", "count": 1 }, { "name": "TCS-CERT", "count": 1 }, { "name": "THA-PSIRT", "count": 1 }, { "name": "TV", "count": 1 }, { "name": "TXOne", "count": 1 }, { "name": "TYPO3", "count": 1 }, { "name": "ThinkstAppliedResearch", "count": 1 }, { "name": "Toreon", "count": 1 }, { "name": "Unisoc", "count": 1 }, { "name": "ZUSO ART", "count": 1 }, { "name": "Zyxel", "count": 1 }, { "name": "dotCMS", "count": 1 }, { "name": "fedora", "count": 1 }, { "name": "harborist", "count": 1 }, { "name": "kubernetes", "count": 1 }, { "name": "netapp", "count": 1 }, { "name": "rapid7", "count": 1 }, { "name": "redhat-cnalr", "count": 1 }, { "name": "trellix", "count": 1 }, { "name": "zte", "count": 1 } ], "id_years": [ { "name": "2026", "count": 9572 }, { "name": "2025", "count": 161 }, { "name": "2024", "count": 57 }, { "name": "2021", "count": 6 }, { "name": "2023", "count": 5 }, { "name": "2022", "count": 4 }, { "name": "2011", "count": 1 }, { "name": "2016", "count": 1 }, { "name": "2019", "count": 1 } ], "publication_days": [ { "date": "2026-07-01", "count": 365 }, { "date": "2026-07-02", "count": 266 }, { "date": "2026-07-03", "count": 180 }, { "date": "2026-07-04", "count": 72 }, { "date": "2026-07-05", "count": 87 }, { "date": "2026-07-06", "count": 196 }, { "date": "2026-07-07", "count": 166 }, { "date": "2026-07-08", "count": 364 }, { "date": "2026-07-09", "count": 277 }, { "date": "2026-07-10", "count": 348 }, { "date": "2026-07-11", "count": 79 }, { "date": "2026-07-12", "count": 63 }, { "date": "2026-07-13", "count": 336 }, { "date": "2026-07-14", "count": 1007 }, { "date": "2026-07-15", "count": 269 }, { "date": "2026-07-16", "count": 247 }, { "date": "2026-07-17", "count": 290 }, { "date": "2026-07-18", "count": 81 }, { "date": "2026-07-19", "count": 466 }, { "date": "2026-07-20", "count": 270 }, { "date": "2026-07-21", "count": 1474 }, { "date": "2026-07-22", "count": 200 }, { "date": "2026-07-23", "count": 377 }, { "date": "2026-07-24", "count": 192 }, { "date": "2026-07-25", "count": 284 }, { "date": "2026-07-26", "count": 15 }, { "date": "2026-07-27", "count": 449 }, { "date": "2026-07-28", "count": 259 }, { "date": "2026-07-29", "count": 275 }, { "date": "2026-07-30", "count": 669 }, { "date": "2026-07-31", "count": 185 } ], "top_publisher_day_batches": [ { "date": "2026-07-21", "publisher": "oracle", "records": 1097, "unique_products": 262, "unique_references": 1, "top_cwes": [ { "name": "CWE-284", "count": 678 }, { "name": "CWE-306", "count": 252 }, { "name": "CWE-269", "count": 125 }, { "name": "CWE-200", "count": 110 }, { "name": "CWE-287", "count": 72 } ] }, { "date": "2026-07-14", "publisher": "microsoft", "records": 570, "unique_products": 104, "unique_references": 576, "top_cwes": [ { "name": "CWE-416", "count": 131 }, { "name": "CWE-122", "count": 111 }, { "name": "CWE-125", "count": 56 }, { "name": "CWE-362", "count": 56 }, { "name": "CWE-200", "count": 29 } ] }, { "date": "2026-07-19", "publisher": "Linux", "records": 431, "unique_products": 1, "unique_references": 2276, "top_cwes": [ { "name": "CWE-416", "count": 13 }, { "name": "CWE-476", "count": 7 }, { "name": "CWE-125", "count": 5 }, { "name": "CWE-401", "count": 5 }, { "name": "CWE-129", "count": 2 } ] }, { "date": "2026-07-30", "publisher": "Chrome", "records": 370, "unique_products": 1, "unique_references": 371, "top_cwes": [ { "name": "CWE-20", "count": 74 }, { "name": "CWE-346", "count": 63 }, { "name": "CWE-416", "count": 51 }, { "name": "CWE-451", "count": 33 }, { "name": "CWE-693", "count": 20 } ] }, { "date": "2026-07-25", "publisher": "Linux", "records": 274, "unique_products": 1, "unique_references": 1572, "top_cwes": [] }, { "date": "2026-07-27", "publisher": "apple", "records": 164, "unique_products": 6, "unique_references": 11, "top_cwes": [ { "name": "CWE-119", "count": 23 }, { "name": "CWE-200", "count": 18 }, { "name": "CWE-787", "count": 17 }, { "name": "CWE-125", "count": 13 }, { "name": "CWE-416", "count": 13 } ] }, { "date": "2026-07-23", "publisher": "Patchstack", "records": 156, "unique_products": 129, "unique_references": 156, "top_cwes": [ { "name": "CWE-862", "count": 47 }, { "name": "CWE-79", "count": 44 }, { "name": "CWE-89", "count": 15 }, { "name": "CWE-352", "count": 13 }, { "name": "CWE-497", "count": 8 } ] }, { "date": "2026-07-13", "publisher": "Patchstack", "records": 149, "unique_products": 136, "unique_references": 149, "top_cwes": [ { "name": "CWE-79", "count": 51 }, { "name": "CWE-862", "count": 33 }, { "name": "CWE-98", "count": 18 }, { "name": "CWE-89", "count": 13 }, { "name": "CWE-502", "count": 8 } ] }, { "date": "2026-07-08", "publisher": "GitHub_M", "records": 126, "unique_products": 53, "unique_references": 434, "top_cwes": [ { "name": "CWE-22", "count": 13 }, { "name": "CWE-407", "count": 11 }, { "name": "CWE-79", "count": 10 }, { "name": "CWE-863", "count": 9 }, { "name": "CWE-345", "count": 5 } ] }, { "date": "2026-07-15", "publisher": "GitHub_M", "records": 115, "unique_products": 50, "unique_references": 322, "top_cwes": [ { "name": "CWE-287", "count": 12 }, { "name": "CWE-862", "count": 11 }, { "name": "CWE-863", "count": 11 }, { "name": "CWE-79", "count": 9 }, { "name": "CWE-639", "count": 8 } ] }, { "date": "2026-07-10", "publisher": "GitHub_M", "records": 114, "unique_products": 35, "unique_references": 388, "top_cwes": [ { "name": "CWE-79", "count": 11 }, { "name": "CWE-863", "count": 11 }, { "name": "CWE-918", "count": 9 }, { "name": "CWE-862", "count": 8 }, { "name": "CWE-639", "count": 7 } ] }, { "date": "2026-07-20", "publisher": "GitHub_M", "records": 99, "unique_products": 40, "unique_references": 158, "top_cwes": [ { "name": "CWE-22", "count": 11 }, { "name": "CWE-79", "count": 9 }, { "name": "CWE-862", "count": 7 }, { "name": "CWE-285", "count": 6 }, { "name": "CWE-287", "count": 6 } ] }, { "date": "2026-07-14", "publisher": "GitHub_M", "records": 98, "unique_products": 46, "unique_references": 284, "top_cwes": [ { "name": "CWE-79", "count": 12 }, { "name": "CWE-400", "count": 10 }, { "name": "CWE-693", "count": 10 }, { "name": "CWE-863", "count": 9 }, { "name": "CWE-1333", "count": 6 } ] }, { "date": "2026-07-02", "publisher": "Patchstack", "records": 97, "unique_products": 91, "unique_references": 97, "top_cwes": [ { "name": "CWE-79", "count": 44 }, { "name": "CWE-862", "count": 15 }, { "name": "CWE-352", "count": 8 }, { "name": "CWE-89", "count": 7 }, { "name": "CWE-98", "count": 6 } ] }, { "date": "2026-07-16", "publisher": "GitHub_M", "records": 94, "unique_products": 40, "unique_references": 255, "top_cwes": [ { "name": "CWE-22", "count": 14 }, { "name": "CWE-94", "count": 11 }, { "name": "CWE-862", "count": 10 }, { "name": "CWE-400", "count": 7 }, { "name": "CWE-20", "count": 5 } ] }, { "date": "2026-07-14", "publisher": "adobe", "records": 88, "unique_products": 22, "unique_references": 12, "top_cwes": [ { "name": "CWE-787", "count": 18 }, { "name": "CWE-79", "count": 14 }, { "name": "CWE-20", "count": 9 }, { "name": "CWE-863", "count": 9 }, { "name": "CWE-22", "count": 5 } ] }, { "date": "2026-07-09", "publisher": "GitHub_M", "records": 78, "unique_products": 23, "unique_references": 258, "top_cwes": [ { "name": "CWE-862", "count": 11 }, { "name": "CWE-200", "count": 8 }, { "name": "CWE-22", "count": 6 }, { "name": "CWE-79", "count": 6 }, { "name": "CWE-94", "count": 6 } ] }, { "date": "2026-07-17", "publisher": "GitHub_M", "records": 78, "unique_products": 53, "unique_references": 279, "top_cwes": [ { "name": "CWE-770", "count": 15 }, { "name": "CWE-862", "count": 6 }, { "name": "CWE-400", "count": 5 }, { "name": "CWE-79", "count": 5 }, { "name": "CWE-918", "count": 4 } ] }, { "date": "2026-07-05", "publisher": "VulDB", "records": 74, "unique_products": 32, "unique_references": 405, "top_cwes": [ { "name": "CWE-74", "count": 44 }, { "name": "CWE-89", "count": 41 }, { "name": "CWE-284", "count": 5 }, { "name": "CWE-285", "count": 5 }, { "name": "CWE-434", "count": 5 } ] }, { "date": "2026-07-06", "publisher": "GitHub_M", "records": 69, "unique_products": 18, "unique_references": 132, "top_cwes": [ { "name": "CWE-78", "count": 8 }, { "name": "CWE-22", "count": 6 }, { "name": "CWE-918", "count": 5 }, { "name": "CWE-306", "count": 4 }, { "name": "CWE-59", "count": 4 } ] }, { "date": "2026-07-21", "publisher": "GitHub_M", "records": 66, "unique_products": 28, "unique_references": 120, "top_cwes": [ { "name": "CWE-639", "count": 9 }, { "name": "CWE-862", "count": 9 }, { "name": "CWE-269", "count": 6 }, { "name": "CWE-22", "count": 5 }, { "name": "CWE-284", "count": 5 } ] }, { "date": "2026-07-21", "publisher": "mozilla", "records": 64, "unique_products": 2, "unique_references": 74, "top_cwes": [ { "name": "CWE-119", "count": 11 }, { "name": "CWE-693", "count": 11 }, { "name": "CWE-200", "count": 8 }, { "name": "CWE-269", "count": 7 }, { "name": "CWE-346", "count": 7 } ] }, { "date": "2026-07-27", "publisher": "Patchstack", "records": 64, "unique_products": 61, "unique_references": 64, "top_cwes": [ { "name": "CWE-79", "count": 23 }, { "name": "CWE-862", "count": 15 }, { "name": "CWE-89", "count": 8 }, { "name": "CWE-918", "count": 5 }, { "name": "CWE-497", "count": 4 } ] }, { "date": "2026-07-07", "publisher": "GitHub_M", "records": 62, "unique_products": 16, "unique_references": 172, "top_cwes": [ { "name": "CWE-78", "count": 12 }, { "name": "CWE-639", "count": 6 }, { "name": "CWE-863", "count": 6 }, { "name": "CWE-285", "count": 4 }, { "name": "CWE-862", "count": 4 } ] }, { "date": "2026-07-23", "publisher": "VulnCheck", "records": 59, "unique_products": 25, "unique_references": 135, "top_cwes": [ { "name": "CWE-79", "count": 18 }, { "name": "CWE-22", "count": 13 }, { "name": "CWE-787", "count": 4 }, { "name": "CWE-639", "count": 3 }, { "name": "CWE-131", "count": 2 } ] }, { "date": "2026-07-28", "publisher": "GitHub_M", "records": 56, "unique_products": 24, "unique_references": 147, "top_cwes": [ { "name": "CWE-200", "count": 6 }, { "name": "CWE-22", "count": 6 }, { "name": "CWE-918", "count": 6 }, { "name": "CWE-94", "count": 6 }, { "name": "CWE-400", "count": 5 } ] }, { "date": "2026-07-20", "publisher": "VulnCheck", "records": 54, "unique_products": 18, "unique_references": 131, "top_cwes": [ { "name": "CWE-918", "count": 8 }, { "name": "CWE-863", "count": 7 }, { "name": "CWE-639", "count": 3 }, { "name": "CWE-674", "count": 3 }, { "name": "CWE-862", "count": 3 } ] }, { "date": "2026-07-11", "publisher": "Wordfence", "records": 53, "unique_products": 49, "unique_references": 383, "top_cwes": [ { "name": "CWE-79", "count": 15 }, { "name": "CWE-862", "count": 13 }, { "name": "CWE-89", "count": 6 }, { "name": "CWE-200", "count": 4 }, { "name": "CWE-22", "count": 2 } ] }, { "date": "2026-07-17", "publisher": "VulnCheck", "records": 53, "unique_products": 15, "unique_references": 116, "top_cwes": [ { "name": "CWE-863", "count": 12 }, { "name": "CWE-862", "count": 8 }, { "name": "CWE-918", "count": 6 }, { "name": "CWE-639", "count": 4 }, { "name": "CWE-306", "count": 3 } ] }, { "date": "2026-07-01", "publisher": "Chrome", "records": 52, "unique_products": 1, "unique_references": 53, "top_cwes": [ { "name": "CWE-416", "count": 11 }, { "name": "CWE-125", "count": 8 }, { "name": "CWE-20", "count": 7 }, { "name": "CWE-457", "count": 7 }, { "name": "CWE-787", "count": 7 } ] }, { "date": "2026-07-10", "publisher": "Wordfence", "records": 51, "unique_products": 49, "unique_references": 292, "top_cwes": [ { "name": "CWE-79", "count": 16 }, { "name": "CWE-862", "count": 11 }, { "name": "CWE-89", "count": 8 }, { "name": "CWE-434", "count": 3 }, { "name": "CWE-352", "count": 2 } ] }, { "date": "2026-07-15", "publisher": "VulnCheck", "records": 50, "unique_products": 16, "unique_references": 116, "top_cwes": [ { "name": "CWE-401", "count": 10 }, { "name": "CWE-20", "count": 3 }, { "name": "CWE-22", "count": 3 }, { "name": "CWE-287", "count": 3 }, { "name": "CWE-639", "count": 3 } ] }, { "date": "2026-07-31", "publisher": "GitHub_M", "records": 49, "unique_products": 24, "unique_references": 135, "top_cwes": [ { "name": "CWE-22", "count": 8 }, { "name": "CWE-200", "count": 5 }, { "name": "CWE-400", "count": 4 }, { "name": "CWE-863", "count": 4 }, { "name": "CWE-918", "count": 4 } ] }, { "date": "2026-07-24", "publisher": "Linux", "records": 48, "unique_products": 1, "unique_references": 241, "top_cwes": [] }, { "date": "2026-07-29", "publisher": "GitHub_M", "records": 48, "unique_products": 19, "unique_references": 98, "top_cwes": [ { "name": "CWE-918", "count": 10 }, { "name": "CWE-74", "count": 5 }, { "name": "CWE-770", "count": 5 }, { "name": "CWE-1336", "count": 4 }, { "name": "CWE-522", "count": 4 } ] }, { "date": "2026-07-01", "publisher": "GitHub_M", "records": 46, "unique_products": 20, "unique_references": 63, "top_cwes": [ { "name": "CWE-79", "count": 8 }, { "name": "CWE-400", "count": 6 }, { "name": "CWE-280", "count": 3 }, { "name": "CWE-862", "count": 3 }, { "name": "CWE-1321", "count": 2 } ] }, { "date": "2026-07-10", "publisher": "drupal", "records": 46, "unique_products": 36, "unique_references": 46, "top_cwes": [ { "name": "CWE-79", "count": 13 }, { "name": "CWE-862", "count": 9 }, { "name": "CWE-915", "count": 8 }, { "name": "CWE-863", "count": 3 }, { "name": "CWE-287", "count": 2 } ] }, { "date": "2026-07-13", "publisher": "VulDB", "records": 44, "unique_products": 31, "unique_references": 262, "top_cwes": [ { "name": "CWE-74", "count": 8 }, { "name": "CWE-89", "count": 7 }, { "name": "CWE-94", "count": 7 }, { "name": "CWE-119", "count": 5 }, { "name": "CWE-22", "count": 5 } ] }, { "date": "2026-07-03", "publisher": "microsoft", "records": 43, "unique_products": 1, "unique_references": 43, "top_cwes": [ { "name": "CWE-416", "count": 8 }, { "name": "CWE-843", "count": 6 }, { "name": "CWE-284", "count": 3 }, { "name": "CWE-79", "count": 3 }, { "name": "CWE-918", "count": 3 } ] }, { "date": "2026-07-12", "publisher": "VulDB", "records": 42, "unique_products": 27, "unique_references": 212, "top_cwes": [ { "name": "CWE-74", "count": 12 }, { "name": "CWE-266", "count": 9 }, { "name": "CWE-89", "count": 9 }, { "name": "CWE-77", "count": 8 }, { "name": "CWE-285", "count": 7 } ] }, { "date": "2026-07-08", "publisher": "VulnCheck", "records": 41, "unique_products": 23, "unique_references": 112, "top_cwes": [ { "name": "CWE-79", "count": 4 }, { "name": "CWE-863", "count": 4 }, { "name": "CWE-125", "count": 3 }, { "name": "CWE-200", "count": 3 }, { "name": "CWE-862", "count": 3 } ] }, { "date": "2026-07-13", "publisher": "VulnCheck", "records": 41, "unique_products": 16, "unique_references": 92, "top_cwes": [ { "name": "CWE-863", "count": 9 }, { "name": "CWE-862", "count": 4 }, { "name": "CWE-918", "count": 4 }, { "name": "CWE-22", "count": 3 }, { "name": "CWE-79", "count": 3 } ] }, { "date": "2026-07-29", "publisher": "apache", "records": 41, "unique_products": 4, "unique_references": 9, "top_cwes": [ { "name": "CWE-121", "count": 5 }, { "name": "CWE-444", "count": 5 }, { "name": "CWE-787", "count": 5 }, { "name": "CWE-20", "count": 3 }, { "name": "CWE-400", "count": 3 } ] }, { "date": "2026-07-03", "publisher": "Gitea", "records": 40, "unique_products": 1, "unique_references": 87, "top_cwes": [ { "name": "CWE-284", "count": 14 }, { "name": "CWE-863", "count": 8 }, { "name": "CWE-862", "count": 4 }, { "name": "CWE-200", "count": 3 }, { "name": "CWE-639", "count": 3 } ] }, { "date": "2026-07-04", "publisher": "VulDB", "records": 40, "unique_products": 19, "unique_references": 231, "top_cwes": [ { "name": "CWE-74", "count": 15 }, { "name": "CWE-89", "count": 15 }, { "name": "CWE-404", "count": 7 }, { "name": "CWE-79", "count": 4 }, { "name": "CWE-94", "count": 4 } ] }, { "date": "2026-07-06", "publisher": "apache", "records": 39, "unique_products": 16, "unique_references": 73, "top_cwes": [ { "name": "CWE-20", "count": 21 }, { "name": "CWE-502", "count": 7 }, { "name": "CWE-918", "count": 5 }, { "name": "CWE-200", "count": 4 }, { "name": "CWE-639", "count": 4 } ] }, { "date": "2026-07-09", "publisher": "Wordfence", "records": 38, "unique_products": 34, "unique_references": 267, "top_cwes": [ { "name": "CWE-862", "count": 13 }, { "name": "CWE-79", "count": 10 }, { "name": "CWE-639", "count": 4 }, { "name": "CWE-287", "count": 3 }, { "name": "CWE-22", "count": 2 } ] }, { "date": "2026-07-10", "publisher": "VulnCheck", "records": 38, "unique_products": 18, "unique_references": 100, "top_cwes": [ { "name": "CWE-22", "count": 4 }, { "name": "CWE-79", "count": 4 }, { "name": "CWE-862", "count": 3 }, { "name": "CWE-639", "count": 2 }, { "name": "CWE-693", "count": 2 } ] }, { "date": "2026-07-14", "publisher": "VulDB", "records": 37, "unique_products": 19, "unique_references": 222, "top_cwes": [ { "name": "CWE-119", "count": 7 }, { "name": "CWE-121", "count": 7 }, { "name": "CWE-918", "count": 6 }, { "name": "CWE-94", "count": 6 }, { "name": "CWE-1321", "count": 4 } ] }, { "date": "2026-07-18", "publisher": "VulDB", "records": 37, "unique_products": 14, "unique_references": 222, "top_cwes": [ { "name": "CWE-918", "count": 7 }, { "name": "CWE-285", "count": 6 }, { "name": "CWE-863", "count": 6 }, { "name": "CWE-74", "count": 4 }, { "name": "CWE-94", "count": 4 } ] } ], "top_shared_references": [ { "url": "https://www.oracle.com/security-alerts/cpujul2026.html", "records": 1108 }, { "url": "https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html", "records": 370 }, { "url": "https://support.apple.com/en-us/128067", "records": 149 }, { "url": "https://support.apple.com/en-us/128071", "records": 122 }, { "url": "https://support.apple.com/en-us/128072", "records": 112 }, { "url": "https://support.apple.com/en-us/128066", "records": 83 }, { "url": "https://support.apple.com/en-us/128069", "records": 66 }, { "url": "https://support.apple.com/en-us/128070", "records": 66 }, { "url": "https://support.apple.com/en-us/128068", "records": 64 }, { "url": "https://www.mozilla.org/security/advisories/mfsa2026-68/", "records": 63 }, { "url": "https://www.mozilla.org/security/advisories/mfsa2026-71/", "records": 61 }, { "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html", "records": 52 }, { "url": "https://www.sourcecodester.com/", "records": 49 }, { "url": "https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d", "records": 38 }, { "url": "https://code-projects.org/", "records": 33 }, { "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/", "records": 33 }, { "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/", "records": 32 }, { "url": "https://regularlabs.com/", "records": 29 }, { "url": "https://www.foxit.com/support/security-bulletins.html", "records": 28 }, { "url": "https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html", "records": 27 }, { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "records": 27 }, { "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc", "records": 25 }, { "url": "https://github.com/symfony/symfony/releases/tag/v7.4.12", "records": 23 }, { "url": "https://github.com/symfony/symfony/releases/tag/v8.0.12", "records": 23 }, { "url": "https://gist.github.com/cyberinforepo/d5b2771d82e1b31b8fc1c33052e08dad", "records": 22 }, { "url": "https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities", "records": 21 }, { "url": "https://www.certvde.com/en/advisories/VDE-2026-008/", "records": 20 }, { "url": "https://cna.openjsf.org/security-advisories.html", "records": 19 }, { "url": "https://github.com/symfony/symfony/releases/tag/v6.4.40", "records": 19 }, { "url": "https://www.geovision.com.tw/cyber_security.php", "records": 19 }, { "url": "https://itsourcecode.com/", "records": 18 }, { "url": "https://github.com/coder/coder/releases/tag/v2.33.8", "records": 17 }, { "url": "https://github.com/coder/coder/releases/tag/v2.34.2", "records": 17 }, { "url": "https://github.com/coder/coder/releases/tag/v2.32.7", "records": 16 }, { "url": "https://github.com/open-webui/open-webui/releases/tag/v0.10.0", "records": 16 }, { "url": "https://url.sap/sapsecuritypatchday", "records": 16 }, { "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/", "records": 16 }, { "url": "https://blog.gitea.com/release-of-1.25.5/", "records": 15 }, { "url": "https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html", "records": 15 }, { "url": "https://codeastro.com/", "records": 15 }, { "url": "https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm", "records": 15 }, { "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.5", "records": 15 }, { "url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9", "records": 15 }, { "url": "https://mattermost.com/security-updates", "records": 15 }, { "url": "https://blog.gitea.com/release-of-1.26.3-and-1.26.4/", "records": 14 }, { "url": "https://github.com/coder/coder/releases/tag/v2.29.17", "records": 14 }, { "url": "https://helpx.adobe.com/security/products/magento/apsb26-73.html", "records": 14 }, { "url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07", "records": 14 }, { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "records": 14 }, { "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "records": 14 }, { "url": "https://www.mozilla.org/security/advisories/mfsa2026-69/", "records": 14 }, { "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/", "records": 13 }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "records": 13 }, { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "records": 13 }, { "url": "https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1", "records": 13 }, { "url": "https://github.com/MervinPraison/PraisonAI/commit/ef79b7a0561796ad9807f0f09538c25cc78d3619", "records": 13 }, { "url": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471", "records": 13 }, { "url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2", "records": 13 }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final", "records": 13 }, { "url": "https://github.com/nextlevelbuilder/goclaw/", "records": 13 }, { "url": "https://github.com/sipeed/picoclaw/", "records": 13 }, { "url": "https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html", "records": 13 }, { "url": "https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html", "records": 13 }, { "url": "https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0256605430.html", "records": 12 }, { "url": "https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1", "records": 12 }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final", "records": 12 }, { "url": "https://github.com/symfony/symfony/releases/tag/v5.4.52", "records": 12 }, { "url": "https://github.com/twigphp/Twig/releases/tag/v3.26.0", "records": 12 }, { "url": "https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html", "records": 12 }, { "url": "https://www.balbooa.com/gridbox", "records": 12 }, { "url": "https://consumer.huawei.com/en/support/bulletin/2026/7/", "records": 11 }, { "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html", "records": 11 }, { "url": "https://github.com/NVIDIA/product-security/tree/main/2026/5841", "records": 11 }, { "url": "https://github.com/discourse/discourse/releases/tag/v2026.1.5", "records": 11 }, { "url": "https://github.com/discourse/discourse/releases/tag/v2026.4.2", "records": 11 }, { "url": "https://github.com/discourse/discourse/releases/tag/v2026.5.1", "records": 11 }, { "url": "https://github.com/discourse/discourse/releases/tag/v2026.6.0", "records": 11 }, { "url": "https://mysites.guru/blog/gridbox-23-critical-vulnerabilities/", "records": 11 }, { "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2026-2373", "records": 11 }, { "url": "https://access.redhat.com/errata/RHSA-2026:42922", "records": 10 }, { "url": "https://github.com/dataease/dataease/releases/tag/v2.10.23", "records": 10 }, { "url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1", "records": 10 }, { "url": "https://github.com/ultravnc/UltraVNC", "records": 10 }, { "url": "https://support.apple.com/en-us/128073", "records": 10 }, { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787", "records": 10 }, { "url": "https://uvnc.com/", "records": 10 }, { "url": "https://csirt.divd.nl/DIVD-2026-00001/", "records": 9 }, { "url": "https://downloads.isc.org/isc/bind9/9.20.26", "records": 9 }, { "url": "https://gfi.ai/products-and-solutions/network-security-solutions/archiver/resources/documentation/product-releases", "records": 9 }, { "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b", "records": 9 }, { "url": "https://github.com/radareorg/radare2/", "records": 9 }, { "url": "https://github.com/vercel/next.js/releases/tag/v16.2.11", "records": 9 }, { "url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html", "records": 9 }, { "url": "https://www.cyrusimap.org/imap/download/release-notes/index.html", "records": 9 }, { "url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities/", "records": 9 }, { "url": "https://blog.gitea.com/release-of-1.26.2/", "records": 8 }, { "url": "https://cert.pl/en/posts/2026/07/CVE-2026-53902", "records": 8 }, { "url": "https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/", "records": 8 }, { "url": "https://downloads.isc.org/isc/bind9/9.21.24", "records": 8 }, { "url": "https://github.com/better-auth/better-auth/releases/tag/v1.6.11", "records": 8 } ], "nvd_statuses": [ { "name": "Analyzed", "count": 3702 }, { "name": "Deferred", "count": 3581 }, { "name": "Awaiting Analysis", "count": 1318 }, { "name": "Undergoing Analysis", "count": 581 }, { "name": "Received", "count": 471 }, { "name": "Modified", "count": 110 } ], "rejected_reasons": [ { "name": "not_a_security_issue", "count": 33 }, { "name": "duplicate", "count": 5 }, { "name": "withdrawn_without_specific_public_reason", "count": 5 }, { "name": "erroneous_determination", "count": 1 }, { "name": "outside_component_threat_model", "count": 1 } ], "reservation_to_publication_lag": { "count": 9763, "p50_days": 13.2, "p90_days": 82.7, "p99_days": 302.3, "max_days": 1982, "over_one_year": 76, "over_five_years": 6, "percentile_method": "Linear interpolation at p*(n-1) over the complete July cohort (the inclusive empirical distribution)." }, "exact_duplicate_text": { "distinct_titles": 6801, "records_in_duplicate_title_clusters": 802, "duplicate_title_clusters": 227, "largest_title_cluster": 25, "distinct_descriptions": 9273, "records_in_duplicate_description_clusters": 752, "duplicate_description_clusters": 262, "largest_description_cluster": 32 }, "cvss_observed": { "maximum_observed_score_buckets": { "critical": 1447, "high": 4294, "low": 292, "medium": 3376, "none": 354 }, "records_with_source_score_spread_gte_1": 1268, "records_with_source_score_spread_gte_2": 640, "records_with_source_score_spread_gte_3": 374, "qualification": "Each record is bucketed by the maximum score observed across all retained CNA, ADP, and NVD rows. Scores can use different CVSS versions or assumptions; the source rows, vectors, and spread are retained and the maximum is not presented as a single official truth." } }, "records": [ { "cve_id": "CVE-2011-10043", "id_year": 2011, "state": "PUBLISHED", "date_reserved": "2026-07-05T11:47:35.949Z", "date_published": "2026-07-07T11:46:13.575Z", "date_updated": "2026-07-07T16:04:29.197Z", "publisher": "CPANSec", "title": "Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded", "affected": { "vendors": [ "BINGOS" ], "products": [ { "vendor": "BINGOS", "product": "Module::Load" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-145", "name": "Improper Neutralization of Section Delimiters", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00447, "percentile": 0.36738 }, "nvd": { "published": "2026-07-07T12:16:24.880", "lastModified": "2026-07-07T17:16:31.890", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2011-10043", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Module::Load treats a leading :: in a caller-supplied module name as a path delimiter and can load executable Perl code outside @INC.", "basis": [ "CNA", "CWE-145" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html", "host": "blogs.perl.org", "sources": [ "cna", "nvd" ], "tags": [ "technical-description" ] }, { "url": "https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/BINGOS/Module-Load-0.22/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 304, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2016-20096", "id_year": 2016, "state": "PUBLISHED", "date_reserved": "2026-07-21T18:49:01.724Z", "date_published": "2026-07-21T18:59:52.802Z", "date_updated": "2026-07-22T19:06:24.973Z", "publisher": "VulnCheck", "title": "Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp", "affected": { "vendors": [ "Kunshi Network Technology Co., Ltd." ], "products": [ { "vendor": "Kunshi Network Technology Co., Ltd.", "product": "Linknat VOS3000" }, { "vendor": "Kunshi Network Technology Co., Ltd.", "product": "Linknat VOS2009" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00382, "percentile": 0.30945 }, "nvd": { "published": "2026-07-21T19:17:07.357", "lastModified": "2026-07-23T15:24:59.880", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2016-20096", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The login endpoint inserts the attacker-controlled name parameter into an SQL command without separating data from SQL syntax.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://web.archive.org/web/20160601102456/http://www.wooyun.org/bugs/wooyun-2010-0145458", "host": "web.archive.org", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://packetstorm.news/files/id/137159", "host": "packetstorm.news", "sources": [ "cna", "nvd" ], "tags": [ "exploit" ] }, { "url": "https://www.linknat.com/", "host": "www.linknat.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://www.vulncheck.com/advisories/linknat-vos3000-vos2009-sql-injection-via-login-jsp", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 473, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 2, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2019-25764", "id_year": 2019, "state": "PUBLISHED", "date_reserved": "2026-06-23T07:34:36.865Z", "date_published": "2026-07-17T06:00:10.806Z", "date_updated": "2026-07-17T10:10:36.305Z", "publisher": "ASUS", "title": "**UNSUPPORTED WHEN ASSIGNED** Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verification and invoke arbitrary IOCTLs, resulting in privilege escalation.", "affected": { "vendors": [ "ASUS" ], "products": [ { "vendor": "ASUS", "product": "AURA SYNC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-782", "name": "Exposed IOCTL with Insufficient Access Control", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "type": "Secondary", "version": "4.0", "score": 7.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.0009, "percentile": 0.00541 }, "nvd": { "published": "2026-07-17T07:16:37.193", "lastModified": "2026-07-17T18:10:29.780", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2019-25764", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The AURA SYNC driver exposes IOCTL dispatch to a local user without an access check that limits the caller to the intended privileged subject.", "basis": [ "CNA", "CWE-782" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.asus.com/security-advisory", "host": "www.asus.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 364, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2021-27137", "id_year": 2021, "state": "PUBLISHED", "date_reserved": "2021-02-10T00:00:00.000Z", "date_published": "2026-07-16T00:00:00.000Z", "date_updated": "2026-07-22T03:55:45.793Z", "publisher": "mitre", "title": "An issue was discovered in router/upnp/src/ssdp.", "affected": { "vendors": [ "DD-WRT" ], "products": [ { "vendor": "DD-WRT", "product": "DD-WRT" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-121", "name": "Stack-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:cve@mitre.org", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.16488, "percentile": 0.9667 }, "official_kev": { "cveID": "CVE-2021-27137", "vendorProject": "DD-WRT", "product": "DD-WRT", "vulnerabilityName": "DD-WRT Stack-Based Buffer Overflow Vulnerability", "dateAdded": "2026-07-21", "shortDescription": "DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "dueDate": "2026-07-24", "knownRansomwareCampaignUse": "Unknown", "notes": "This vulnerability affects a common open-source component, third-party library, proprietary implementation, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://svn.dd-wrt.com/changeset/45724 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-27137", "cwes": [ "CWE-121" ] }, "nvd": { "published": "2026-07-16T18:16:39.113", "lastModified": "2026-07-22T05:17:07.330", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2021-27137", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The ssdp_msearch path copies attacker-controlled M-SEARCH data with strcpy into a fixed stack buffer without a length bound.", "basis": [ "CNA", "CWE-121", "CISA KEV feed" ], "deepDive": true, "notes": "Inspected the CISA KEV feed at https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; the linked DD-WRT patch at https://svn.dd-wrt.com/changeset/45724 was blocked by an Anubis browser challenge, so no source-traced claim is made." }, "references": [ { "url": "https://svn.dd-wrt.com/changeset/45724", "host": "svn.dd-wrt.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch" ] }, { "url": "https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/", "host": "ssd-disclosure.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "exploit" ] }, { "url": "https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html", "host": "securityaffairs.com", "sources": [ "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/", "host": "www.bleepingcomputer.com", "sources": [ "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo", "host": "www.fortinet.com", "sources": [ "cna", "nvd" ], "tags": [ "Exploit" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137", "host": "www.cisa.gov", "sources": [ "adp:0", "nvd" ], "tags": [ "US Government Resource", "government-resource" ] } ], "record_shape": { "descriptionChars": 427, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2021-32084", "id_year": 2021, "state": "PUBLISHED", "date_reserved": "2021-05-06T00:00:00.000Z", "date_published": "2026-07-27T00:00:00.000Z", "date_updated": "2026-07-28T14:55:09.026Z", "publisher": "mitre", "title": "An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00327, "percentile": 0.25209 }, "nvd": { "published": "2026-07-27T22:16:56.543", "lastModified": "2026-08-03T14:31:11.327", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2021-32084", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The appliance applies an IP allowlist to its web console but leaves API endpoints outside that network restriction.", "basis": [ "CNA", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.quest.com/download-product-select", "host": "support.quest.com", "sources": [ "cna", "nvd" ], "tags": [ "Product" ] }, { "url": "https://support.quest.com/kace-systems-management-appliance/kb/4293505/quest-response-to-criticalstart-vulnerability-report", "host": "support.quest.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 384, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2021-32085", "id_year": 2021, "state": "PUBLISHED", "date_reserved": "2021-05-06T00:00:00.000Z", "date_published": "2026-07-27T00:00:00.000Z", "date_updated": "2026-07-28T14:55:00.720Z", "publisher": "mitre", "title": "An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-798", "name": "Use of Hard-coded Credentials", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00293, "percentile": 0.21572 }, "nvd": { "published": "2026-07-27T22:16:57.500", "lastModified": "2026-08-03T14:31:07.000", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2021-32085", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The appliance creates database accounts with a publicly known default password that remains valid until an operator changes it.", "basis": [ "CNA", "CWE-798" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.quest.com/download-product-select", "host": "support.quest.com", "sources": [ "cna", "nvd" ], "tags": [ "Product" ] }, { "url": "https://support.quest.com/kace-systems-management-appliance/kb/4293505/quest-response-to-criticalstart-vulnerability-report", "host": "support.quest.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 413, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2021-32086", "id_year": 2021, "state": "PUBLISHED", "date_reserved": "2021-05-06T00:00:00.000Z", "date_published": "2026-07-27T00:00:00.000Z", "date_updated": "2026-07-28T14:54:54.862Z", "publisher": "mitre", "title": "An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-321", "name": "Use of Hard-coded Cryptographic Key", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0019, "percentile": 0.0895 }, "nvd": { "published": "2026-07-27T22:16:57.613", "lastModified": "2026-08-03T14:30:59.897", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2021-32086", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "the affected component uses the same embedded credential or cryptographic key across installations instead of a per-deployment secret.", "basis": [ "CNA", "CWE-321" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.quest.com/download-product-select", "host": "support.quest.com", "sources": [ "cna", "nvd" ], "tags": [ "Product" ] }, { "url": "https://support.quest.com/kace-systems-management-appliance/kb/4293505/quest-response-to-criticalstart-vulnerability-report", "host": "support.quest.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 448, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2021-32087", "id_year": 2021, "state": "PUBLISHED", "date_reserved": "2021-05-06T00:00:00.000Z", "date_published": "2026-07-27T00:00:00.000Z", "date_updated": "2026-07-28T18:47:08.899Z", "publisher": "mitre", "title": "An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-798", "name": "Use of Hard-coded Credentials", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00293, "percentile": 0.21572 }, "nvd": { "published": "2026-07-27T22:16:57.723", "lastModified": "2026-08-03T14:31:17.597", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2021-32087", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected component in CVE-2021-32087 ships a known default credential, allowing any caller who knows the published value to authenticate as the built-in account.", "basis": [ "CNA", "ADP", "NVD", "CWE-798" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.quest.com/download-product-select", "host": "support.quest.com", "sources": [ "cna", "nvd" ], "tags": [ "Product" ] }, { "url": "https://support.quest.com/kace-systems-management-appliance/kb/4293505/quest-response-to-criticalstart-vulnerability-report", "host": "support.quest.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 433, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2021-32088", "id_year": 2021, "state": "PUBLISHED", "date_reserved": "2021-05-06T00:00:00.000Z", "date_published": "2026-07-27T00:00:00.000Z", "date_updated": "2026-07-28T16:01:46.198Z", "publisher": "mitre", "title": "An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-384", "name": "Session Fixation", "abstraction": "Compound", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00287, "percentile": 0.20916 }, "nvd": { "published": "2026-07-27T22:16:57.840", "lastModified": "2026-08-03T14:30:47.763", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2021-32088", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The API rate limiter binds its state to the optional kboxid cookie, so removing that attacker-controlled identity marker bypasses the throttle.", "basis": [ "CNA", "NVD", "CWE-384", "Vendor advisory" ], "deepDive": true, "notes": "Inspected Quest's official advisory at https://support.quest.com/kace-systems-management-appliance/kb/4293505/quest-response-to-criticalstart-vulnerability-report; it identifies K1-30594 and the 11.1 repair but does not publish the limiter implementation, so the cookie-keyed mechanism remains bounded to the embedded CNA description." }, "references": [ { "url": "https://support.quest.com/download-product-select", "host": "support.quest.com", "sources": [ "cna", "nvd" ], "tags": [ "Product" ] }, { "url": "https://support.quest.com/kace-systems-management-appliance/kb/4293505/quest-response-to-criticalstart-vulnerability-report", "host": "support.quest.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 233, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2022-4989", "id_year": 2022, "state": "PUBLISHED", "date_reserved": "2026-05-19T05:59:50.869Z", "date_published": "2026-07-03T02:01:02.599Z", "date_updated": "2026-07-17T06:00:27.417Z", "publisher": "ASUS", "title": "** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to access unintended memory regions via crafted IOCTL requests, leading to privilege escalation.", "affected": { "vendors": [ "ASUS" ], "products": [ { "vendor": "ASUS", "product": "AI Suite 3" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "type": "Secondary", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00103, "percentile": 0.01166 }, "nvd": { "published": "2026-07-03T03:16:22.100", "lastModified": "2026-07-17T07:16:37.373", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2022-4989", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "AI Suite 3 accepts an IOCTL quantity without validating it against the permitted memory region, allowing access outside the intended range.", "basis": [ "CNA", "NVD", "CWE-1284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.asus.com/security-advisory", "host": "www.asus.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 366, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2022-4990", "id_year": 2022, "state": "PUBLISHED", "date_reserved": "2026-05-19T06:00:30.357Z", "date_published": "2026-07-03T02:00:47.500Z", "date_updated": "2026-07-17T06:00:36.108Z", "publisher": "ASUS", "title": "** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypass security validation and access restricted memory blocks via crafted IOCTL requests, leading to...", "affected": { "vendors": [ "ASUS" ], "products": [ { "vendor": "ASUS", "product": "AI Suite 3" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:54bf65a7-a193-42d2-b1ba-8e150d3c35e1", "type": "Secondary", "version": "4.0", "score": 7.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00096, "percentile": 0.00816 }, "nvd": { "published": "2026-07-03T03:16:23.087", "lastModified": "2026-07-17T07:16:37.490", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2022-4990", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The AI Suite driver accepts crafted IOCTL quantity values without validating them before using them to select restricted memory blocks.", "basis": [ "CNA", "CWE-1284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.asus.com/security-advisory", "host": "www.asus.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 396, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2022-4994", "id_year": 2022, "state": "PUBLISHED", "date_reserved": "2026-07-30T09:16:34.860Z", "date_published": "2026-07-30T09:18:06.591Z", "date_updated": "2026-07-30T09:18:06.591Z", "publisher": "Linux", "title": "KVM: x86: wean fast IN from emulator_pio_in", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 3, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00182, "percentile": 0.08011 }, "nvd": { "published": "2026-07-30T10:16:34.270", "lastModified": "2026-07-30T10:16:34.270", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2022-4994", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The record describes a no-op KVM PIO call-path cleanup and does not disclose an exploitable failure or causal invariant.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/dc7a4bfde507ffe1d8bef49aba1322f1d20c2cb3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 443, "referenceCount": 1, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2022-50973", "id_year": 2022, "state": "PUBLISHED", "date_reserved": "2026-01-11T13:34:26.334Z", "date_published": "2026-07-02T17:04:20.487Z", "date_updated": "2026-07-02T19:44:37.756Z", "publisher": "VulnCheck", "title": "Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet", "affected": { "vendors": [ "Yonyou Network Technology Co., Ltd." ], "products": [ { "vendor": "Yonyou Network Technology Co., Ltd.", "product": "KSOA" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0.5, "epss": { "score": 0.0086, "percentile": 0.54977 }, "nvd": { "published": "2026-07-02T17:16:56.947", "lastModified": "2026-07-02T20:16:59.920", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2022-50973", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The unauthenticated ImageUpload servlet accepts an arbitrary upload without constraining the stored file to the intended file namespace.", "basis": [ "CNA", "CWE-434" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://cn-sec.com/archives/1329088.html", "host": "cn-sec.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://buaq.net/go-167023.html", "host": "buaq.net", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.cnblogs.com/yang-miemie/p/17714927.html", "host": "www.cnblogs.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.yonyou.com/", "host": "www.yonyou.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://www.vulncheck.com/advisories/yonyou-ksoa-unauthenticated-file-upload-rce-via-imageupload-servlet", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 681, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2023-37507", "id_year": 2023, "state": "PUBLISHED", "date_reserved": "2023-07-06T16:11:40.095Z", "date_published": "2026-07-21T05:00:33.303Z", "date_updated": "2026-07-21T15:02:40.439Z", "publisher": "HCL", "title": "An information disclosure vulnerability affects HCL DevOps Plan", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "DevOps Plan" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-497", "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00249, "percentile": 0.16319 }, "nvd": { "published": "2026-07-21T06:16:27.113", "lastModified": "2026-07-29T20:50:23.543", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2023-37507", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record says HCL DevOps Plan reveals system information, while the exposed field and failing access boundary remain undisclosed.", "basis": [ "CNA", "CWE-497" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132309", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 146, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2023-37508", "id_year": 2023, "state": "PUBLISHED", "date_reserved": "2023-07-06T16:11:40.095Z", "date_published": "2026-07-21T04:34:15.196Z", "date_updated": "2026-07-21T13:27:06.182Z", "publisher": "HCL", "title": "HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "DevOps Plan" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 2.3, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "4.0", "score": 2.3, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 3.8, "epss": { "score": 0.0013, "percentile": 0.03006 }, "nvd": { "published": "2026-07-21T05:16:33.263", "lastModified": "2026-07-29T20:43:39.393", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2023-37508", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132308", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 175, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2023-49899", "id_year": 2023, "state": "PUBLISHED", "date_reserved": "2023-12-01T08:19:11.319Z", "date_published": "2026-07-16T10:11:32.404Z", "date_updated": "2026-07-18T02:46:07.283Z", "publisher": "CERTVDE", "title": "Origin Validation Error in X-Rite MA-T6", "affected": { "vendors": [ "X-Rite" ], "products": [ { "vendor": "X-Rite", "product": "MA-T6" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-346", "name": "Origin Validation Error", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:info@cert.vde.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0021, "percentile": 0.11371 }, "nvd": { "published": "2026-07-16T11:16:35.597", "lastModified": "2026-07-18T03:16:34.103", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2023-49899", "family": "REQUEST_CHANNEL_TRUST", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The device accepts a privileged communication channel without verifying its origin; the public record does not identify the channel or the omitted check.", "basis": [ "CNA", "CWE-346", "https://claroty.com/team82/disclosure-dashboard/cve-2023-49899" ], "deepDive": true, "notes": "Reviewed https://claroty.com/team82/disclosure-dashboard/cve-2023-49899. The researcher dashboard repeats the origin-validation category and affected firmware but does not publish the channel check or patch." }, "references": [ { "url": "https://claroty.com/team82/disclosure-dashboard/cve-2023-49899", "host": "claroty.com", "sources": [ "cna", "nvd" ], "tags": [ "related" ] } ], "record_shape": { "descriptionChars": 151, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2023-49900", "id_year": 2023, "state": "PUBLISHED", "date_reserved": "2023-12-01T08:19:11.319Z", "date_published": "2026-07-16T10:11:11.925Z", "date_updated": "2026-07-16T15:11:14.497Z", "publisher": "CERTVDE", "title": "Origin Validation Error in X-Rite MA-T6", "affected": { "vendors": [ "X-Rite" ], "products": [ { "vendor": "X-Rite", "product": "MA-T6" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:info@cert.vde.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00536, "percentile": 0.42165 }, "nvd": { "published": "2026-07-16T11:16:36.597", "lastModified": "2026-07-16T16:17:18.373", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2023-49900", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled command data reaches a command interpreter without safe argument separation or complete command-language neutralization.", "basis": [ "CNA", "CWE-78" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://claroty.com/team82/disclosure-dashboard/cve-2023-49900", "host": "claroty.com", "sources": [ "cna", "nvd" ], "tags": [ "related" ] } ], "record_shape": { "descriptionChars": 144, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2023-54366", "id_year": 2023, "state": "PUBLISHED", "date_reserved": "2026-06-22T21:54:30.246Z", "date_published": "2026-07-18T13:10:00.190Z", "date_updated": "2026-07-28T01:47:40.301Z", "publisher": "VulnCheck", "title": "SurrealDB before 1.0.1 Insecure Default Table Permissions", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-276", "name": "Incorrect Default Permissions", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00277, "percentile": 0.19962 }, "nvd": { "published": "2026-07-18T14:17:07.603", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2023-54366", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Installation or startup assigns a broader default permission than the product's intended private scope.", "basis": [ "CNA", "CWE-276" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x5fr-7hhj-34j3", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-insecure-default-table-permissions", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 351, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2024-1248", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-02-06T04:46:46.449Z", "date_published": "2026-07-04T20:38:49.590Z", "date_updated": "2026-07-06T13:50:13.770Z", "publisher": "WSO2", "title": "Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation", "affected": { "vendors": [ "WSO2" ], "products": [ { "vendor": "WSO2", "product": "WSO2 API Manager" }, { "vendor": "WSO2", "product": "WSO2 Identity Server" }, { "vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager" }, { "vendor": "WSO2", "product": "WSO2 Open Banking AM" }, { "vendor": "WSO2", "product": "WSO2 Open Banking IAM" } ], "affectedBlockCount": 5, "versionEntryCount": 18, "versionRangeCount": 18, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-298", "name": "Improper Validation of Certificate Expiration", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "source": "NVD:ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary", "version": "3.1", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00182, "percentile": 0.0805 }, "nvd": { "published": "2026-07-04T21:17:13.793", "lastModified": "2026-07-09T18:47:41.403", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2024-1248", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Silent JIT provisioning matches a federated identity to an existing local username and overwrites the local account roles with the federated role set.", "basis": [ "CNA", "CWE-298" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3179/", "host": "security.docs.wso2.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 816, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 5, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2024-5300", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-05-23T21:58:22.809Z", "date_published": "2026-07-21T14:00:51.066Z", "date_updated": "2026-07-22T18:28:16.818Z", "publisher": "canonical", "title": "AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd", "affected": { "vendors": [ "Canonical" ], "products": [ { "vendor": "Canonical", "product": "Ubuntu 26.04 LTS" }, { "vendor": "Canonical", "product": "Ubuntu 24.04 LTS" }, { "vendor": "Canonical", "product": "Ubuntu 22.04 LTS" }, { "vendor": "Canonical", "product": "Ubuntu 20.04 LTS" }, { "vendor": "Canonical", "product": "Ubuntu 18.04 LTS" }, { "vendor": "Canonical", "product": "Ubuntu 16.04 LTS" } ], "affectedBlockCount": 7, "versionEntryCount": 7, "versionRangeCount": 1, "defaultStatuses": [ "affected", "unaffected" ] }, "cwes": [ { "id": "CWE-212", "name": "Improper Removal of Sensitive Information Before Storage or Transfer", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N" }, { "source": "NVD:security@ubuntu.com", "type": "Secondary", "version": "3.1", "score": 5.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00099, "percentile": 0.00951 }, "nvd": { "published": "2026-07-21T15:16:29.027", "lastModified": "2026-07-22T19:16:53.303", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-5300", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The base AppArmor profile lets a confined root process reach systemd-userdbd sockets, whose authorization does not distinguish sandboxed root from host root.", "basis": [ "CNA", "CWE-212" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://ubuntu.com/security/CVE-2024-5300", "host": "ubuntu.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "vdb-entry" ] } ], "record_shape": { "descriptionChars": 1231, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 6, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2024-6228", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-06-20T20:27:35.683Z", "date_published": "2026-07-06T06:00:01.064Z", "date_updated": "2026-07-06T12:09:45.862Z", "publisher": "WPScan", "title": "WANotifier < 2.6 - Subscriber+ LFI", "affected": { "vendors": [ "Unknown" ], "products": [ { "vendor": "Unknown", "product": "Notifications for Forms & WordPress Actions" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00319, "percentile": 0.24279 }, "nvd": { "published": "2026-07-06T08:16:34.057", "lastModified": "2026-07-06T18:37:01.220", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-6228", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A subscriber-controlled value is used to build a server-side include path without restricting the resolved file to the intended directory.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://wpscan.com/vulnerability/6382bfea-6265-4f4b-b26e-4219d9ed78aa/", "host": "wpscan.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description", "vdb-entry" ] } ], "record_shape": { "descriptionChars": 307, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-7708", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-08-12T16:15:04.741Z", "date_published": "2026-07-14T09:01:53.869Z", "date_updated": "2026-07-14T12:17:11.635Z", "publisher": "eclipse", "title": "For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.", "affected": { "vendors": [ "Eclipse Foundation" ], "products": [ { "vendor": "Eclipse Foundation", "product": "Eclipse Jetty" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-400", "name": "Uncontrolled Resource Consumption", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:emo@eclipse.org", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00252, "percentile": 0.16631 }, "nvd": { "published": "2026-07-14T09:16:39.453", "lastModified": "2026-07-14T20:56:01.530", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2024-7708", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A request-body read that returns zero bytes leaves its buffer unreleased, so slow or 100-Continue requests can steadily exhaust memory.", "basis": [ "CNA", "CWE-400", "CWE-401" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/29", "host": "gitlab.eclipse.org", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 206, "referenceCount": 1, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2024-14037", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-02T15:40:17.092Z", "date_published": "2026-07-02T17:03:23.307Z", "date_updated": "2026-07-02T18:20:10.126Z", "publisher": "VulnCheck", "title": "Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob", "affected": { "vendors": [ "Guangzhou Red Sea Cloud Computing Co., Ltd." ], "products": [ { "vendor": "Guangzhou Red Sea Cloud Computing Co., Ltd.", "product": "Red Sea Cloud eHR" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00708, "percentile": 0.49945 }, "nvd": { "published": "2026-07-02T17:16:57.360", "lastModified": "2026-07-02T19:16:58.693", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-14037", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The upload endpoint accepts an attacker-named executable JSP as an image and stores it at a web-reachable path without restricting the dangerous file type.", "basis": [ "CNA", "CWE-434" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://cn-sec.com/archives/2734791.html", "host": "cn-sec.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://cn-sec.com/archives/3003231.html", "host": "cn-sec.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://redseacloud.com/", "host": "redseacloud.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://www.vulncheck.com/advisories/redsea-cloud-ehr-unauthenticated-file-upload-rce-via-ptfjk-mob", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 598, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-14040", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-26T06:29:25.532Z", "date_published": "2026-07-26T06:30:17.607Z", "date_updated": "2026-07-27T12:51:09.812Z", "publisher": "Linux", "title": "net: nexthop: Increase weight to u16", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 3, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0011, "percentile": 0.01505 }, "nvd": { "published": "2026-07-26T07:16:39.583", "lastModified": "2026-07-27T14:16:51.257", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-14040", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An 8-bit next-hop weight cannot represent required ECMP ratios, so the repair widens and audits the weight representation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3089, "referenceCount": 1, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2024-14041", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-28T05:07:53.475Z", "date_published": "2026-07-28T08:05:35.310Z", "date_updated": "2026-07-28T12:55:43.574Z", "publisher": "bcorg", "title": "ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)", "affected": { "vendors": [ "Legion of the Bouncy Castle Inc." ], "products": [ { "vendor": "Legion of the Bouncy Castle Inc.", "product": "BC-JAVA" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-208", "name": "Observable Timing Discrepancy", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/U:Amber" }, { "source": "NVD:91579145-5d7b-4cc5-b925-a0262ff19630", "type": "Secondary", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00275, "percentile": 0.19643 }, "nvd": { "published": "2026-07-28T08:17:12.367", "lastModified": "2026-07-30T16:27:52.133", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-14041", "family": "HARDWARE_PHYSICAL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Secret-derived ML-KEM coefficients pass through non-constant-time division, making decapsulation timing depend on the private key.", "basis": [ "CNA record", "CWE-208" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/bcgit/bc-java/wiki/CVE-2024-14041", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://github.com/bcgit/bc-java/commit/5adb2c5c5b462a332b01a012bea0784b40b904e5", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://github.com/bcgit/bc-java/commit/1590247178f2280defa36421475f015175dfbe9e", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://kyberslash.cr.yp.to/", "host": "kyberslash.cr.yp.to", "sources": [ "cna", "nvd" ], "tags": [ "technical-description" ] } ], "record_shape": { "descriptionChars": 642, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23564", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:56.729Z", "date_published": "2026-07-17T13:25:40.588Z", "date_updated": "2026-07-17T13:54:47.286Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response.", "affected": { "vendors": [ "HCL Software" ], "products": [ { "vendor": "HCL Software", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-326", "name": "Inadequate Encryption Strength", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00188, "percentile": 0.08685 }, "nvd": { "published": "2026-07-17T14:17:16.513", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23564", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The initial request validates UserId, but the password-email request omits the same identity check and lets the caller redirect the password to another address.", "basis": [ "CNA", "CWE-326" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 430, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23565", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:56.729Z", "date_published": "2026-07-17T13:36:31.972Z", "date_updated": "2026-07-17T15:15:03.298Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality.", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-799", "name": "Improper Control of Interaction Frequency", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00238, "percentile": 0.14862 }, "nvd": { "published": "2026-07-17T14:17:16.647", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23565", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The password-reset endpoint accepts an unbounded number of email requests, allowing one caller to exhaust mail-handling capacity.", "basis": [ "CNA", "CWE-799" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 326, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23566", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:56.729Z", "date_published": "2026-07-17T13:32:42.289Z", "date_updated": "2026-07-17T15:13:56.784Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented.", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-804", "name": "Guessable CAPTCHA", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00159, "percentile": 0.05565 }, "nvd": { "published": "2026-07-17T14:17:16.760", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23566", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The login path permits automated guesses without an effective CAPTCHA or equivalent attempt-control gate.", "basis": [ "CNA", "CWE-804" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 206, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23567", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:56.729Z", "date_published": "2026-07-17T13:28:43.206Z", "date_updated": "2026-07-17T13:54:13.031Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage.", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-804", "name": "Guessable CAPTCHA", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.0018, "percentile": 0.0779 }, "nvd": { "published": "2026-07-17T14:17:16.877", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23567", "family": "EXPOSURE_OUTPUT", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Sensitive values are placed in URL parameters, making them visible in browser history, server logs, and other URL-observing surfaces.", "basis": [ "CNA record", "NVD", "CWE-804" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 324, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23568", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:56.729Z", "date_published": "2026-07-17T13:38:28.022Z", "date_updated": "2026-07-17T15:17:21.200Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server.", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00238, "percentile": 0.14862 }, "nvd": { "published": "2026-07-17T14:17:16.990", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23568", "family": "EXPOSURE_OUTPUT", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The web server returns its software version to unauthenticated clients, exposing a banner that identifies potentially vulnerable server builds.", "basis": [ "CNA", "NVD", "CWE-200" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 351, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23569", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:56.729Z", "date_published": "2026-07-17T13:49:12.238Z", "date_updated": "2026-07-17T15:22:26.200Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection\" header", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-692", "name": "Incomplete Denylist to Cross-Site Scripting", "abstraction": "Compound", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00175, "percentile": 0.0715 }, "nvd": { "published": "2026-07-17T14:17:17.110", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23569", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Aftermarket EPC server omits the X-XSS-Protection response header, leaving the browser-side filter configuration at its ambient default.", "basis": [ "CNA", "CWE-692" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 109, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23570", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:59.076Z", "date_published": "2026-07-17T13:50:42.412Z", "date_updated": "2026-07-17T15:23:23.683Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in an iFrame on his malicious site.", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.0606 }, "nvd": { "published": "2026-07-17T14:17:17.223", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23570", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The page can be framed by an attacker-controlled site because the response does not enforce an effective anti-framing policy.", "basis": [ "CNA", "CWE-200" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 339, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23571", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:59.076Z", "date_published": "2026-07-17T13:42:48.152Z", "date_updated": "2026-07-17T15:18:44.014Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its form fields should be cached.", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-525", "name": "Use of Web Browser Cache Containing Sensitive Information", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00175, "percentile": 0.0715 }, "nvd": { "published": "2026-07-17T14:17:17.343", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23571", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Aftermarket EPC response lacks a restrictive browser-cache policy, leaving sensitive fields recoverable from a shared local cache.", "basis": [ "CNA", "CWE-525" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 364, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23572", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:59.076Z", "date_published": "2026-07-17T13:51:11.203Z", "date_updated": "2026-07-17T15:24:11.725Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue.", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-614", "name": "Sensitive Cookie in HTTPS Session Without 'Secure' Attribute", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 4.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00086, "percentile": 0.00398 }, "nvd": { "published": "2026-07-17T14:17:17.460", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23572", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "medium", "mechanism": "The session-token cookie is issued without the Secure attribute, allowing transport outside the intended HTTPS channel.", "basis": [ "CNA", "CWE-614" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 217, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23573", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:59.076Z", "date_published": "2026-07-17T13:42:13.216Z", "date_updated": "2026-07-17T15:17:56.645Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13.", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-425", "name": "Direct Request ('Forced Browsing')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 3.7, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 3.7, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 3.7, "cvss_source_score_spread": 0, "epss": { "score": 0.00155, "percentile": 0.05181 }, "nvd": { "published": "2026-07-17T14:17:17.573", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23573", "family": "CRYPTO_SECRET", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The record identifies a Lucky 13 timing oracle in TLS CBC processing, while the mismatched CWE-425 label and public advisory do not identify the variable-time operation.", "basis": [ "CNA", "CWE-425" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 316, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23574", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:59.076Z", "date_published": "2026-07-17T13:45:33.068Z", "date_updated": "2026-07-17T15:20:50.789Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in the system.", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-204", "name": "Observable Response Discrepancy", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00197, "percentile": 0.09731 }, "nvd": { "published": "2026-07-17T14:17:17.693", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23574", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The login response reveals whether a supplied account exists, enabling remote user enumeration.", "basis": [ "CNA", "CWE-204" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 295, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23575", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:59.076Z", "date_published": "2026-07-17T13:43:25.535Z", "date_updated": "2026-07-17T15:19:29.809Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server.", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-209", "name": "Generation of Error Message Containing Sensitive Information", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00197, "percentile": 0.09731 }, "nvd": { "published": "2026-07-17T14:17:17.810", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23575", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected response, log, or client-visible object emits sensitive data without the required redaction or audience restriction.", "basis": [ "CNA", "CWE-209" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 251, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23577", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:59.077Z", "date_published": "2026-07-17T13:46:04.378Z", "date_updated": "2026-07-17T15:21:21.423Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol.", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-20", "name": "Improper Input Validation", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00175, "percentile": 0.0715 }, "nvd": { "published": "2026-07-17T14:17:17.947", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23577", "family": "REQUEST_CHANNEL_TRUST", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "HCL Leap accepts a request Host value without publishing the exact canonicalization or allowlist check that fails.", "basis": [ "CNA", "CWE-20" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 330, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-23578", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-01-18T07:29:59.077Z", "date_published": "2026-07-17T13:50:08.817Z", "date_updated": "2026-07-17T15:22:55.528Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from any domain (*-Wildcard).", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-692", "name": "Incomplete Denylist to Cross-Site Scripting", "abstraction": "Compound", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna" ] }, { "id": "CWE-942", "name": "Permissive Cross-domain Security Policy with Untrusted Domains", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 4.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00122, "percentile": 0.0236 }, "nvd": { "published": "2026-07-17T14:17:18.063", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-23578", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The CORS policy grants browser cross-origin access to any requesting domain instead of an approved origin set.", "basis": [ "CNA", "CWE-692", "CWE-942" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 192, "referenceCount": 1, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-25039", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-02-03T14:49:24.713Z", "date_published": "2026-07-30T18:14:16.220Z", "date_updated": "2026-07-31T23:05:09.914Z", "publisher": "ibm", "title": "IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "Engineering Requirements Management DOORS and DOORS Web Access" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-400", "name": "Uncontrolled Resource Consumption", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:psirt@us.ibm.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00263, "percentile": 0.17961 }, "nvd": { "published": "2026-07-30T19:16:56.507", "lastModified": "2026-07-31T23:17:22.570", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-25039", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The HTTP service leaves Slowloris connections open without an effective length or duration bound, allowing connection slots to be exhausted.", "basis": [ "CNA", "CWE-400" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7279145", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 294, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2024-32385", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-04-12T00:00:00.000Z", "date_published": "2026-07-16T00:00:00.000Z", "date_updated": "2026-07-17T13:34:16.641Z", "publisher": "mitre", "title": "An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AC:L/AV:A/A:N/C:L/I:N/PR:N/S:U/UI:N" }, { "source": "NVD:cve@mitre.org", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00208, "percentile": 0.11023 }, "nvd": { "published": "2026-07-16T21:17:17.510", "lastModified": "2026-07-17T18:11:59.263", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-32385", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "low", "mechanism": "The product exposes board and revision identifiers to a remote requester, but the public record does not identify the missing disclosure control.", "basis": [ "CNA", "CWE-200" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.kerlink.com/", "host": "www.kerlink.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.bdosecurity.de/de-de/advisories/cve-2024-32385", "host": "www.bdosecurity.de", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 173, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-32386", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-04-12T00:00:00.000Z", "date_published": "2026-07-16T00:00:00.000Z", "date_updated": "2026-07-17T13:41:06.510Z", "publisher": "mitre", "title": "Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AC:L/AV:A/A:N/C:H/I:H/PR:N/S:U/UI:R" }, { "source": "NVD:cve@mitre.org", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00522, "percentile": 0.41416 }, "nvd": { "published": "2026-07-16T21:17:18.547", "lastModified": "2026-07-17T18:11:59.263", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-32386", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The SNMP update mechanism accepts traversal segments that select files outside its intended directory.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.kerlink.com/", "host": "www.kerlink.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.bdosecurity.de/de-de/advisories/cve-2024-32386", "host": "www.bdosecurity.de", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 189, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-32387", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-04-12T00:00:00.000Z", "date_published": "2026-07-16T00:00:00.000Z", "date_updated": "2026-07-17T13:42:03.575Z", "publisher": "mitre", "title": "An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] }, { "id": "CWE-798", "name": "Use of Hard-coded Credentials", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.7, "severity": "MEDIUM", "vector": "CVSS:3.1/AC:L/AV:A/A:N/C:H/I:N/PR:N/S:U/UI:R" }, { "source": "NVD:cve@mitre.org", "type": "Secondary", "version": "3.1", "score": 5.7, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.7, "cvss_source_score_spread": 0, "epss": { "score": 0.00202, "percentile": 0.10363 }, "nvd": { "published": "2026-07-16T21:17:18.670", "lastModified": "2026-07-17T18:11:59.263", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-32387", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "medium", "mechanism": "The device relies on a fixed or embedded SNMP community credential that can be used to obtain protected information, although the exposure path is not public.", "basis": [ "CNA", "NVD", "CWE-798" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.kerlink.com/", "host": "www.kerlink.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.bdosecurity.de/de-de/advisories/cve-2024-32387", "host": "www.bdosecurity.de", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 169, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 0, "adpCweCount": 2, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-32389", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-04-12T00:00:00.000Z", "date_published": "2026-07-16T00:00:00.000Z", "date_updated": "2026-07-17T13:40:20.550Z", "publisher": "mitre", "title": "Buffer Overflow vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 3.5, "severity": "LOW", "vector": "CVSS:3.1/AC:L/AV:A/A:N/C:L/I:N/PR:N/S:U/UI:R" }, { "source": "NVD:cve@mitre.org", "type": "Secondary", "version": "3.1", "score": 3.5, "severity": "LOW", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 3.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00209, "percentile": 0.11179 }, "nvd": { "published": "2026-07-16T21:17:18.777", "lastModified": "2026-07-17T18:11:59.263", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-32389", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected component path copies input without enforcing the destination buffer size.", "basis": [ "CNA", "CWE-120" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.kerlink.com/", "host": "www.kerlink.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.bdosecurity.de/de-de/advisories/cve-2024-32389", "host": "www.bdosecurity.de", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 185, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-34268", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-05-02T00:00:00.000Z", "date_published": "2026-07-16T00:00:00.000Z", "date_updated": "2026-07-17T13:39:24.468Z", "publisher": "mitre", "title": "EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AC:L/AV:A/A:L/C:N/I:H/PR:N/S:U/UI:N" }, { "source": "NVD:cve@mitre.org", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00206, "percentile": 0.10806 }, "nvd": { "published": "2026-07-16T21:17:18.890", "lastModified": "2026-07-17T18:11:59.263", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-34268", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The thermostat accepts Bluetooth control connections without requiring the peer to authenticate.", "basis": [ "CNA", "CWE-306" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.bdosecurity.de/de-de/advisories/cve-2024-34268", "host": "www.bdosecurity.de", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.eq-3.com", "host": "www.eq-3.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 246, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-40683", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-07-08T19:30:52.530Z", "date_published": "2026-07-30T18:11:56.676Z", "date_updated": "2026-07-30T19:22:14.290Z", "publisher": "ibm", "title": "IBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password change", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "Operations Analytics - Log Analysis" } ], "affectedBlockCount": 1, "versionEntryCount": 4, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-613", "name": "Insufficient Session Expiration", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "source": "NVD:psirt@us.ibm.com", "type": "Secondary", "version": "3.1", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00154, "percentile": 0.05041 }, "nvd": { "published": "2026-07-30T19:16:57.767", "lastModified": "2026-07-30T20:16:50.313", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-40683", "family": "STATE_SEQUENCE", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A credential-state change in Operations Analytics - Log Analysis leaves an earlier session or token valid after it should have been withdrawn.", "basis": [ "CNA", "CWE-613" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7279877", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 303, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2024-42214", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-07-29T21:32:16.371Z", "date_published": "2026-07-17T13:45:04.678Z", "date_updated": "2026-07-17T15:20:14.969Z", "publisher": "HCL", "title": "HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server.", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "Aftermarket EPC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-692", "name": "Incomplete Denylist to Cross-Site Scripting", "abstraction": "Compound", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00197, "percentile": 0.09732 }, "nvd": { "published": "2026-07-17T14:17:18.863", "lastModified": "2026-07-17T17:56:08.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-42214", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Aftermarket EPC enables or exposes a server method in its deployed configuration without the restriction needed to keep that capability outside untrusted reach.", "basis": [ "CNA", "NVD", "CWE-692" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 251, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-51311", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-10-28T00:00:00.000Z", "date_published": "2026-07-20T00:00:00.000Z", "date_updated": "2026-07-21T14:58:33.718Z", "publisher": "mitre", "title": "The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub_4418CC function of the file /goform/SetNetControlList.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-121", "name": "Stack-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00427, "percentile": 0.35183 }, "nvd": { "published": "2026-07-20T21:16:46.153", "lastModified": "2026-07-21T18:55:59.253", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-51311", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The SetNetControlList handler writes attacker-controlled data beyond a stack buffer in sub_4418CC.", "basis": [ "CNA", "NVD", "CWE-121" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.tendacn.com/download/detail-4515.html", "host": "www.tendacn.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://gitee.com/GXB0_0/iot-vul/blob/master/Tenda/TX9/20/SetNetControlList.md", "host": "gitee.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 136, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-51312", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-10-28T00:00:00.000Z", "date_published": "2026-07-20T00:00:00.000Z", "date_updated": "2026-07-21T14:58:22.886Z", "publisher": "mitre", "title": "The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 function of the file /goform/SetStaticRouteCfg.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-121", "name": "Stack-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00419, "percentile": 0.34475 }, "nvd": { "published": "2026-07-20T22:17:02.500", "lastModified": "2026-07-21T18:55:59.253", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-51312", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "the affected component copies attacker-controlled data past a fixed stack buffer because the input length is not bounded to the destination size.", "basis": [ "CNA", "ADP", "NVD", "CWE-121" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.tendacn.com/download/detail-4515.html", "host": "www.tendacn.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://gitee.com/GXB0_0/iot-vul/blob/master/Tenda/TX9/20/SetStaticRouteCfg.md", "host": "gitee.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 136, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-51313", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-10-28T00:00:00.000Z", "date_published": "2026-07-20T00:00:00.000Z", "date_updated": "2026-07-21T14:58:28.306Z", "publisher": "mitre", "title": "The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EA38 function of the file /goform/SetVirtualServerCfg.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-121", "name": "Stack-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00419, "percentile": 0.34475 }, "nvd": { "published": "2026-07-20T21:16:46.297", "lastModified": "2026-07-21T18:55:59.253", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-51313", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The SetVirtualServerCfg handler copies attacker-controlled data into a fixed stack buffer in sub_42EA38 without an effective length bound.", "basis": [ "CNA", "CWE-121" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.tendacn.com/download/detail-4515.html", "host": "www.tendacn.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://gitee.com/GXB0_0/iot-vul/blob/master/Tenda/TX9/20/SetNetControlList.md", "host": "gitee.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 138, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-51314", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-10-28T00:00:00.000Z", "date_published": "2026-07-20T00:00:00.000Z", "date_updated": "2026-07-21T14:58:17.255Z", "publisher": "mitre", "title": "The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of the file /goform/setMacFilterCfg.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-121", "name": "Stack-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00419, "percentile": 0.34475 }, "nvd": { "published": "2026-07-20T22:17:03.440", "lastModified": "2026-07-21T18:55:59.253", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-51314", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The setMacFilterCfg handler reaches sub_424CE0 with data that overflows a stack buffer.", "basis": [ "CNA", "CWE-121" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.tendacn.com/download/detail-4515.html", "host": "www.tendacn.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://gitee.com/GXB0_0/iot-vul/blob/master/Tenda/TX9/20/setMacFilterCfg.md", "host": "gitee.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 134, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-51315", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-10-28T00:00:00.000Z", "date_published": "2026-07-20T00:00:00.000Z", "date_updated": "2026-07-21T14:58:11.507Z", "publisher": "mitre", "title": "The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function of the file /goform/SetOnlineDevName", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-121", "name": "Stack-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00419, "percentile": 0.34474 }, "nvd": { "published": "2026-07-20T22:17:03.550", "lastModified": "2026-07-21T18:55:59.253", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-51315", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A request to SetOnlineDevName reaches sub_425964 with data that exceeds a stack buffer.", "basis": [ "CNA", "CWE-121" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.tendacn.com/download/detail-4515.html", "host": "www.tendacn.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://gitee.com/GXB0_0/iot-vul/blob/master/Tenda/TX9/20/SetOnlineDevName_mac.md", "host": "gitee.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 134, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-51316", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-10-28T00:00:00.000Z", "date_published": "2026-07-20T00:00:00.000Z", "date_updated": "2026-07-21T14:58:05.589Z", "publisher": "mitre", "title": "The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevName", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-400", "name": "Uncontrolled Resource Consumption", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00343, "percentile": 0.26968 }, "nvd": { "published": "2026-07-20T22:17:03.657", "lastModified": "2026-07-21T18:55:59.253", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-51316", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The public record identifies a denial of service in update_dev_name without disclosing whether the trigger is resource exhaustion, memory corruption, or another implementation failure.", "basis": [ "CNA", "CWE-400" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.tendacn.com/download/detail-4515.html", "host": "www.tendacn.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://gitee.com/GXB0_0/iot-vul/blob/master/Tenda/TX9/20/SetOnlineDevName_devName.md", "host": "gitee.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 142, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-56141", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2024-12-16T18:04:39.982Z", "date_published": "2026-07-06T23:17:54.978Z", "date_updated": "2026-07-08T19:41:44.619Z", "publisher": "GitHub_M", "title": "Minosoft has IV equal to key", "affected": { "vendors": [ "Bixilon" ], "products": [ { "vendor": "Bixilon", "product": "Minosoft" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-329", "name": "Generation of Predictable IV with CBC Mode", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "3.1", "score": 5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 5, "cvss_source_score_spread": 0, "epss": { "score": 0.00111, "percentile": 0.01544 }, "nvd": { "published": "2026-07-07T00:16:33.607", "lastModified": "2026-07-08T20:16:46.777", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-56141", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "CryptManager uses the AES key itself as the CBC initialization vector, making the IV predictable and coupled to the secret key.", "basis": [ "CNA", "CWE-329" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/Bixilon/Minosoft/security/advisories/GHSA-rvr6-48rj-c94j", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_CONFIRM" ] }, { "url": "https://github.com/Bixilon/Minosoft/blob/3a608abe2d0999e4e702cc1b2d28366884c7f31e/src/main/java/de/bixilon/minosoft/protocol/protocol/encryption/CryptManager.kt#L72", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 726, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-58023", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-23T07:45:15.711Z", "date_published": "2026-07-23T07:52:32.395Z", "date_updated": "2026-07-23T13:59:46.842Z", "publisher": "bosch", "title": "Information disclosure in Bosch Configuration Manager in Version 7.", "affected": { "vendors": [ "Bosch" ], "products": [ { "vendor": "Bosch", "product": "Bosch Configuration Manager" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-312", "name": "Cleartext Storage of Sensitive Information", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N" }, { "source": "NVD:psirt@bosch.com", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00079, "percentile": 0.00195 }, "nvd": { "published": "2026-07-23T09:16:26.290", "lastModified": "2026-07-23T15:48:25.133", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58023", "family": "CRYPTO_SECRET", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The product stores or transmits a security secret in cleartext where an unauthorized observer can recover it.", "basis": [ "CNA", "CWE-312" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-981803.html", "host": "psirt.bosch.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 126, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-58330", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-23T07:45:15.716Z", "date_published": "2026-07-23T07:56:34.646Z", "date_updated": "2026-07-23T13:59:27.140Z", "publisher": "bosch", "title": "A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data.", "affected": { "vendors": [ "Bosch" ], "products": [ { "vendor": "Bosch", "product": "Camera Firmware" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:psirt@bosch.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00291, "percentile": 0.21343 }, "nvd": { "published": "2026-07-23T09:16:26.430", "lastModified": "2026-07-23T15:48:25.133", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58330", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The implementation evaluates identity or privilege without binding it to the exact object, action, or security state being requested.", "basis": [ "CNA", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-659648.html", "host": "psirt.bosch.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 153, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2024-58352", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-06-08T15:20:35.497Z", "date_published": "2026-07-02T17:05:10.709Z", "date_updated": "2026-07-28T01:47:44.539Z", "publisher": "VulnCheck", "title": "Landray OA Unauthenticated HQL Injection via wechatLoginHelper.do", "affected": { "vendors": [ "Shenzhen Landray Software Co., Ltd." ], "products": [ { "vendor": "Shenzhen Landray Software Co., Ltd.", "product": "Landry Office Automation (OA)" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-564", "name": "SQL Injection: Hibernate", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 1.1999999999999993, "epss": { "score": 0.00564, "percentile": 0.43656 }, "nvd": { "published": "2026-07-02T17:16:57.557", "lastModified": "2026-07-02T18:16:48.033", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58352", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A caller-controlled value is incorporated into a Landry Office Automation (OA) database query without safe parameter binding, allowing query syntax injection.", "basis": [ "CNA", "CWE-564" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://cn-sec.com/archives/2532828.html", "host": "cn-sec.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://blog.csdn.net/fushuang333/article/details/136377020", "host": "blog.csdn.net", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://blog.csdn.net/qq_39342001/article/details/137354047", "host": "blog.csdn.net", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/landray-oa-unauthenticated-hql-injection-via-wechatloginhelper-do", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 647, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-58353", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-06-08T15:20:35.497Z", "date_published": "2026-07-23T21:16:42.870Z", "date_updated": "2026-07-28T01:47:45.196Z", "publisher": "VulnCheck", "title": "Cal.com through 4.7.15 Cross-Site Scripting via booking questions", "affected": { "vendors": [ "calcom" ], "products": [ { "vendor": "calcom", "product": "cal.diy" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L" }, { "source": "cna", "version": "3.1", "score": 8.9, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.9, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0.40000000000000036, "epss": { "score": 0.00298, "percentile": 0.22035 }, "nvd": { "published": "2026-07-23T22:16:51.080", "lastModified": "2026-07-30T16:41:25.650", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58353", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A booking-question label reaches dangerouslySetInnerHTML without sanitization, so stored markup is executed in a visitor's browser.", "basis": [ "CNA", "CWE-80" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/calcom/cal.diy/security/advisories/GHSA-vgj7-76cw-h6f8", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://github.com/calcom/cal.diy/commit/00689fda0a30b8f933c096f02c1fe092a4206def", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/cal-com-through-cross-site-scripting-via-booking-questions", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 586, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-58354", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-06-08T15:20:35.497Z", "date_published": "2026-07-23T21:16:43.545Z", "date_updated": "2026-07-24T21:35:07.962Z", "publisher": "VulnCheck", "title": "cal.com Repository Takeover via pull_request_target Workflow", "affected": { "vendors": [ "calcom" ], "products": [ { "vendor": "calcom", "product": "cal.diy" } ], "affectedBlockCount": 1, "versionEntryCount": 0, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-77", "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H" }, { "source": "cna", "version": "3.1", "score": 9.9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.9, "cvss_source_score_spread": 1.4000000000000004, "epss": { "score": 0.00386, "percentile": 0.31318 }, "nvd": { "published": "2026-07-23T22:16:51.380", "lastModified": "2026-07-30T16:41:25.650", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58354", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A pull_request_target workflow grants a write-capable token and then checks out and executes contributor-controlled pull-request code.", "basis": [ "CNA", "CWE-77" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/calcom/cal.diy/security/advisories/GHSA-p3f6-52gv-cj7m", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://github.com/calcom/cal.diy/commit/9aa60fae41a6b6b101c86bf430754b439f440871", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/cal-com-repository-takeover-via-pull-request-target-workflow", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 835, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 0 } }, { "cve_id": "CVE-2024-58355", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-06-08T15:20:35.497Z", "date_published": "2026-07-23T21:16:44.180Z", "date_updated": "2026-07-28T01:47:45.864Z", "publisher": "VulnCheck", "title": "Cal.com through 4.7.15 Cross-Site Scripting via booking questions", "affected": { "vendors": [ "calcom" ], "products": [ { "vendor": "calcom", "product": "cal.diy" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L" }, { "source": "cna", "version": "3.1", "score": 8.9, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.9, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0.40000000000000036, "epss": { "score": 0.00291, "percentile": 0.21377 }, "nvd": { "published": "2026-07-23T22:16:51.533", "lastModified": "2026-07-30T16:41:25.650", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58355", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A booking-question label reaches dangerouslySetInnerHTML without sanitization, so stored attacker markup executes in the booking view.", "basis": [ "CNA record", "CWE-80" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/calcom/cal.diy/security/advisories/GHSA-vgj7-76cw-h6f8", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://github.com/calcom/cal.diy/commit/00689fda0a30b8f933c096f02c1fe092a4206def", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/cal-com-through-cross-site-scripting-via-booking-questions-2", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 491, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2024-58356", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-06-08T15:20:35.497Z", "date_published": "2026-07-18T13:10:00.884Z", "date_updated": "2026-07-28T01:47:46.525Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-276", "name": "Incorrect Default Permissions", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 2.3, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 2.3, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 2.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00265, "percentile": 0.18271 }, "nvd": { "published": "2026-07-18T14:17:08.363", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58356", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "DEFINE TABLE OVERWRITE silently retains the prior permission definition for relation tables instead of applying the replacement definition.", "basis": [ "CNA", "CWE-276" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-27vq-hv74-7cqp", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-define-table-overwrite", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 527, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2024-58357", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-06-08T15:20:35.497Z", "date_published": "2026-07-18T13:10:01.549Z", "date_updated": "2026-07-28T01:47:47.190Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.1.0 Denial of Service via rand::time()", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-248", "name": "Uncaught Exception", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00307, "percentile": 0.2298 }, "nvd": { "published": "2026-07-18T14:17:08.503", "lastModified": "2026-07-22T20:16:41.810", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58357", "family": "OTHER_SPECIFIC", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The rand::time path unwraps an absent value instead of handling it, so crafted input raises an uncaught panic that terminates the service.", "basis": [ "CNA", "CWE-248" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4f5-h82v-5w4r", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-rand-time", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 292, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2024-58358", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-06-08T15:20:35.497Z", "date_published": "2026-07-18T13:10:02.254Z", "date_updated": "2026-07-28T01:47:47.875Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.1.0 Denial of Service via Nonexistent Role", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-248", "name": "Uncaught Exception", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 6.9, "cvss_source_score_spread": 2, "epss": { "score": 0.00329, "percentile": 0.25381 }, "nvd": { "published": "2026-07-18T14:17:08.643", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58358", "family": "OTHER_SPECIFIC", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "SurrealDB accepts a nonexistent role when defining a user and later panics instead of handling that invalid role during sign-in.", "basis": [ "CNA", "CWE-248" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jc55-246c-r88f", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-role", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 280, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2024-58359", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-06-08T15:20:35.497Z", "date_published": "2026-07-18T13:10:02.920Z", "date_updated": "2026-07-28T01:47:48.525Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.1.0 Denial of Service via rand() Sorting", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-248", "name": "Uncaught Exception", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00307, "percentile": 0.2298 }, "nvd": { "published": "2026-07-18T14:17:08.780", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58359", "family": "OTHER_SPECIFIC", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Malformed input raises an exception that escapes the request-handling boundary and terminates the affected process.", "basis": [ "CNA record", "NVD", "CWE-248" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m52v-24p8-654f", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-rand-sorting", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 258, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2024-58360", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-16T12:22:08.178Z", "date_published": "2026-07-16T12:23:14.567Z", "date_updated": "2026-07-18T02:49:27.174Z", "publisher": "VulnCheck", "title": "stoatchat before 0.7.8 Unrestricted Account Creation", "affected": { "vendors": [ "stoatchat" ], "products": [ { "vendor": "stoatchat", "product": "stoatchat" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-1173", "name": "Improper Use of Validation Framework", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.9, "cvss_source_score_spread": 0.40000000000000036, "epss": { "score": 0.00259, "percentile": 0.17496 }, "nvd": { "published": "2026-07-16T13:16:23.000", "lastModified": "2026-07-18T03:16:34.433", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58360", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The registration path fails to enforce invite-only, email-verification, CAPTCHA, and shield-verification gates, allowing unrestricted creation of unverified accounts.", "basis": [ "CNA", "NVD", "CWE-1173" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/stoatchat/stoatchat/security/advisories/GHSA-f26h-rqjq-qqjq", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://github.com/stoatchat/stoatchat/commit/eda36436a862bcab92f7ac2cf1c2dd88c41e52a4", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/stoatchat-before-unrestricted-account-creation", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 302, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2024-58361", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-18T12:40:52.916Z", "date_published": "2026-07-18T13:10:03.607Z", "date_updated": "2026-07-28T01:47:49.210Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.0.4 Denial of Service via Parser Exception", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-248", "name": "Uncaught Exception", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00249, "percentile": 0.16258 }, "nvd": { "published": "2026-07-18T14:17:08.917", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58361", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The surrealdb request path lets attacker-controlled input reach an uncaught exception that terminates service processing.", "basis": [ "CNA", "CWE-248" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-qjrv-v6qp-x99x", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-parser-exception", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 328, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2024-58362", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-18T12:40:52.916Z", "date_published": "2026-07-18T13:10:04.263Z", "date_updated": "2026-07-28T01:47:49.887Z", "publisher": "VulnCheck", "title": "SurrealDB before 1.5.5 Query Injection via RPC API", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-75", "name": "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00367, "percentile": 0.29415 }, "nvd": { "published": "2026-07-18T14:17:09.047", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58362", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A crafted bincode object embeds a subquery that the sign-in or sign-up path executes with system or editor authority.", "basis": [ "CNA", "CWE-75" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-64f8-pjgr-9wmr", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-query-injection-via-rpc-api", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 772, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2024-58363", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-18T12:40:52.916Z", "date_published": "2026-07-18T13:10:04.938Z", "date_updated": "2026-07-28T01:47:50.565Z", "publisher": "VulnCheck", "title": "SurrealDB before 1.5.4 Authentication Bypass via Database Switch", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-287", "name": "Improper Authentication", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 1, "epss": { "score": 0.00194, "percentile": 0.0933 }, "nvd": { "published": "2026-07-18T14:17:09.187", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58363", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The surrealdb access path accepts an identity or request signal that is insufficient to authenticate the actor for the requested operation.", "basis": [ "CNA", "CWE-287" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 370, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2024-58364", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-18T12:40:52.916Z", "date_published": "2026-07-18T13:10:05.569Z", "date_updated": "2026-07-28T01:47:51.243Z", "publisher": "VulnCheck", "title": "SurrealDB before 1.2.1 Denial of Service via Parsing Error", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-248", "name": "Uncaught Exception", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00249, "percentile": 0.16257 }, "nvd": { "published": "2026-07-18T14:17:09.320", "lastModified": "2026-07-22T19:16:51.900", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58364", "family": "OTHER_SPECIFIC", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "SurrealDB span rendering throws an uncaught exception when a malformed query places an error on a line terminator.", "basis": [ "CNA", "CWE-248" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-8xff-473h-f863", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-parsing-error", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 314, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2024-58365", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-18T12:40:52.916Z", "date_published": "2026-07-18T13:10:06.241Z", "date_updated": "2026-07-28T01:47:51.921Z", "publisher": "VulnCheck", "title": "SurrealDB before 1.2.0 Denial of Service via Nonexistent Function", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-248", "name": "Uncaught Exception", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00249, "percentile": 0.16258 }, "nvd": { "published": "2026-07-18T14:17:09.460", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58365", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions.", "basis": [ "CNA", "CWE-248" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6wr5-jmpr-mjcx", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-function", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 277, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2024-58366", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-18T12:40:52.916Z", "date_published": "2026-07-18T13:10:06.939Z", "date_updated": "2026-07-28T01:47:52.571Z", "publisher": "VulnCheck", "title": "SurrealDB before 1.1.1 Format String via Scripting Functions", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-134", "name": "Use of Externally-Controlled Format String", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "cna", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00299, "percentile": 0.22223 }, "nvd": { "published": "2026-07-18T14:17:09.600", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58366", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "rquickjs passes attacker-controlled text as a format string instead of as inert data.", "basis": [ "CNA", "CWE-134" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functions", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 298, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2024-58367", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-18T12:40:52.916Z", "date_published": "2026-07-18T13:10:07.604Z", "date_updated": "2026-07-28T01:47:53.305Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-285", "name": "Improper Authorization", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00215, "percentile": 0.12 }, "nvd": { "published": "2026-07-18T14:17:09.737", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58367", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SurrealDB applies field permissions inconsistently across projections, aliases, expressions, filters, and mutation return paths, so denied field values remain observable.", "basis": [ "CNA", "CWE-285" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-9722-9j67-vjcr", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-improper-authorization-via-select-permissions", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 441, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2024-58368", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-18T12:40:52.917Z", "date_published": "2026-07-18T13:10:08.303Z", "date_updated": "2026-07-28T01:47:54.003Z", "publisher": "VulnCheck", "title": "SurrealDB before 1.1.0 Denial of Service via HTTP Headers", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-248", "name": "Uncaught Exception", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 1.1999999999999993, "epss": { "score": 0.00376, "percentile": 0.30338 }, "nvd": { "published": "2026-07-18T14:17:09.867", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58368", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "SurrealDB lets malformed ID, database, or namespace headers raise an uncaught exception, terminating request handling instead of returning a bounded error.", "basis": [ "CNA", "CWE-248" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m24x-r6q3-2vp9", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-http-headers", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 282, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2024-58369", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-18T12:40:52.917Z", "date_published": "2026-07-18T13:10:08.965Z", "date_updated": "2026-07-28T01:47:54.726Z", "publisher": "VulnCheck", "title": "SurrealDB before 1.1.1 Denial of Service via Global Parameters", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-248", "name": "Uncaught Exception", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00249, "percentile": 0.16259 }, "nvd": { "published": "2026-07-18T14:17:10.003", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58369", "family": "OTHER_SPECIFIC", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The router permits custom parameters or functions at root and namespace levels where they are unsupported, and the resulting uncaught exception panics the server.", "basis": [ "CNA", "CWE-248" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jm4v-58r5-66hj", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-global-parameters", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 284, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2024-58370", "id_year": 2024, "state": "PUBLISHED", "date_reserved": "2026-07-18T12:40:52.917Z", "date_published": "2026-07-18T13:10:09.658Z", "date_updated": "2026-07-28T01:47:55.449Z", "publisher": "VulnCheck", "title": "SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-674", "name": "Uncontrolled Recursion", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00275, "percentile": 0.19622 }, "nvd": { "published": "2026-07-18T14:17:10.140", "lastModified": "2026-07-22T19:16:53.173", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2024-58370", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SurrealQL parser recursively handles nested IF, RELATE, and attribute expressions without a depth limit, allowing stack exhaustion.", "basis": [ "CNA", "CWE-674" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6r8p-hpg7-825g", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-uncontrolled-recursion-denial-of-service", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 277, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-0152", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2024-12-31T19:08:58.246Z", "date_published": "2026-07-30T16:57:15.862Z", "date_updated": "2026-07-30T17:40:37.424Z", "publisher": "ibm", "title": "IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "Engineering Requirements Management DOORS and DOORS Web Access" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:psirt@us.ibm.com", "type": "Primary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00162, "percentile": 0.05861 }, "nvd": { "published": "2026-07-30T19:16:57.910", "lastModified": "2026-07-30T19:31:02.643", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-0152", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Unauthenticated input is embedded in the DOORS web interface as executable browser script without the required HTML or JavaScript escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7279145", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 376, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-3110", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-04-02T07:56:08.672Z", "date_published": "2026-07-08T16:19:38.337Z", "date_updated": "2026-07-08T16:30:47.077Z", "publisher": "OpenVPN", "title": "OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy", "affected": { "vendors": [ "OpenVPN" ], "products": [ { "vendor": "OpenVPN", "product": "Access Server" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N" }, { "source": "NVD:security@openvpn.net", "type": "Secondary", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00259, "percentile": 0.17542 }, "nvd": { "published": "2026-07-08T17:17:19.650", "lastModified": "2026-07-10T17:00:29.527", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-3110", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Access Server HTTP parser accepts a message boundary that a front-end proxy can interpret differently, enabling request desynchronization.", "basis": [ "CNA", "CWE-444" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://openvpn.net/as-docs/as-3-2-release-notes.html", "host": "openvpn.net", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "release-notes" ] } ], "record_shape": { "descriptionChars": 198, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-5017", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-05-20T20:41:45.614Z", "date_published": "2026-07-11T05:35:47.239Z", "date_updated": "2026-07-14T14:27:57.432Z", "publisher": "Wordfence", "title": "Catalyst Connect Zoho CRM Client Portal <= 2.2.0 - Authenticated (Administrator+) SQL Injection via uid Parameter", "affected": { "vendors": [ "catalyst2020" ], "products": [ { "vendor": "catalyst2020", "product": "Catalyst Connect Zoho CRM Client Portal" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00258, "percentile": 0.17413 }, "nvd": { "published": "2026-07-11T07:16:44.453", "lastModified": "2026-07-14T15:16:54.353", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-5017", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In Catalyst Connect Zoho CRM Client Portal, attacker-controlled values reach an SQL statement without the required escaping or parameter binding.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/37ce28de-f41d-42f8-8467-0af5e643a739?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://wordpress.org/plugins/catalyst-connect-client-portal/", "host": "wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/BFS-Lab/BFSDV/blob/main/client%20portal%20SQL%20injection-1.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 524, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-6784", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-06-27T12:28:50.508Z", "date_published": "2026-07-11T05:35:44.591Z", "date_updated": "2026-07-13T14:28:15.594Z", "publisher": "Wordfence", "title": "Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution", "affected": { "vendors": [ "tigroumeow" ], "products": [ { "vendor": "tigroumeow", "product": "Code Engine – PHP Snippets, AI Functions & Automation for WordPress" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-77", "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00469, "percentile": 0.38157 }, "nvd": { "published": "2026-07-11T07:16:44.637", "lastModified": "2026-07-13T16:59:13.647", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-6784", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A contributor can invoke the code-engine feature because the action is not restricted to the role intended to execute code.", "basis": [ "CNA", "CWE-77" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1a5f970a-e6a0-4dc7-8e99-342a32f5fd49?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3345666", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 376, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-8412", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-07-31T09:41:28.725Z", "date_published": "2026-07-14T07:42:47.016Z", "date_updated": "2026-07-14T12:31:14.506Z", "publisher": "suse", "title": "VMDP: Potential buffer overflow in the RtlQueryRegistryValues function", "affected": { "vendors": [ "SUSE" ], "products": [ { "vendor": "SUSE", "product": "Virtual Machine Driver Pack" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 2, "severity": "LOW", "vector": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:meissner@suse.de", "type": "Secondary", "version": "4.0", "score": 2, "severity": "LOW", "vector": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 2, "cvss_source_score_spread": 0, "epss": { "score": 0.0009, "percentile": 0.00545 }, "nvd": { "published": "2026-07-14T09:16:39.637", "lastModified": "2026-07-15T21:00:44.900", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-8412", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The implementation fails to preserve a valid bound, initialization state, type, ownership rule, or object lifetime before memory access.", "basis": [ "CNA", "CWE-120" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-8412", "host": "bugzilla.suse.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 384, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-8591", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-08-05T11:53:15.931Z", "date_published": "2026-07-06T10:16:53.685Z", "date_updated": "2026-07-06T11:05:59.157Z", "publisher": "WSO2", "title": "Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification", "affected": { "vendors": [ "WSO2" ], "products": [ { "vendor": "WSO2", "product": "WSO2 Identity Server" }, { "vendor": "WSO2", "product": "WSO2 API Manager" }, { "vendor": "WSO2", "product": "WSO2 API Control Plane" }, { "vendor": "WSO2", "product": "WSO2 Traffic Manager" }, { "vendor": "WSO2", "product": "WSO2 Universal Gateway" }, { "vendor": "WSO2", "product": "WSO2 Open Banking AM" }, { "vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager" }, { "vendor": "WSO2", "product": "WSO2 Open Banking IAM" } ], "affectedBlockCount": 8, "versionEntryCount": 30, "versionRangeCount": 30, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.05789 }, "nvd": { "published": "2026-07-06T11:16:25.713", "lastModified": "2026-07-09T13:04:39.937", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-8591", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "User-controlled content reaches WSO2 Identity Server page output without context-appropriate sanitization or escaping, so the browser interprets it as script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4343/", "host": "security.docs.wso2.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 548, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 8, "affectedVersionEntryCount": 30 } }, { "cve_id": "CVE-2025-9205", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-08-19T17:53:39.009Z", "date_published": "2026-07-24T02:31:59.945Z", "date_updated": "2026-07-24T12:23:09.617Z", "publisher": "Wordfence", "title": "MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting", "affected": { "vendors": [ "oyatek" ], "products": [ { "vendor": "oyatek", "product": "MapSVG – Vector maps, Image maps, Google Maps" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00187, "percentile": 0.08529 }, "nvd": { "published": "2026-07-24T04:16:50.297", "lastModified": "2026-07-24T20:45:45.697", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-9205", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Map option attributes are stored without sufficient sanitization or output escaping and later execute as browser script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a2dab9d3-a890-4c66-a825-e30329e37a60?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/tags/8.7.5/php/Admin/Admin.php#L233", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3608308%40mapsvg-lite-interactive-vector-maps&new=3608308%40mapsvg-lite-interactive-vector-maps", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 436, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-10656", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-17T20:34:13.390Z", "date_published": "2026-07-29T08:32:35.881Z", "date_updated": "2026-07-29T15:08:20.019Z", "publisher": "Wordfence", "title": "Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation", "affected": { "vendors": [ "holest" ], "products": [ { "vendor": "holest", "product": "Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00492, "percentile": 0.39621 }, "nvd": { "published": "2026-07-29T10:16:31.407", "lastModified": "2026-07-30T14:01:30.413", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-10656", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The unauthenticated user_filter path creates administrator accounts without an authorization check.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1f891b68-72c4-4f94-bd49-52576ad710f9?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/trunk/sellingcommander.php#L3725", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 284, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-11698", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-10-13T16:23:13.209Z", "date_published": "2026-07-14T15:05:32.682Z", "date_updated": "2026-07-14T15:53:19.355Z", "publisher": "Rockwell", "title": "CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow", "affected": { "vendors": [ "Rockwell Automation" ], "products": [ { "vendor": "Rockwell Automation", "product": "CompactLogix® 5380 Recovery Image Compact GuardLogix® 5380 Recovery Image CompactLogix® 5480 Recovery Image ControlLogix® 5580 Recovery Image GuardLogix® 5580 Recovery Image" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H" }, { "source": "NVD:PSIRT@rockwellautomation.com", "type": "Secondary", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00303, "percentile": 0.2266 }, "nvd": { "published": "2026-07-14T16:16:41.837", "lastModified": "2026-07-14T16:46:49.030", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-11698", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Controller boot firmware copies attacker-supplied file data into a fixed buffer without enforcing the destination size.", "basis": [ "CNA", "CWE-120" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html", "host": "www.rockwellautomation.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 274, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-11977", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-10-20T16:45:21.982Z", "date_published": "2026-07-10T07:48:44.939Z", "date_updated": "2026-07-10T10:07:52.289Z", "publisher": "Wordfence", "title": "HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion", "affected": { "vendors": [ "happyforms" ], "products": [ { "vendor": "happyforms", "product": "Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-98", "name": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 6.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00501, "percentile": 0.40134 }, "nvd": { "published": "2026-07-10T09:16:51.153", "lastModified": "2026-07-10T15:43:30.330", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-11977", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "happyforms_get_form_partial accepts an attacker-selected partial path and includes the resulting PHP file without confining it to the intended template set.", "basis": [ "CNA", "CWE-98" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e31119ab-963d-48a4-9948-0a0dce761918?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.svn.wordpress.org/happyforms/trunk/core/classes/class-wp-customize-form-manager.php", "host": "plugins.svn.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.svn.wordpress.org/happyforms/trunk/core/helpers/helper-form-templates.php", "host": "plugins.svn.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3494912%40happyforms&new=3494912%40happyforms", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 626, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-12011", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-10-21T12:56:46.593Z", "date_published": "2026-07-14T15:03:11.708Z", "date_updated": "2026-07-14T15:26:29.661Z", "publisher": "Rockwell", "title": "CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow", "affected": { "vendors": [ "Rockwell Automation" ], "products": [ { "vendor": "Rockwell Automation", "product": "CompactLogix® 5370 Compact GuardLogix® 5370 ControlLogix® 5570 GuardLogix® 5570" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H" }, { "source": "NVD:PSIRT@rockwellautomation.com", "type": "Secondary", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00303, "percentile": 0.22661 }, "nvd": { "published": "2026-07-14T15:16:53.323", "lastModified": "2026-07-14T16:46:49.030", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-12011", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A malformed controller project reaches a fixed-size project-processing buffer without a sufficient bounds check, producing the classic buffer-overflow condition that forces 5370/5570 controllers into a major non-recoverable fault.", "basis": [ "CNA", "NVD", "CWE-120", "Rockwell Automation advisory" ], "deepDive": true, "notes": "Inspected Rockwell Automation advisory https://www.rockwellautomation.com/es-es/trust-center/security-advisories/advisory.SD1781.html; it confirms invalid-project input, CWE-120, affected firmware, and corrected firmware, but it does not disclose the copy site, buffer bounds, or patch diff." }, "references": [ { "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html", "host": "www.rockwellautomation.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 210, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-12012", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-10-21T12:58:15.696Z", "date_published": "2026-07-14T15:04:18.725Z", "date_updated": "2026-07-14T15:26:00.338Z", "publisher": "Rockwell", "title": "CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow", "affected": { "vendors": [ "Rockwell Automation" ], "products": [ { "vendor": "Rockwell Automation", "product": "CompactLogix® 5370 Compact GuardLogix® 5370 ControlLogix® 5570 GuardLogix® 5570" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H" }, { "source": "NVD:PSIRT@rockwellautomation.com", "type": "Secondary", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00303, "percentile": 0.2266 }, "nvd": { "published": "2026-07-14T15:16:54.210", "lastModified": "2026-07-14T16:46:49.030", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-12012", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Invalid controller file data can exceed a destination buffer and force the controller into a major non-recoverable fault, although the copy site is not public.", "basis": [ "CNA", "NVD", "CWE-120", "Vendor advisory" ], "deepDive": true, "notes": "Inspected Rockwell Automation advisory SD1781 at https://www.rockwellautomation.com/es-es/trust-center/security-advisories/advisory.SD1781.html; it confirms CWE-120, invalid file data, affected and corrected firmware, and MNRF impact, but it does not identify the destination buffer or copy site." }, "references": [ { "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html", "host": "www.rockwellautomation.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 235, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-12506", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-10-30T14:05:29.287Z", "date_published": "2026-07-08T20:47:28.863Z", "date_updated": "2026-07-09T13:53:34.205Z", "publisher": "GitLab", "title": "Use of Incorrectly-Resolved Name or Reference in GitLab", "affected": { "vendors": [ "GitLab" ], "products": [ { "vendor": "GitLab", "product": "GitLab" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-706", "name": "Use of Incorrectly-Resolved Name or Reference", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 3.5, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "source": "NVD:cve@gitlab.com", "type": "Secondary", "version": "3.1", "score": 3.5, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0.7999999999999998, "epss": { "score": 0.00187, "percentile": 0.0856 }, "nvd": { "published": "2026-07-08T21:16:44.493", "lastModified": "2026-07-09T20:17:33.973", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-12506", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "GitLab resolves a repository reference differently for web display and archive download, so one repository name can select different content across the two paths.", "basis": [ "CNA", "NVD", "CWE-706" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://hackerone.com/reports/3351460", "host": "hackerone.com", "sources": [ "cna", "nvd" ], "tags": [ "Permissions Required", "exploit", "permissions-required", "technical-description" ] }, { "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/578988", "host": "gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Broken Link" ] }, { "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/", "host": "docs.gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 390, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2025-12799", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-11-06T11:15:12.378Z", "date_published": "2026-07-07T16:18:57.555Z", "date_updated": "2026-07-29T16:24:51.191Z", "publisher": "redhat", "title": "Jastow: jastow cross-site scripting attack due to unsanitized uri", "affected": { "vendors": [ "Red Hat" ], "products": [ { "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1.7.GA" }, { "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10" }, { "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8" }, { "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7" }, { "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8" }, { "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack" }, { "vendor": "Red Hat", "product": "Red Hat Single Sign-On 7" } ], "affectedBlockCount": 240, "versionEntryCount": 229, "versionRangeCount": 229, "defaultStatuses": [ "affected", "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" }, { "source": "NVD:secalert@redhat.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00247, "percentile": 0.16009 }, "nvd": { "published": "2026-07-07T17:16:34.640", "lastModified": "2026-07-29T17:16:49.140", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-12799", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Under the affected Undertow and Jastow configuration, unescaped URI characters reach generated HTML and can become executable script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://access.redhat.com/errata/RHSA-2026:36342", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:36343", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:36344", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:36345", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/security/cve/CVE-2025-12799", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413071", "host": "bugzilla.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "x_refsource_REDHAT" ] } ], "record_shape": { "descriptionChars": 256, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 8, "affectedVersionEntryCount": 229 } }, { "cve_id": "CVE-2025-13146", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-11-13T20:03:00.603Z", "date_published": "2026-07-22T11:35:15.786Z", "date_updated": "2026-07-22T12:19:54.699Z", "publisher": "Wordfence", "title": "Contact Form 7 – Dynamic Text Extension <= 5.0.6 - Unauthenticated Arbitrary Shortcode Execution", "affected": { "vendors": [ "sevenspark" ], "products": [ { "vendor": "sevenspark", "product": "Contact Form 7 – Dynamic Text Extension" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00275, "percentile": 0.19622 }, "nvd": { "published": "2026-07-22T12:16:54.763", "lastModified": "2026-07-22T16:30:26.533", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-13146", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An unauthenticated value reaches WordPress do_shortcode without validation, so shortcode syntax is interpreted.", "basis": [ "CNA", "CWE-94" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3e5ad3a7-03c5-4085-b330-bc77e7e46cea?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/contact-form-7-dynamic-text-extension/trunk/contact-form-7-dynamic-text-extension.php#L765", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/contact-form-7-dynamic-text-extension/trunk/contact-form-7-dynamic-text-extension.php#L782", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/contact-form-7-dynamic-text-extension/trunk/includes/utilities.php#L265", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3430784/", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 437, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-13475", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-11-20T12:17:18.234Z", "date_published": "2026-07-04T12:49:06.782Z", "date_updated": "2026-07-06T13:55:26.159Z", "publisher": "WSO2", "title": "Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure", "affected": { "vendors": [ "WSO2" ], "products": [ { "vendor": "WSO2", "product": "WSO2 Identity Server" }, { "vendor": "WSO2", "product": "WSO2 API Manager" } ], "affectedBlockCount": 2, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 3.5, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" }, { "source": "NVD:ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary", "version": "3.1", "score": 3.5, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 3.8, "epss": { "score": 0.00158, "percentile": 0.05427 }, "nvd": { "published": "2026-07-04T13:16:30.083", "lastModified": "2026-07-09T17:55:35.993", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-13475", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Consent is keyed by application name without tenant scope, so consent from one tenant is reused for a same-named application in another tenant.", "basis": [ "CNA", "CWE-288" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-1613/", "host": "security.docs.wso2.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 690, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 2, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2025-13968", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-03T15:29:18.491Z", "date_published": "2026-07-11T03:44:23.106Z", "date_updated": "2026-07-15T13:37:26.829Z", "publisher": "Wordfence", "title": "Starboard Suite Reservation Calendars <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "affected": { "vendors": [ "starboardsuite" ], "products": [ { "vendor": "starboardsuite", "product": "Starboard Suite Reservation Calendars" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00195, "percentile": 0.09474 }, "nvd": { "published": "2026-07-11T05:16:30.190", "lastModified": "2026-07-15T14:17:00.773", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-13968", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Starboard Suite Reservation Calendars plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in the [starboard-suite-lightbox] shortcode in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6e8a3628-b7cf-4f1a-89dc-d7e58257b2e4?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/starboard-suite-reservation-calendars/trunk/starboard-suite.php#L64", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/starboard-suite-reservation-calendars/tags/3.0.0/starboard-suite.php#L64", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/starboard-suite-reservation-calendars/trunk/starboard-suite.php#L78", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/starboard-suite-reservation-calendars/tags/3.0.0/starboard-suite.php#L78", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3551037%40starboard-suite-reservation-calendars&new=3551037%40starboard-suite-reservation-calendars", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 475, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-14562", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-12T10:03:51.120Z", "date_published": "2026-07-29T19:02:26.038Z", "date_updated": "2026-07-29T19:33:59.228Z", "publisher": "GitLab", "title": "Incorrect Authorization in GitLab", "affected": { "vendors": [ "GitLab" ], "products": [ { "vendor": "GitLab", "product": "GitLab" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 3.1, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:cve@gitlab.com", "type": "Secondary", "version": "3.1", "score": 3.1, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 3.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00225, "percentile": 0.13205 }, "nvd": { "published": "2026-07-29T20:17:00.067", "lastModified": "2026-08-03T13:44:10.667", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-14562", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a member, due to improper authorization checks on merge request collaboration settings.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://hackerone.com/reports/3460445", "host": "hackerone.com", "sources": [ "cna", "nvd" ], "tags": [ "Permissions Required", "exploit", "permissions-required", "technical-description" ] }, { "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/583889", "host": "gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Broken Link" ] }, { "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/", "host": "docs.gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 382, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2025-14785", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-16T14:13:31.998Z", "date_published": "2026-07-08T11:30:34.021Z", "date_updated": "2026-07-08T17:09:49.942Z", "publisher": "Wordfence", "title": "Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'seedprodnestedmenuwidget' Shortcode", "affected": { "vendors": [ "seedprod" ], "products": [ { "vendor": "seedprod", "product": "Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00152, "percentile": 0.04824 }, "nvd": { "published": "2026-07-08T12:17:18.223", "lastModified": "2026-07-08T18:16:28.860", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-14785", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled data reaches an HTML or DOM sink without context-appropriate sanitization and output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ba751f98-f86c-451b-8a12-a2e9e76768e5?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3565979/coming-soon/trunk/app/nestednavmenu.php?old=3422960&old_path=coming-soon%2Ftrunk%2Fapp%2Fnestednavmenu.php", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 553, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-15646", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-05-22T10:47:01.107Z", "date_published": "2026-07-01T14:38:03.727Z", "date_updated": "2026-07-01T18:09:08.371Z", "publisher": "CPANSec", "title": "HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion", "affected": { "vendors": [ "BPS" ], "products": [ { "vendor": "BPS", "product": "HTML::Gumbo" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-125", "name": "Out-of-bounds Read", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type ('Type Confusion')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:1", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00512, "percentile": 0.40821 }, "nvd": { "published": "2026-07-01T16:16:29.657", "lastModified": "2026-07-02T17:39:57.427", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-15646", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "HTML::Gumbo treats a template element as a text node and calls strlen() on the incompatible object, reading past the heap allocation and serializing those bytes.", "basis": [ "CNA", "CWE-125", "CWE-843" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/bestpractical/HTML-Gumbo/commit/15c0598909d4a64f47ef0a1abc5051f4e113c186.patch", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://metacpan.org/release/BPS/HTML-Gumbo-0.19/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] }, { "url": "https://bugs.debian.org/1104789", "host": "bugs.debian.org", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/01/7", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 652, "referenceCount": 4, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-15662", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-22T14:04:23.537Z", "date_published": "2026-07-27T06:00:01.242Z", "date_updated": "2026-07-27T15:52:23.770Z", "publisher": "WPScan", "title": "Printcart Web to Print Product Designer for WooCommerce < 2.5.3 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery", "affected": { "vendors": [ "Unknown" ], "products": [ { "vendor": "Unknown", "product": "Printcart Web to Print Product Designer for WooCommerce" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "adp", "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 8.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00261, "percentile": 0.17707 }, "nvd": { "published": "2026-07-27T07:16:23.680", "lastModified": "2026-07-27T20:33:01.673", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-15662", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The server accepts an attacker-controlled destination without constraining the resolved request target to approved endpoints.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://wpscan.com/vulnerability/6294afde-d23a-4634-a49a-168ce463278c/", "host": "wpscan.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description", "vdb-entry" ] } ], "record_shape": { "descriptionChars": 409, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-15665", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-23T11:11:48.893Z", "date_published": "2026-07-14T06:00:01.908Z", "date_updated": "2026-07-14T12:47:58.589Z", "publisher": "WPScan", "title": "BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field", "affected": { "vendors": [ "Unknown" ], "products": [ { "vendor": "Unknown", "product": "Ultimate Before After Image Slider & Gallery" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00133, "percentile": 0.03236 }, "nvd": { "published": "2026-07-14T06:16:41.087", "lastModified": "2026-07-14T16:42:11.910", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-15665", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "User-controlled content reaches Ultimate Before After Image Slider & Gallery page output without context-appropriate sanitization or escaping, so the browser interprets it as script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://wpscan.com/vulnerability/754f0960-efc8-426f-bb1d-7cceec920910/", "host": "wpscan.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description", "vdb-entry" ] } ], "record_shape": { "descriptionChars": 425, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-15666", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-29T04:58:39.190Z", "date_published": "2026-07-01T05:45:06.959Z", "date_updated": "2026-07-01T14:25:58.436Z", "publisher": "VulDB", "title": "Open Asset Import Library Assimp Model File SceneCombiner.cpp Copy heap-based overflow", "affected": { "vendors": [ "Open Asset Import Library" ], "products": [ { "vendor": "Open Asset Import Library", "product": "Assimp" } ], "affectedBlockCount": 1, "versionEntryCount": 4, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-122", "name": "Heap-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P" }, { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R" }, { "source": "cna", "version": "3.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R" }, { "source": "cna", "version": "2.0", "score": 4.3, "severity": "", "vector": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR" }, { "source": "NVD:cna@vuldb.com", "type": "Secondary", "version": "4.0", "score": 1.9, "severity": "LOW", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:cna@vuldb.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "source": "NVD:cna@vuldb.com", "type": "Secondary", "version": "2.0", "score": 4.3, "severity": "", "vector": "AV:L/AC:L/Au:S/C:P/I:P/A:P" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 3.4, "epss": { "score": 0.00123, "percentile": 0.02487 }, "nvd": { "published": "2026-07-01T07:16:21.077", "lastModified": "2026-07-01T15:16:23.077", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-15666", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled model dimensions can make SceneCombiner::Copy write beyond a heap allocation.", "basis": [ "CNA", "CWE-119", "CWE-122" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://vuldb.com/vuln/374595", "host": "vuldb.com", "sources": [ "cna", "nvd" ], "tags": [ "technical-description", "vdb-entry" ] }, { "url": "https://vuldb.com/vuln/374595/cti", "host": "vuldb.com", "sources": [ "cna", "nvd" ], "tags": [ "permissions-required", "signature" ] }, { "url": "https://vuldb.com/cve/CVE-2025-15666", "host": "vuldb.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] }, { "url": "https://vuldb.com/submit/844487", "host": "vuldb.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] }, { "url": "https://github.com/assimp/assimp/issues/6079", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "issue-tracking" ] } ], "record_shape": { "descriptionChars": 492, "referenceCount": 5, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 7, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2025-15667", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-04T05:16:18.510Z", "date_published": "2026-07-06T11:15:08.893Z", "date_updated": "2026-07-06T18:50:01.768Z", "publisher": "VulDB", "title": "GPAC MP4Box avc_ext.c gf_isom_nalu_sample_rewrite double free", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "GPAC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-415", "name": "Double Free", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P" }, { "source": "cna", "version": "3.1", "score": 3.3, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C" }, { "source": "cna", "version": "3.0", "score": 3.3, "severity": "LOW", "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C" }, { "source": "cna", "version": "2.0", "score": 1.7, "severity": "", "vector": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C" }, { "source": "NVD:cna@vuldb.com", "type": "Secondary", "version": "4.0", "score": 1.9, "severity": "LOW", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:cna@vuldb.com", "type": "Secondary", "version": "3.1", "score": 3.3, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": "NVD:cna@vuldb.com", "type": "Secondary", "version": "2.0", "score": 1.7, "severity": "", "vector": "AV:L/AC:L/Au:S/C:N/I:N/A:P" } ], "max_cvss_observed_across_sources": 4.8, "cvss_source_score_spread": 3.0999999999999996, "epss": { "score": 0.00112, "percentile": 0.0161 }, "nvd": { "published": "2026-07-06T12:16:38.457", "lastModified": "2026-07-06T19:16:53.743", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-15667", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The nalu_out_bs cleanup path can free the same allocation twice.", "basis": [ "CNA", "CWE-119", "CWE-415" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://vuldb.com/vuln/376292", "host": "vuldb.com", "sources": [ "cna", "nvd" ], "tags": [ "technical-description", "vdb-entry" ] }, { "url": "https://vuldb.com/vuln/376292/cti", "host": "vuldb.com", "sources": [ "cna", "nvd" ], "tags": [ "permissions-required", "signature" ] }, { "url": "https://vuldb.com/cve/CVE-2025-15667", "host": "vuldb.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] }, { "url": "https://vuldb.com/submit/846839", "host": "vuldb.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] }, { "url": "https://github.com/gpac/gpac/issues/3403", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://github.com/TimChan2001/pocs/raw/refs/heads/main/poc-gpac-1", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit" ] }, { "url": "https://github.com/gpac/gpac/commit/f29f955f2a3b5e8e507caad3e52319f961bf37bf", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://github.com/gpac/gpac/", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 473, "referenceCount": 8, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 7, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-15668", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-04T05:16:20.854Z", "date_published": "2026-07-06T11:45:07.439Z", "date_updated": "2026-07-07T14:03:00.156Z", "publisher": "VulDB", "title": "GPAC MP4Box box_code_base.c sgpd_del_entry heap-based overflow", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "GPAC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-122", "name": "Heap-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P" }, { "source": "cna", "version": "3.1", "score": 3.3, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C" }, { "source": "cna", "version": "3.0", "score": 3.3, "severity": "LOW", "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C" }, { "source": "cna", "version": "2.0", "score": 1.7, "severity": "", "vector": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C" }, { "source": "NVD:cna@vuldb.com", "type": "Secondary", "version": "4.0", "score": 1.9, "severity": "LOW", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:cna@vuldb.com", "type": "Secondary", "version": "3.1", "score": 3.3, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": "NVD:cna@vuldb.com", "type": "Secondary", "version": "2.0", "score": 1.7, "severity": "", "vector": "AV:L/AC:L/Au:S/C:N/I:N/A:P" } ], "max_cvss_observed_across_sources": 4.8, "cvss_source_score_spread": 3.0999999999999996, "epss": { "score": 0.00124, "percentile": 0.02563 }, "nvd": { "published": "2026-07-06T12:16:39.630", "lastModified": "2026-07-07T15:16:41.887", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-15668", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A crafted sgpd entry drives sgpd_del_entry beyond its heap buffer bounds.", "basis": [ "CNA record", "CWE-122" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://vuldb.com/vuln/376293", "host": "vuldb.com", "sources": [ "cna", "nvd" ], "tags": [ "technical-description", "vdb-entry" ] }, { "url": "https://vuldb.com/vuln/376293/cti", "host": "vuldb.com", "sources": [ "cna", "nvd" ], "tags": [ "permissions-required", "signature" ] }, { "url": "https://vuldb.com/cve/CVE-2025-15668", "host": "vuldb.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] }, { "url": "https://vuldb.com/submit/846851", "host": "vuldb.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] }, { "url": "https://github.com/gpac/gpac/issues/3398", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "issue-tracking" ] }, { "url": "https://github.com/TimChan2001/pocs/raw/refs/heads/main/poc-gpac-0", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit" ] }, { "url": "https://github.com/gpac/gpac/commit/f29f955f2a3b5e8e507caad3e52319f961bf37bf", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://github.com/gpac/gpac/", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 474, "referenceCount": 8, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 7, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-23350", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-01-14T01:07:21.737Z", "date_published": "2026-07-01T14:36:19.755Z", "date_updated": "2026-07-01T16:03:30.696Z", "publisher": "nvidia", "title": "NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input.", "affected": { "vendors": [ "NVIDIA" ], "products": [ { "vendor": "NVIDIA", "product": "BlueField GA" }, { "vendor": "NVIDIA", "product": "BlueField LTS22" }, { "vendor": "NVIDIA", "product": "BlueField LTS23" }, { "vendor": "NVIDIA", "product": "BlueField LTS24" }, { "vendor": "NVIDIA", "product": "ConnectX GA" }, { "vendor": "NVIDIA", "product": "ConnectX LTS22" }, { "vendor": "NVIDIA", "product": "ConnectX LTS23" }, { "vendor": "NVIDIA", "product": "ConnectX LTS24" } ], "affectedBlockCount": 8, "versionEntryCount": 8, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:psirt@nvidia.com", "type": "Secondary", "version": "3.1", "score": 9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9, "cvss_source_score_spread": 0, "epss": { "score": 0.00269, "percentile": 0.18874 }, "nvd": { "published": "2026-07-01T16:16:29.767", "lastModified": "2026-07-01T18:32:29.917", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-23350", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "BlueField GA lets attacker-controlled input reach an out-of-bounds write.", "basis": [ "CNA", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23350", "host": "nvd.nist.gov", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-23350", "host": "www.cve.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/NVIDIA/product-security/tree/main/2026/5699", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 276, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 8, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2025-23351", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-01-14T01:07:21.737Z", "date_published": "2026-07-01T14:39:03.200Z", "date_updated": "2026-07-01T16:03:10.537Z", "publisher": "nvidia", "title": "NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input.", "affected": { "vendors": [ "NVIDIA" ], "products": [ { "vendor": "NVIDIA", "product": "BlueField GA" }, { "vendor": "NVIDIA", "product": "BlueField LTS22" }, { "vendor": "NVIDIA", "product": "BlueField LTS23" }, { "vendor": "NVIDIA", "product": "BlueField LTS24" }, { "vendor": "NVIDIA", "product": "ConnectX GA" }, { "vendor": "NVIDIA", "product": "ConnectX LTS22" }, { "vendor": "NVIDIA", "product": "ConnectX LTS23" }, { "vendor": "NVIDIA", "product": "ConnectX LTS24" }, { "vendor": "NVIDIA", "product": "ConnectX-4" }, { "vendor": "NVIDIA", "product": "ConnectX-4 LX" } ], "affectedBlockCount": 10, "versionEntryCount": 10, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:psirt@nvidia.com", "type": "Secondary", "version": "3.1", "score": 9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9, "cvss_source_score_spread": 0, "epss": { "score": 0.00269, "percentile": 0.18875 }, "nvd": { "published": "2026-07-01T16:16:29.903", "lastModified": "2026-07-01T18:32:29.917", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-23351", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The device command interface writes beyond its destination buffer when a virtual-function user supplies crafted command input.", "basis": [ "CNA", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23351", "host": "nvd.nist.gov", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-23351", "host": "www.cve.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/NVIDIA/product-security/tree/main/2026/5699", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 276, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 10, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2025-27462", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-02-26T09:16:54.461Z", "date_published": "2026-07-09T14:27:03.467Z", "date_updated": "2026-07-09T16:06:58.873Z", "publisher": "XEN", "title": "WinPVDrivers: Excessive permissions on user-exposed devices", "affected": { "vendors": [ "Xen" ], "products": [ { "vendor": "Xen", "product": "Windows PV drivers" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-276", "name": "Incorrect Default Permissions", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "NVD:security@xen.org", "type": "Secondary", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00158, "percentile": 0.05433 }, "nvd": { "published": "2026-07-09T16:16:33.070", "lastModified": "2026-07-09T17:16:56.323", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-27462", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The XenCons user-facing device has no security descriptor, so its facilities inherit access that is broader than intended for unprivileged Windows users.", "basis": [ "CNA", "CWE-276" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://xenbits.xen.org/xsa/advisory-468.html", "host": "xenbits.xen.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 401, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-27463", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-02-26T09:16:54.461Z", "date_published": "2026-07-09T14:29:49.625Z", "date_updated": "2026-07-09T15:52:14.394Z", "publisher": "XEN", "title": "WinPVDrivers: Excessive permissions on user-exposed devices", "affected": { "vendors": [ "Xen" ], "products": [ { "vendor": "Xen", "product": "Windows PV drivers" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-276", "name": "Incorrect Default Permissions", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "NVD:security@xen.org", "type": "Secondary", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00158, "percentile": 0.05433 }, "nvd": { "published": "2026-07-09T16:16:33.203", "lastModified": "2026-07-09T17:16:56.437", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-27463", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The product installs or enables a capability with default permissions that expose it to subjects outside the intended trust boundary.", "basis": [ "CNA record", "NVD", "CWE-276" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://xenbits.xen.org/xsa/advisory-468.html", "host": "xenbits.xen.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 387, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-27464", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-02-26T09:16:54.461Z", "date_published": "2026-07-09T14:35:38.440Z", "date_updated": "2026-07-09T16:07:40.763Z", "publisher": "XEN", "title": "WinPVDrivers: Excessive permissions on user-exposed devices", "affected": { "vendors": [ "Xen" ], "products": [ { "vendor": "Xen", "product": "Windows PV drivers" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-276", "name": "Incorrect Default Permissions", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "NVD:security@xen.org", "type": "Secondary", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00158, "percentile": 0.05433 }, "nvd": { "published": "2026-07-09T16:16:33.313", "lastModified": "2026-07-09T17:16:56.547", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-27464", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The XenBus user-facing device is created without a security descriptor, so its facilities inherit permissions that expose them to unprivileged users.", "basis": [ "CNA", "NVD", "CWE-276" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://xenbits.xen.org/xsa/advisory-468.html", "host": "xenbits.xen.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 387, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-30007", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-03-13T17:27:08.113Z", "date_published": "2026-07-10T17:50:33.868Z", "date_updated": "2026-07-14T22:25:37.912Z", "publisher": "VulnCheck", "title": "HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management", "affected": { "vendors": [ "hestiacp" ], "products": [ { "vendor": "hestiacp", "product": "hestiacp" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.01986, "percentile": 0.78631 }, "nvd": { "published": "2026-07-10T19:17:18.130", "lastModified": "2026-07-20T13:04:01.073", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-30007", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The hestiacp path inserts attacker-controlled text into an operating-system command without preserving the command grammar.", "basis": [ "CNA", "CWE-78" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/hestiacp/hestiacp/releases/tag/1.9.5", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "release-notes" ] }, { "url": "https://github.com/hestiacp/hestiacp/pull/5197", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Patch", "issue-tracking" ] }, { "url": "https://github.com/hestiacp/hestiacp/commit/a74babb739aa92e52b12d6ef52b6b9428ffbbb67", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "patch" ] }, { "url": "https://www.vulncheck.com/advisories/hestiacp-authenticated-os-command-injection-via-dns-record-management", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 535, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-30008", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-03-13T17:27:08.113Z", "date_published": "2026-07-10T17:51:07.679Z", "date_updated": "2026-07-14T22:25:38.598Z", "publisher": "VulnCheck", "title": "HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface", "affected": { "vendors": [ "hestiacp" ], "products": [ { "vendor": "hestiacp", "product": "hestiacp" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "source": "cna", "version": "3.1", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0.8000000000000007, "epss": { "score": 0.00178, "percentile": 0.07531 }, "nvd": { "published": "2026-07-10T19:17:19.243", "lastModified": "2026-07-20T12:57:39.340", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-30008", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An unescaped DNS value breaks out of a data-sort-value HTML attribute because that output is not encoded with htmlspecialchars.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/hestiacp/hestiacp/releases/tag/1.9.5", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "release-notes" ] }, { "url": "https://github.com/hestiacp/hestiacp/pull/5196", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Patch", "issue-tracking" ] }, { "url": "https://github.com/hestiacp/hestiacp/commit/07dda18ef0087ea981ff84d4d5757774cf2124b0", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "patch" ] }, { "url": "https://www.vulncheck.com/advisories/hestiacp-stored-xss-via-dns-record-management-interface", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 514, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 5, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-32781", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-04-10T12:51:12.278Z", "date_published": "2026-07-15T16:31:56.122Z", "date_updated": "2026-07-15T17:29:51.557Z", "publisher": "GitHub_M", "title": "Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId", "affected": { "vendors": [ "apolloconfig" ], "products": [ { "vendor": "apolloconfig", "product": "apollo" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00304, "percentile": 0.22751 }, "nvd": { "published": "2026-07-15T17:16:45.317", "lastModified": "2026-07-15T18:16:44.063", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-32781", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Apollo Portal retrieves a release by identifier without binding the release's application and namespace to the caller's permissions.", "basis": [ "CNA", "CWE-639", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/apolloconfig/apollo/security/advisories/GHSA-jxpj-9j24-w337", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_CONFIRM" ] }, { "url": "https://github.com/apolloconfig/apollo/pull/5378", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_MISC" ] }, { "url": "https://github.com/apolloconfig/apollo/commit/362735ded4f13b62f6ab9df135d7096066e8e291", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_MISC" ] }, { "url": "https://github.com/apolloconfig/apollo/releases/tag/v2.5.0", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 599, "referenceCount": 4, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-36298", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-04-15T21:16:48.650Z", "date_published": "2026-07-30T14:21:48.973Z", "date_updated": "2026-07-31T22:54:44.854Z", "publisher": "ibm", "title": "Security Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "Sterling B2B Integrator" }, { "vendor": "IBM", "product": "Sterling File Gateway" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 8, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:psirt@us.ibm.com", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00162, "percentile": 0.05827 }, "nvd": { "published": "2026-07-30T15:16:22.110", "lastModified": "2026-07-31T23:17:22.727", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-36298", "family": "INTERPRETER_BOUNDARY", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record says attacker-controlled input reaches executable syntax in Sterling B2B Integrator, while the input field and interpreter sink are not public.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7280668", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 551, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2025-36374", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-04-15T21:16:56.325Z", "date_published": "2026-07-30T17:55:11.095Z", "date_updated": "2026-07-30T18:49:22.675Z", "publisher": "ibm", "title": "IBM DataPower Gateway affected by XML external entity injection", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "DataPower Gateway 10.6CD" }, { "vendor": "IBM", "product": "DataPower Gateway 10.5.0" }, { "vendor": "IBM", "product": "DataPower Gateway 10.6.0" } ], "affectedBlockCount": 3, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-611", "name": "Improper Restriction of XML External Entity Reference", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H" }, { "source": "NVD:psirt@us.ibm.com", "type": "Primary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00241, "percentile": 0.15319 }, "nvd": { "published": "2026-07-30T19:16:58.867", "lastModified": "2026-07-30T19:31:02.643", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-36374", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The XML parser resolves attacker-supplied external entities while processing a crafted document.", "basis": [ "CNA", "CWE-611" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7278748", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 222, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2025-36431", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-04-15T21:17:03.968Z", "date_published": "2026-07-30T14:36:56.833Z", "date_updated": "2026-07-30T16:14:23.516Z", "publisher": "ibm", "title": "XSS Security Vulnerability in response header affects IBM Sterling B2B Integrator and IBM Sterling File Gateway", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "Sterling B2B Integrator" }, { "vendor": "IBM", "product": "Sterling File Gateway" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:psirt@us.ibm.com", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00162, "percentile": 0.05827 }, "nvd": { "published": "2026-07-30T15:16:23.057", "lastModified": "2026-07-30T17:16:27.480", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-36431", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled data reaches an HTML or DOM sink without context-appropriate sanitization and output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7280647", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 358, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-40945", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-04-16T09:06:15.879Z", "date_published": "2026-07-14T09:19:08.857Z", "date_updated": "2026-07-14T12:16:59.871Z", "publisher": "siemens", "title": "A vulnerability has been identified in COMOS V10.", "affected": { "vendors": [ "Siemens" ], "products": [ { "vendor": "Siemens", "product": "COMOS V10.4.5" }, { "vendor": "Siemens", "product": "COMOS V10.6" }, { "vendor": "Siemens", "product": "Designcenter NX" }, { "vendor": "Siemens", "product": "Simcenter 3D" }, { "vendor": "Siemens", "product": "Simcenter Femap V2506" }, { "vendor": "Siemens", "product": "Simcenter Femap V2512" }, { "vendor": "Siemens", "product": "Simcenter Nastran" }, { "vendor": "Siemens", "product": "Simcenter STAR-CCM+" }, { "vendor": "Siemens", "product": "Solid Edge SE2025" }, { "vendor": "Siemens", "product": "Solid Edge SE2026" }, { "vendor": "Siemens", "product": "Teamcenter Visualization V2412" }, { "vendor": "Siemens", "product": "Teamcenter Visualization V2506" }, { "vendor": "Siemens", "product": "Teamcenter Visualization V2512" }, { "vendor": "Siemens", "product": "Tecnomatix Plant Simulation V2404" }, { "vendor": "Siemens", "product": "Tecnomatix Plant Simulation V2504" }, { "vendor": "Siemens", "product": "Tecnomatix Process Simulate" } ], "affectedBlockCount": 16, "versionEntryCount": 16, "versionRangeCount": 16, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-426", "name": "Untrusted Search Path", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.7, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "source": "cna", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:productcert@siemens.com", "type": "Secondary", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:productcert@siemens.com", "type": "Secondary", "version": "3.1", "score": 6.7, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 1.7999999999999998, "epss": { "score": 0.00112, "percentile": 0.01566 }, "nvd": { "published": "2026-07-14T10:16:30.783", "lastModified": "2026-07-15T20:27:37.663", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-40945", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Siemens Industrial Edge Management searches an attacker-writable location when loading a dynamic library into a privileged process.", "basis": [ "CNA", "CWE-426" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-288252.html", "host": "cert-portal.siemens.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 995, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 16, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2025-43892", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-04-18T14:46:53.847Z", "date_published": "2026-07-14T15:19:51.080Z", "date_updated": "2026-07-16T14:00:36.002Z", "publisher": "fortinet", "title": "A buffer over-read vulnerability in Fortinet FortiOS 7.", "affected": { "vendors": [ "Fortinet" ], "products": [ { "vendor": "Fortinet", "product": "FortiOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-126", "name": "Buffer Over-read", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C" }, { "source": "NVD:psirt@fortinet.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0.20000000000000018, "epss": { "score": 0.00318, "percentile": 0.24186 }, "nvd": { "published": "2026-07-14T16:16:42.340", "lastModified": "2026-07-16T15:16:29.423", "vulnStatus": "Modified", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-43892", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A length, offset, or termination error makes the program read beyond the end of an allocated buffer.", "basis": [ "CNA", "CWE-126" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://fortiguard.fortinet.com/psirt/#5944", "host": "fortiguard.fortinet.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 328, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2025-44089", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-04-22T00:00:00.000Z", "date_published": "2026-07-22T00:00:00.000Z", "date_updated": "2026-07-24T19:04:11.077Z", "publisher": "mitre", "title": "An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-693", "name": "Protection Mechanism Failure", "abstraction": "Pillar", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00288, "percentile": 0.21015 }, "nvd": { "published": "2026-07-22T21:17:10.460", "lastModified": "2026-07-24T20:16:59.877", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-44089", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The public record says a crafted archive can lead ExpressZip to execute code but does not identify the parser, file-selection rule, or executable boundary that fails.", "basis": [ "CNA", "CWE-693" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-44089.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 139, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-44090", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-04-22T00:00:00.000Z", "date_published": "2026-07-22T00:00:00.000Z", "date_updated": "2026-07-24T19:03:57.818Z", "publisher": "mitre", "title": "An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-693", "name": "Protection Mechanism Failure", "abstraction": "Pillar", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00293, "percentile": 0.21571 }, "nvd": { "published": "2026-07-22T21:17:11.420", "lastModified": "2026-07-24T20:17:01.097", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-44090", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The record says a crafted archive is downloaded and executed but does not identify the engineering failure that permits code execution.", "basis": [ "CNA", "CWE-693" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://ohsoft.net/update/download.php", "host": "ohsoft.net", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-44090.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 134, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-45422", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-04-22T00:00:00.000Z", "date_published": "2026-07-09T00:00:00.000Z", "date_updated": "2026-07-10T17:27:54.190Z", "publisher": "mitre", "title": "Incorrect access control in Proximus b-box v8c.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00375, "percentile": 0.30207 }, "nvd": { "published": "2026-07-09T21:16:54.167", "lastModified": "2026-07-10T18:53:55.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-45422", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "An authenticated b-box user can change port-forwarding rules without the privilege required for that administrative action, although the exact check is not public.", "basis": [ "CNA", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "http://proximus.com", "host": "proximus.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "http://b-box.com", "host": "b-box.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:U/RC:C/CR:H/IR:H/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/MS:C/MC:H/MI:H/MA:H&version=3.1", "host": "nvd.nist.gov", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/Cedrico03/CVE-2025-45422---Bbox", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 165, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-45868", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-04-22T00:00:00.000Z", "date_published": "2026-07-16T00:00:00.000Z", "date_updated": "2026-07-20T16:03:19.761Z", "publisher": "mitre", "title": "LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allowing authenticated user to manipulate SQL queries via crafted input.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00281, "percentile": 0.20361 }, "nvd": { "published": "2026-07-16T16:18:58.563", "lastModified": "2026-07-20T17:17:02.597", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-45868", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "ComparisonServlet incorporates authenticated user input into a SQL query without preserving the boundary between data and SQL syntax.", "basis": [ "CNA", "NVD", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.logicaldoc.com/", "host": "www.logicaldoc.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/netero1010/Vulnerability-Disclosure/blob/main/CVE-2025-45868/README.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 188, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-45869", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-04-22T00:00:00.000Z", "date_published": "2026-07-13T00:00:00.000Z", "date_updated": "2026-07-13T19:29:41.809Z", "publisher": "mitre", "title": "LogicalDOC Enterprise Version up to and before v9.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.002, "percentile": 0.10018 }, "nvd": { "published": "2026-07-13T19:16:36.360", "lastModified": "2026-07-13T20:37:48.157", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-45869", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected component request path lets a caller choose a server-side destination outside the intended network boundary.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.logicaldoc.com/", "host": "www.logicaldoc.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/netero1010/Vulnerability-Disclosure/blob/main/CVE-2025-45869/README.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 274, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-45870", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-04-22T00:00:00.000Z", "date_published": "2026-07-16T00:00:00.000Z", "date_updated": "2026-07-20T15:33:25.104Z", "publisher": "mitre", "title": "LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized acc...", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00362, "percentile": 0.28959 }, "nvd": { "published": "2026-07-16T17:16:53.157", "lastModified": "2026-07-20T16:16:53.563", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-45870", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The fileExt parameter can select a path outside the OnlyOfficeEditor servlet's intended directory.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.logicaldoc.com/", "host": "www.logicaldoc.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/netero1010/Vulnerability-Disclosure/blob/main/CVE-2025-45870/README.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 295, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-50324", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-06-16T00:00:00.000Z", "date_published": "2026-07-22T00:00:00.000Z", "date_updated": "2026-07-24T19:05:41.692Z", "publisher": "mitre", "title": "An issue in Milos Paripovic OneCommander v.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-693", "name": "Protection Mechanism Failure", "abstraction": "Pillar", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00363, "percentile": 0.29035 }, "nvd": { "published": "2026-07-22T21:17:11.530", "lastModified": "2026-07-24T20:17:01.277", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-50324", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The public record for CVE-2025-50324 states affected scope and impact but does not identify a failing check, parser boundary, state transition, resource limit, object selection, or memory-lifetime error that supports a mechanism family.", "basis": [ "CNA", "ADP", "NVD", "CWE-693" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.onecommander.com/", "host": "www.onecommander.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50324.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 138, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-50325", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-06-16T00:00:00.000Z", "date_published": "2026-07-22T00:00:00.000Z", "date_updated": "2026-07-24T19:17:11.474Z", "publisher": "mitre", "title": "BandiZip v.7.37 is affected by a Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of BandiZip", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-693", "name": "Protection Mechanism Failure", "abstraction": "Pillar", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00286, "percentile": 0.20802 }, "nvd": { "published": "2026-07-22T21:17:11.647", "lastModified": "2026-07-24T20:17:01.467", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-50325", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The public record says Bandizip can bypass Mark-of-the-Web protection but does not disclose the file, metadata, or state transition that fails.", "basis": [ "CNA", "NVD", "CWE-693" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://en.bandisoft.com/bandizip/help/zone-identifier/", "host": "en.bandisoft.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://en.bandisoft.com/bandizip/history/", "host": "en.bandisoft.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50325.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 201, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-50327", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-06-16T00:00:00.000Z", "date_published": "2026-07-22T00:00:00.000Z", "date_updated": "2026-07-24T19:15:23.122Z", "publisher": "mitre", "title": "An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection mechanism", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-693", "name": "Protection Mechanism Failure", "abstraction": "Pillar", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00386, "percentile": 0.31325 }, "nvd": { "published": "2026-07-22T21:17:11.760", "lastModified": "2026-07-24T20:17:01.633", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-50327", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The record says Mark-of-the-Web can be bypassed but does not identify which file-handling or trust decision drops or ignores the mark.", "basis": [ "CNA", "ADP", "NVD", "CWE-693" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/fcorbelli/zpaqfranz/releases/", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50327.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 187, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-50329", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-06-16T00:00:00.000Z", "date_published": "2026-07-22T00:00:00.000Z", "date_updated": "2026-07-24T19:13:10.771Z", "publisher": "mitre", "title": "An issue in ConeXware, Inc Power Archiver v.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-693", "name": "Protection Mechanism Failure", "abstraction": "Pillar", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0057, "percentile": 0.43948 }, "nvd": { "published": "2026-07-22T21:17:11.873", "lastModified": "2026-07-24T20:17:01.797", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-50329", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The public record states that powerarc.exe permits remote privilege escalation and code execution but does not disclose the enabling check, parser, or memory error.", "basis": [ "CNA", "CWE-693", "https://www.powerarchiver.com/" ], "deepDive": true, "notes": "Primary source inspected: https://www.powerarchiver.com/. The vendor site exposes no CVE advisory, patch, vulnerable code path, or causal check, so the archive-memory cause remains undetermined." }, "references": [ { "url": "https://www.powerarchiver.com/", "host": "www.powerarchiver.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50329.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/OV-0-VO/Public-references/commit/20437207859288ad1502fed2caebc38be27a3450", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 160, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-50330", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-06-16T00:00:00.000Z", "date_published": "2026-07-22T00:00:00.000Z", "date_updated": "2026-07-24T19:11:13.648Z", "publisher": "mitre", "title": "An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute arbitrary code via the zipgenius.exe.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-693", "name": "Protection Mechanism Failure", "abstraction": "Pillar", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00363, "percentile": 0.29034 }, "nvd": { "published": "2026-07-22T21:17:11.983", "lastModified": "2026-07-24T20:17:01.963", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-50330", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The record reports privilege escalation and code execution through zipgenius.exe but does not disclose the enabling engineering failure.", "basis": [ "CNA", "CWE-693" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://zipgenius.it/en/downloads-2/", "host": "zipgenius.it", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50330.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 158, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-50455", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-06-16T00:00:00.000Z", "date_published": "2026-07-27T00:00:00.000Z", "date_updated": "2026-07-27T17:40:00.291Z", "publisher": "mitre", "title": "SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00552, "percentile": 0.4306 }, "nvd": { "published": "2026-07-27T16:16:58.860", "lastModified": "2026-07-30T19:32:25.133", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-50455", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The customers search endpoint incorporates the order_by parameter into SQL without preserving the SQL grammar boundary.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.linkedin.com/posts/michael-chesang_cve-securityadvisory-appsec-activity-7360754900827365376-Z-IY", "host": "www.linkedin.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/advisory.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] }, { "url": "https://github.com/threatlance-org/security-advisories/blob/main/CVE-2025-50455/poc.py", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 452, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-51677", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-06-16T00:00:00.000Z", "date_published": "2026-07-17T00:00:00.000Z", "date_updated": "2026-07-20T18:14:01.358Z", "publisher": "mitre", "title": "An issue was discovered in openRISC OR1200 commit 83ac6b.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-116", "name": "Improper Encoding or Escaping of Output", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00432, "percentile": 0.35519 }, "nvd": { "published": "2026-07-17T20:17:13.763", "lastModified": "2026-07-23T18:17:51.380", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-51677", "family": "HARDWARE_PHYSICAL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The synthesized OR1200 load-store-unit netlist produces a du_lsu_load_dat output that diverges from the RTL design under the same stimulus.", "basis": [ "CNA", "CWE-116", "GitHub issue openrisc/mor1kx#160", "arXiv:2504.18812" ], "deepDive": true, "notes": "Inspected https://github.com/openrisc/mor1kx/issues/160 and https://arxiv.org/abs/2504.18812; both confirm RTL/netlist divergence found with Synopsys DC and Cadence Genus, while neither identifies a repaired RTL statement or synthesis transformation." }, "references": [ { "url": "https://github.com/openrisc/mor1kx/issues/160#issuecomment-2585618940", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.arxiv.org/abs/2504.18812", "host": "www.arxiv.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://mason.gmu.edu/~rsaravan/projects/synfuzz/cve/cve.html", "host": "mason.gmu.edu", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 171, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-51678", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-06-16T00:00:00.000Z", "date_published": "2026-07-17T00:00:00.000Z", "date_updated": "2026-07-20T17:56:52.867Z", "publisher": "mitre", "title": "An issue was discovered in RISC-V PicoRV32 commit 87c89a.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] }, { "id": "CWE-704", "name": "Incorrect Type Conversion or Cast", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00432, "percentile": 0.35518 }, "nvd": { "published": "2026-07-17T20:17:13.887", "lastModified": "2026-07-23T18:17:51.380", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-51678", "family": "HARDWARE_PHYSICAL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The processor can associate a PCPI instruction with the wrong memory address, producing an invalid hardware state transition.", "basis": [ "CNA", "CWE-119", "CWE-704" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/YosysHQ/picorv32/issues/269", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.arxiv.org/abs/2504.18812", "host": "www.arxiv.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://mason.gmu.edu/~rsaravan/projects/synfuzz/cve/cve.html", "host": "mason.gmu.edu", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 137, "referenceCount": 3, "cweCount": 2, "cnaCweCount": 0, "adpCweCount": 2, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-51684", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-06-16T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-07-31T19:11:17.155Z", "publisher": "mitre", "title": "CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that...", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00217, "percentile": 0.12231 }, "nvd": { "published": "2026-07-30T20:16:51.793", "lastModified": "2026-07-31T20:16:44.277", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-51684", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled data reaches an HTML or DOM sink without context-appropriate sanitization and output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/CleverTap/clevertap-web-sdk/issues/416", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 355, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-53379", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-06-27T15:44:12.816Z", "date_published": "2026-07-14T15:13:02.254Z", "date_updated": "2026-07-22T13:57:33.288Z", "publisher": "fortinet", "title": "A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.", "affected": { "vendors": [ "Fortinet" ], "products": [ { "vendor": "Fortinet", "product": "FortiAuthenticator" } ], "affectedBlockCount": 1, "versionEntryCount": 4, "versionRangeCount": 4, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-125", "name": "Out-of-bounds Read", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C" }, { "source": "NVD:psirt@fortinet.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00385, "percentile": 0.31249 }, "nvd": { "published": "2026-07-14T16:16:42.477", "lastModified": "2026-07-15T18:30:56.310", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-53379", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "FortiAuthenticator can read beyond the valid bounds of an input or object allocation while processing attacker-influenced data.", "basis": [ "CNA", "CWE-125" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-146", "host": "fortiguard.fortinet.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 233, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2025-53827", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-07-09T14:14:52.530Z", "date_published": "2026-07-06T14:31:07.220Z", "date_updated": "2026-07-08T03:56:33.632Z", "publisher": "GitHub_M", "title": "ownCloud Core: Updater has an exposed dangerous method or function", "affected": { "vendors": [ "owncloud" ], "products": [ { "vendor": "owncloud", "product": "ownCloud Core" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-749", "name": "Exposed Dangerous Method or Function", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00362, "percentile": 0.28874 }, "nvd": { "published": "2026-07-06T16:16:26.740", "lastModified": "2026-07-08T05:16:24.890", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-53827", "family": "OTHER_SPECIFIC", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The updater exposes code-executing functionality to an administrator, but the public advisory does not identify the dangerous method or the missing restriction around it.", "basis": [ "CNA", "CWE-749", "https://github.com/owncloud/security-advisories/security/advisories/GHSA-hvcx-ph66-mmvw" ], "deepDive": true, "notes": "The official advisory confirms administrator-level reachability and recommends 10.15.3 or disabling Updater, but publishes no method, request, or patch path." }, "references": [ { "url": "https://github.com/owncloud/security-advisories/security/advisories/GHSA-hvcx-ph66-mmvw", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_CONFIRM" ] } ], "record_shape": { "descriptionChars": 380, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-53828", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-07-09T14:14:52.530Z", "date_published": "2026-07-06T14:41:55.647Z", "date_updated": "2026-07-08T03:56:34.441Z", "publisher": "GitHub_M", "title": "SharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)", "affected": { "vendors": [ "owncloud" ], "products": [ { "vendor": "owncloud", "product": "SharePoint" }, { "vendor": "owncloud", "product": "ownCloud 10" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00232, "percentile": 0.14147 }, "nvd": { "published": "2026-07-06T16:16:26.903", "lastModified": "2026-07-08T05:16:25.877", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-53828", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "SharePoint follows a caller-controlled server-side URL without restricting the resolved destination to an allowed network scope.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/owncloud/security-advisories/security/advisories/GHSA-4m66-rpfj-m5f6", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_CONFIRM" ] } ], "record_shape": { "descriptionChars": 490, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-53829", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-07-09T14:14:52.531Z", "date_published": "2026-07-06T14:46:40.933Z", "date_updated": "2026-07-08T03:56:35.191Z", "publisher": "GitHub_M", "title": "ownCloud 10 is vulnerable to Relative Path Traversal", "affected": { "vendors": [ "owncloud" ], "products": [ { "vendor": "owncloud", "product": "ownCloud 10" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-23", "name": "Relative Path Traversal", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "3.1", "score": 8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8, "cvss_source_score_spread": 0, "epss": { "score": 0.00335, "percentile": 0.26026 }, "nvd": { "published": "2026-07-06T16:16:27.033", "lastModified": "2026-07-08T05:16:25.977", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-53829", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An administrative input can traverse outside the intended ownCloud path namespace and select code-bearing files.", "basis": [ "CNA", "CWE-23" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/owncloud/security-advisories/security/advisories/GHSA-4439-4wxm-c9px", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_CONFIRM" ] } ], "record_shape": { "descriptionChars": 305, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-53830", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-07-09T14:14:52.531Z", "date_published": "2026-07-06T15:17:01.924Z", "date_updated": "2026-07-08T03:56:35.944Z", "publisher": "GitHub_M", "title": "Anti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)", "affected": { "vendors": [ "owncloud" ], "products": [ { "vendor": "owncloud", "product": "Anti-Virus for ownCloud" }, { "vendor": "owncloud", "product": "ownCloud 10" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00257, "percentile": 0.17257 }, "nvd": { "published": "2026-07-06T16:16:27.157", "lastModified": "2026-07-08T05:16:26.073", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-53830", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A server-side request accepts an attacker-selected destination without enforcing the intended network boundary.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/owncloud/security-advisories/security/advisories/GHSA-3wg4-mg27-hj4w", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_CONFIRM" ] } ], "record_shape": { "descriptionChars": 416, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-53831", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-07-09T14:14:52.531Z", "date_published": "2026-07-06T16:23:35.257Z", "date_updated": "2026-07-06T18:49:06.961Z", "publisher": "GitHub_M", "title": "DrawIO for ownCloud 10 is vulnerable to Stored XSS", "affected": { "vendors": [ "owncloud" ], "products": [ { "vendor": "owncloud", "product": "DrawIO for ownCloud" }, { "vendor": "owncloud", "product": "ownCloud 10" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.06009 }, "nvd": { "published": "2026-07-06T17:16:26.870", "lastModified": "2026-07-06T19:16:54.250", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-53831", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "DrawIO input is stored and later rendered into a web page without the escaping required for its HTML context.", "basis": [ "CNA record", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/owncloud/security-advisories/security/advisories/GHSA-r9j8-fr2h-m47q", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_CONFIRM" ] } ], "record_shape": { "descriptionChars": 506, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-56361", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-08-16T00:00:00.000Z", "date_published": "2026-07-14T00:00:00.000Z", "date_updated": "2026-07-15T14:27:15.683Z", "publisher": "mitre", "title": "A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-617", "name": "Reachable Assertion", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00411, "percentile": 0.33759 }, "nvd": { "published": "2026-07-14T22:16:50.857", "lastModified": "2026-07-17T03:18:44.757", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-56361", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A MoveToLevel transition followed by a conflicting OperationMode write creates a state combination that reaches an internal assertion.", "basis": [ "CNA", "CWE-617" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/project-chip/connectedhomeip/issues/38619", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "Exploit", "Issue Tracking", "exploit" ] }, { "url": "https://github.com/project-chip/connectedhomeip/", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product" ] } ], "record_shape": { "descriptionChars": 612, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-56362", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-08-16T00:00:00.000Z", "date_published": "2026-07-14T00:00:00.000Z", "date_updated": "2026-07-15T14:23:19.667Z", "publisher": "mitre", "title": "A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-617", "name": "Reachable Assertion", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00338, "percentile": 0.26424 }, "nvd": { "published": "2026-07-14T23:17:27.193", "lastModified": "2026-07-17T03:10:14.310", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-56362", "family": "STATE_SEQUENCE", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A MoveToLevel command followed by OperationMode 2 leaves currentLevel outside the asserted range and reaches a fatal assertion.", "basis": [ "CNA", "CWE-617" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/project-chip/connectedhomeip/issues/38618", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "Exploit", "Issue Tracking", "exploit" ] }, { "url": "https://github.com/project-chip/connectedhomeip/", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product" ] } ], "record_shape": { "descriptionChars": 542, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-56363", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-08-16T00:00:00.000Z", "date_published": "2026-07-14T00:00:00.000Z", "date_updated": "2026-07-15T14:21:50.878Z", "publisher": "mitre", "title": "A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-476", "name": "NULL Pointer Dereference", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00378, "percentile": 0.30545 }, "nvd": { "published": "2026-07-14T23:17:27.367", "lastModified": "2026-07-17T03:07:54.360", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-56363", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "ReadRevisionAttribute dereferences a cluster delegate without first proving that the delegate pointer is non-null.", "basis": [ "CNA", "CWE-476" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/project-chip/connectedhomeip/issues/39173", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "Exploit", "Issue Tracking", "exploit" ] }, { "url": "https://github.com/project-chip/connectedhomeip/", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product" ] } ], "record_shape": { "descriptionChars": 509, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-56364", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-08-16T00:00:00.000Z", "date_published": "2026-07-14T00:00:00.000Z", "date_updated": "2026-07-15T14:20:03.829Z", "publisher": "mitre", "title": "A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-457", "name": "Use of Uninitialized Variable", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00331, "percentile": 0.25659 }, "nvd": { "published": "2026-07-14T23:17:27.467", "lastModified": "2026-07-17T03:00:07.473", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-56364", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected path consumes a variable or optional value before establishing that it was initialized.", "basis": [ "CNA record", "ADP", "NVD", "CWE-457" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/project-chip/connectedhomeip/issues/36711", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "Issue Tracking", "exploit" ] }, { "url": "https://github.com/project-chip/connectedhomeip/pull/36729", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch" ] }, { "url": "https://github.com/project-chip/connectedhomeip/", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product" ] } ], "record_shape": { "descriptionChars": 478, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-56365", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-08-16T00:00:00.000Z", "date_published": "2026-07-14T00:00:00.000Z", "date_updated": "2026-07-15T14:17:52.828Z", "publisher": "mitre", "title": "A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-617", "name": "Reachable Assertion", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00362, "percentile": 0.28915 }, "nvd": { "published": "2026-07-14T23:17:27.593", "lastModified": "2026-07-17T03:19:43.137", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-56365", "family": "OTHER_SPECIFIC", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "CodegenDataModelProvider::Invoke treats a nonexistent endpoint and cluster as valid, allowing the request to reach a fatal assertion in ProcessCommandDataIB.", "basis": [ "CNA", "NVD", "CWE-617" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/project-chip/connectedhomeip/issues/37184", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "Exploit", "Issue Tracking", "exploit" ] }, { "url": "https://github.com/project-chip/connectedhomeip/pull/37207", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch" ] }, { "url": "https://github.com/project-chip/connectedhomeip/", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product" ] } ], "record_shape": { "descriptionChars": 508, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-58146", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-08-26T06:48:41.443Z", "date_published": "2026-07-09T14:42:22.690Z", "date_updated": "2026-07-09T16:07:56.939Z", "publisher": "XEN", "title": "XAPI UTF-8 string handling", "affected": { "vendors": [ "Xen" ], "products": [ { "vendor": "Xen", "product": "XAPI" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-20", "name": "Improper Input Validation", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "NVD:security@xen.org", "type": "Secondary", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00137, "percentile": 0.03563 }, "nvd": { "published": "2026-07-09T16:16:33.687", "lastModified": "2026-07-09T17:16:56.657", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-58146", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "XAPI accepts strings under one UTF-8 rule and later processes them under stricter libraries, while some database update paths also reuse unsanitized values, allowing malformed state to stop event processing or prevent database reload.", "basis": [ "CNA", "CWE-20" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://xenbits.xen.org/xsa/advisory-474.html", "host": "xenbits.xen.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "http://www.openwall.com/lists/oss-security/2025/09/09/3", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] }, { "url": "http://xenbits.xen.org/xsa/advisory-474.html", "host": "xenbits.xen.org", "sources": [ "adp:0", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 713, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-58151", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-08-26T06:48:41.444Z", "date_published": "2026-07-09T14:45:16.531Z", "date_updated": "2026-07-09T15:41:25.431Z", "publisher": "XEN", "title": "varstored: TOCTOU issues with mapped guest memory", "affected": { "vendors": [ "Xen" ], "products": [ { "vendor": "Xen", "product": "varstored" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-367", "name": "Time-of-check Time-of-use (TOCTOU) Race Condition", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "NVD:security@xen.org", "type": "Secondary", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.4, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02114 }, "nvd": { "published": "2026-07-09T16:16:33.817", "lastModified": "2026-07-09T17:16:56.770", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-58151", "family": "STATE_SEQUENCE", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Missing compiler barriers let the guest change a shared-buffer value after validation and before it indexes a jump table.", "basis": [ "CNA", "CWE-367" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://xenbits.xen.org/xsa/advisory-478.html", "host": "xenbits.xen.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/27/2", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] }, { "url": "http://xenbits.xen.org/xsa/advisory-478.html", "host": "xenbits.xen.org", "sources": [ "adp:0", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 479, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-58902", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-05T10:50:39.330Z", "date_published": "2026-07-02T11:14:39.340Z", "date_updated": "2026-07-02T12:51:06.576Z", "publisher": "Patchstack", "title": "WordPress Lighthouse theme <= 1.2.12 - Local File Inclusion vulnerability", "affected": { "vendors": [ "AncoraThemes" ], "products": [ { "vendor": "AncoraThemes", "product": "Lighthouse" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-98", "name": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00274, "percentile": 0.19576 }, "nvd": { "published": "2026-07-02T12:16:51.187", "lastModified": "2026-07-02T13:58:23.330", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-58902", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Lighthouse include path accepts an attacker-controlled filename that can select a local file outside the intended include set.", "basis": [ "CNA", "CWE-98" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/lighthouseschool/vulnerability/wordpress-lighthouse-theme-1-2-12-local-file-inclusion-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 70, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-59172", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-10T13:24:49.360Z", "date_published": "2026-07-27T14:03:14.214Z", "date_updated": "2026-07-27T15:04:04.155Z", "publisher": "ERIC", "title": "Improper Neutralization of Special Elements used in an OS Command Vulnerability", "affected": { "vendors": [ "Ericsson" ], "products": [ { "vendor": "Ericsson", "product": "Packet Core Controller (PCC)" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0018, "percentile": 0.078 }, "nvd": { "published": "2026-07-27T15:16:45.017", "lastModified": "2026-07-28T16:17:16.127", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-59172", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled command elements reach an operating-system command context in Ericsson Packet Core Controller without required neutralization.", "basis": [ "CNA", "CWE-78" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026", "host": "www.ericsson.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 185, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-59177", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-10T13:24:49.361Z", "date_published": "2026-07-27T14:11:59.865Z", "date_updated": "2026-07-27T15:04:26.143Z", "publisher": "ERIC", "title": "Generation of Error Message Containing Sensitive Information Vulnerability", "affected": { "vendors": [ "Ericsson" ], "products": [ { "vendor": "Ericsson", "product": "Ericsson Packet Core Controller (PCC)" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-209", "name": "Generation of Error Message Containing Sensitive Information", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary", "version": "4.0", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 6.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00146, "percentile": 0.04383 }, "nvd": { "published": "2026-07-27T15:16:45.893", "lastModified": "2026-07-28T16:17:16.127", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-59177", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages.", "basis": [ "CNA", "CWE-209" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026", "host": "www.ericsson.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 223, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-59178", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-10T13:24:49.361Z", "date_published": "2026-07-27T14:15:45.592Z", "date_updated": "2026-07-27T15:06:03.400Z", "publisher": "ERIC", "title": "Exposure of Sensitive System Information to an Unauthorized Control Sphere Vulnerability", "affected": { "vendors": [ "Ericsson" ], "products": [ { "vendor": "Ericsson", "product": "Packet Core Controller (PCC)" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-497", "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary", "version": "4.0", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 4.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00146, "percentile": 0.04383 }, "nvd": { "published": "2026-07-27T15:16:46.020", "lastModified": "2026-07-28T16:17:16.127", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-59178", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The endpoint returns user and system details to an observer who lacks authority to receive them.", "basis": [ "CNA", "CWE-497" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026", "host": "www.ericsson.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 215, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-59180", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-10T13:24:49.362Z", "date_published": "2026-07-27T14:19:16.119Z", "date_updated": "2026-07-27T15:08:17.243Z", "publisher": "ERIC", "title": "Use of Hard-coded Credentials Vulnerability", "affected": { "vendors": [ "Ericsson" ], "products": [ { "vendor": "Ericsson", "product": "Packet Core Controller (PCC)" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-798", "name": "Use of Hard-coded Credentials", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 5.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00111, "percentile": 0.01512 }, "nvd": { "published": "2026-07-27T15:16:46.170", "lastModified": "2026-07-28T16:17:16.127", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-59180", "family": "CRYPTO_SECRET", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The affected component generates, stores, validates, or uses a credential or authenticity value without the required secrecy or binding.", "basis": [ "CNA", "CWE-798" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026", "host": "www.ericsson.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 246, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-59181", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-10T13:24:49.362Z", "date_published": "2026-07-27T14:21:48.696Z", "date_updated": "2026-07-27T15:07:53.787Z", "publisher": "ERIC", "title": "Path traversal Vulnerability", "affected": { "vendors": [ "Ericsson" ], "products": [ { "vendor": "Ericsson", "product": "Packet Core Controller (PCC)" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-35", "name": "Path Traversal: '.../...//'", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:85b1779b-6ecd-4f52-bcc5-73eac4659dcf", "type": "Secondary", "version": "4.0", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 4.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00268, "percentile": 0.18727 }, "nvd": { "published": "2026-07-27T15:16:46.300", "lastModified": "2026-07-28T16:17:16.127", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-59181", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Ericsson management endpoint lets a caller traverse outside the intended directory and change permissions on a selected filesystem object.", "basis": [ "CNA", "CWE-35" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-pcc-july-2026", "host": "www.ericsson.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 230, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-59615", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-18T03:19:23.202Z", "date_published": "2026-07-06T20:09:31.634Z", "date_updated": "2026-07-07T13:11:29.305Z", "publisher": "qualcomm", "title": "Use After Free in Computer Vision", "affected": { "vendors": [ "Qualcomm, Inc." ], "products": [ { "vendor": "Qualcomm, Inc.", "product": "Snapdragon" } ], "affectedBlockCount": 1, "versionEntryCount": 60, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-416", "name": "Use After Free", "abstraction": "Variant", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L" }, { "source": "NVD:product-security@qualcomm.com", "type": "Secondary", "version": "3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 1.2000000000000002, "epss": { "score": 0.00064, "percentile": 0.0002 }, "nvd": { "published": "2026-07-06T21:16:52.077", "lastModified": "2026-07-07T17:03:12.387", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-59615", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Mapping and unmapping persistent-memory buffers can run without the synchronization needed to keep the referenced buffer alive across both operations.", "basis": [ "CNA", "CWE-416" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html", "host": "docs.qualcomm.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 155, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 60 } }, { "cve_id": "CVE-2025-59616", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-18T03:19:23.202Z", "date_published": "2026-07-06T20:09:32.700Z", "date_updated": "2026-07-07T13:11:17.423Z", "publisher": "qualcomm", "title": "Use After Free in Computer Vision", "affected": { "vendors": [ "Qualcomm, Inc." ], "products": [ { "vendor": "Qualcomm, Inc.", "product": "Snapdragon" } ], "affectedBlockCount": 1, "versionEntryCount": 48, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-416", "name": "Use After Free", "abstraction": "Variant", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L" }, { "source": "NVD:product-security@qualcomm.com", "type": "Secondary", "version": "3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 1.2000000000000002, "epss": { "score": 0.00064, "percentile": 0.00021 }, "nvd": { "published": "2026-07-06T21:16:52.513", "lastModified": "2026-07-07T17:00:24.487", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-59616", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Repeated IOCTL calls can reuse the same buffer file descriptor after its backing object has already been freed.", "basis": [ "CNA", "CWE-416" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html", "host": "docs.qualcomm.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 136, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 48 } }, { "cve_id": "CVE-2025-59617", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-18T03:19:23.202Z", "date_published": "2026-07-06T20:09:33.799Z", "date_updated": "2026-07-07T13:11:08.093Z", "publisher": "qualcomm", "title": "Use After Free in Computer Vision", "affected": { "vendors": [ "Qualcomm, Inc." ], "products": [ { "vendor": "Qualcomm, Inc.", "product": "Snapdragon" } ], "affectedBlockCount": 1, "versionEntryCount": 48, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-416", "name": "Use After Free", "abstraction": "Variant", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L" }, { "source": "NVD:product-security@qualcomm.com", "type": "Secondary", "version": "3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0.7000000000000002, "epss": { "score": 0.00065, "percentile": 0.00022 }, "nvd": { "published": "2026-07-06T21:16:52.653", "lastModified": "2026-07-07T16:59:44.367", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-59617", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Repeated IOCTL calls using the same buffer file descriptor leave an object reachable after its storage has been freed.", "basis": [ "CNA", "CWE-416" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2026-bulletin.html", "host": "docs.qualcomm.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 98, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 48 } }, { "cve_id": "CVE-2025-59866", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-22T15:00:11.102Z", "date_published": "2026-07-17T17:22:03.343Z", "date_updated": "2026-07-17T17:52:43.779Z", "publisher": "HCL", "title": "The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in non-administrative user to overwrite or replace the executable f...", "affected": { "vendors": [ "HCLSoftware" ], "products": [ { "vendor": "HCLSoftware", "product": "DFMPro for CATIA" }, { "vendor": "HCLSoftware", "product": "DFXAnalytics" }, { "vendor": "HCLSoftware", "product": "DFXServer" } ], "affectedBlockCount": 3, "versionEntryCount": 3, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 3.3, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 3.3, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 3.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00074, "percentile": 0.001 }, "nvd": { "published": "2026-07-17T18:17:12.643", "lastModified": "2026-07-17T18:30:38.987", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-59866", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The installers leave an executable writable by non-administrative users, allowing a local user to replace code that a privileged context later runs.", "basis": [ "CNA", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132365", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 265, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2025-60357", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-26T00:00:00.000Z", "date_published": "2026-07-17T00:00:00.000Z", "date_updated": "2026-07-17T16:48:37.328Z", "publisher": "mitre", "title": "AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-943", "name": "Improper Neutralization of Special Elements in Data Query Logic", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00286, "percentile": 0.20873 }, "nvd": { "published": "2026-07-17T14:17:19.003", "lastModified": "2026-07-17T18:47:13.683", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-60357", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The eventlog/agentEvent/list endpoint incorporates attacker-controlled values into NoSQL query logic without neutralizing query operators.", "basis": [ "CNA", "NVD", "CWE-943" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://ahnlab.com", "host": "ahnlab.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/Nullbyte3117/CVE-2025-60357", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 138, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-60835", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-26T00:00:00.000Z", "date_published": "2026-07-22T00:00:00.000Z", "date_updated": "2026-07-24T19:08:43.994Z", "publisher": "mitre", "title": "An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-35", "name": "Path Traversal: '.../...//'", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00148, "percentile": 0.04485 }, "nvd": { "published": "2026-07-22T21:17:12.097", "lastModified": "2026-07-24T20:17:02.137", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-60835", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected component file operation accepts an attacker-controlled path that escapes the intended directory or storage target.", "basis": [ "CNA", "CWE-35" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.rarlab.com/rar_add.htm", "host": "www.rarlab.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.izarc.org/", "host": "www.izarc.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-60835.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/OV-0-VO/Public-references/commit/834a2be23292cbb305053a5d78d4d95c096e43b5", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 95, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-60931", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-09-26T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-29T18:12:36.155Z", "publisher": "mitre", "title": "An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00232, "percentile": 0.14167 }, "nvd": { "published": "2026-07-29T17:16:50.367", "lastModified": "2026-07-30T14:12:18.697", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-60931", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The compensation-view request trusts a caller-controlled employee identifier without checking that the caller may view that employee.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://docs.offsecguy.com/cve/infor/vulnerability/insecure-direct-object-references-idor", "host": "docs.offsecguy.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 245, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-62347", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-10-10T09:04:27.772Z", "date_published": "2026-07-31T15:16:02.020Z", "date_updated": "2026-07-31T17:39:58.918Z", "publisher": "HCL", "title": "HCL iControl was affected by Improper Input Validation vulnerability.", "affected": { "vendors": [ "HCL" ], "products": [ { "vendor": "HCL", "product": "HCL iControl" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-20", "name": "Improper Input Validation", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:psirt@hcl.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00185, "percentile": 0.08351 }, "nvd": { "published": "2026-07-31T16:16:56.500", "lastModified": "2026-07-31T18:17:08.400", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-62347", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The affected input handler accepts a value whose runtime type does not match the type required by its security-sensitive operation.", "basis": [ "CNA", "CWE-20" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132395", "host": "support.hcl-software.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 313, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-62675", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-10-20T08:07:37.650Z", "date_published": "2026-07-14T15:15:12.695Z", "date_updated": "2026-07-14T16:02:45.423Z", "publisher": "fortinet", "title": "An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.", "affected": { "vendors": [ "Fortinet" ], "products": [ { "vendor": "Fortinet", "product": "FortiOS" }, { "vendor": "Fortinet", "product": "FortiPAM" }, { "vendor": "Fortinet", "product": "FortiProxy" } ], "affectedBlockCount": 3, "versionEntryCount": 17, "versionRangeCount": 15, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 3.4, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N/E:P/RL:O/RC:C" }, { "source": "NVD:psirt@fortinet.com", "type": "Secondary", "version": "3.1", "score": 3.4, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0.8999999999999999, "epss": { "score": 0.00238, "percentile": 0.14923 }, "nvd": { "published": "2026-07-14T16:16:42.617", "lastModified": "2026-07-14T18:45:16.350", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-62675", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "FortiOS permits attacker-controlled CRLF bytes to enter an HTTP response header, allowing those bytes to be interpreted as new header or response structure.", "basis": [ "CNA", "NVD", "CWE-113" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-152", "host": "fortiguard.fortinet.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 462, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 3, "affectedVersionEntryCount": 17 } }, { "cve_id": "CVE-2025-62826", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-10-23T11:55:45.919Z", "date_published": "2026-07-14T15:19:46.918Z", "date_updated": "2026-07-14T16:02:27.387Z", "publisher": "fortinet", "title": "An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.", "affected": { "vendors": [ "Fortinet" ], "products": [ { "vendor": "Fortinet", "product": "FortiPAM" }, { "vendor": "Fortinet", "product": "FortiProxy" }, { "vendor": "Fortinet", "product": "FortiOS" } ], "affectedBlockCount": 3, "versionEntryCount": 17, "versionRangeCount": 15, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 3.1, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C" }, { "source": "NVD:psirt@fortinet.com", "type": "Secondary", "version": "3.1", "score": 3.1, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 1.1999999999999997, "epss": { "score": 0.00257, "percentile": 0.17343 }, "nvd": { "published": "2026-07-14T16:16:42.850", "lastModified": "2026-07-14T18:46:00.140", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-62826", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Crafted captive-portal input permits CRLF bytes to create additional HTTP header fields in the generated response.", "basis": [ "CNA", "NVD", "CWE-113" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-153", "host": "fortiguard.fortinet.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 461, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 3, "affectedVersionEntryCount": 17 } }, { "cve_id": "CVE-2025-63579", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-10-27T00:00:00.000Z", "date_published": "2026-07-09T00:00:00.000Z", "date_updated": "2026-07-09T19:45:11.618Z", "publisher": "mitre", "title": "Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] }, { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] }, { "id": "CWE-311", "name": "Missing Encryption of Sensitive Data", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] }, { "id": "CWE-326", "name": "Inadequate Encryption Strength", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00199, "percentile": 0.09962 }, "nvd": { "published": "2026-07-09T19:16:57.757", "lastModified": "2026-07-10T18:50:20.507", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-63579", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The record reports unauthenticated address-book export and decryption but does not identify whether the enabling failure is an access check, key handling, or cryptographic validation error.", "basis": [ "CNA", "ADP", "NVD", "CWE-200", "CWE-284", "CWE-311", "CWE-326" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/barisbaydur/CVE-2025-63579", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://global.kyocera.com/", "host": "global.kyocera.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 592, "referenceCount": 2, "cweCount": 4, "cnaCweCount": 0, "adpCweCount": 4, "nvdCweCount": 4, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-63913", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-10-27T00:00:00.000Z", "date_published": "2026-07-27T00:00:00.000Z", "date_updated": "2026-07-28T13:37:44.677Z", "publisher": "mitre", "title": "An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-400", "name": "Uncontrolled Resource Consumption", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00263, "percentile": 0.17962 }, "nvd": { "published": "2026-07-27T23:16:39.717", "lastModified": "2026-07-28T14:16:32.443", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-63913", "family": "RESOURCE_CONTROL", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A crafted SBI PMU request causes denial of service, but the public record does not identify the resource or termination condition that fails.", "basis": [ "CNA", "CWE-400" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/luojia65/opensbi-pmu2-crash", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 207, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-65336", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-11-18T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-07-31T18:27:20.234Z", "publisher": "mitre", "title": "Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00321, "percentile": 0.24521 }, "nvd": { "published": "2026-07-30T21:16:50.690", "lastModified": "2026-07-31T19:17:01.110", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-65336", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The show_price_by_pdtId endpoint incorporates untrusted input into an SQL statement without preserving the SQL grammar boundary.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/ecommercefruitsbazarmaster/20250811-ecommerce-project-with-php-and-mysqli-fruits-bazar-show_price_by_pdtid.php-pid-sqli/20250811-ecommerce-project-with-php-and-mysqli-fruits-bazar-show_price_by_pdtid.php-pid-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 114, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-65337", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-11-18T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-30T17:40:12.190Z", "publisher": "mitre", "title": "Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00155, "percentile": 0.05135 }, "nvd": { "published": "2026-07-29T21:17:45.760", "lastModified": "2026-07-30T19:16:59.047", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-65337", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "pageEditMember.php renders the address field as browser markup without the required output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.sourcecodester.com/php/12258/fantastic-blog-cms-php.html", "host": "www.sourcecodester.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/um-dsp/TaintRadar/blob/main/XSS_cve/fantasticblog/XSS1.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 126, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-65340", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-11-18T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-30T17:39:30.597Z", "publisher": "mitre", "title": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17663 }, "nvd": { "published": "2026-07-29T21:17:45.880", "lastModified": "2026-07-30T19:17:00.743", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-65340", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-betweendates-detailsreports.php-fromdate-sqli/20250811-hospital-management-system-betweendates-detailsreports.php-fromdate-sqli.md#injection-techniques-as-identified-by-sqlmap", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 109, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-65341", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-11-18T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-07-31T19:08:58.577Z", "publisher": "mitre", "title": "Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00149, "percentile": 0.04576 }, "nvd": { "published": "2026-07-30T21:16:51.667", "lastModified": "2026-07-31T20:16:45.390", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-65341", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/XSS_cve/ecommercefruitsbazar/XSS.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 97, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-65342", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-11-18T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-07-31T18:45:44.327Z", "publisher": "mitre", "title": "code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00149, "percentile": 0.04581 }, "nvd": { "published": "2026-07-30T21:16:51.777", "lastModified": "2026-07-31T19:17:02.480", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-65342", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled data reaches an HTML or DOM sink without context-appropriate sanitization and output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/XSS_cve/bloodsystem/XSS1.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 106, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-65720", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-11-18T00:00:00.000Z", "date_published": "2026-07-15T00:00:00.000Z", "date_updated": "2026-07-16T18:12:05.298Z", "publisher": "mitre", "title": "An issue in Open Source GPT Researcher v3.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-77", "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00722, "percentile": 0.50419 }, "nvd": { "published": "2026-07-15T22:16:45.417", "lastModified": "2026-07-16T19:16:44.107", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-65720", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Attacker-controlled command data reaches a command interpreter without safe argument separation or complete command-language neutralization.", "basis": [ "CNA", "CWE-77" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/assafelovic/gpt-researcher", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.ox.security/blog/gpt-researcher-remote-code-execution", "host": "www.ox.security", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/", "host": "www.ox.security", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 158, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-66076", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-11-21T11:20:58.862Z", "date_published": "2026-07-02T11:14:40.329Z", "date_updated": "2026-07-02T14:52:09.760Z", "publisher": "Patchstack", "title": "WordPress Woostify Sites Library plugin <= 1.6.2 - Broken Access Control vulnerability", "affected": { "vendors": [ "dylan ngo" ], "products": [ { "vendor": "dylan ngo", "product": "Woostify Sites Library" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00208, "percentile": 0.11043 }, "nvd": { "published": "2026-07-02T12:16:52.743", "lastModified": "2026-07-02T15:16:55.320", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-66076", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The affected action runs without the capability or object-level authorization check required for that caller.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/woostify-sites-library/vulnerability/wordpress-woostify-sites-library-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 82, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-66390", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-11-28T00:00:00.000Z", "date_published": "2026-07-21T00:00:00.000Z", "date_updated": "2026-07-22T15:47:05.047Z", "publisher": "mitre", "title": "In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to ...", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00345, "percentile": 0.2719 }, "nvd": { "published": "2026-07-21T14:16:32.797", "lastModified": "2026-07-23T18:28:35.280", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-66390", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The registration API remains callable when signup is hidden and selects the target tenant from a caller-controlled Host or tenant value, although Microsoft disputes that this behavior crosses a security boundary.", "basis": [ "CNA", "CWE-284" ], "deepDive": false, "notes": "The embedded record includes the supplier position that the observed behavior was a configuration or state issue and did not cross a security boundary." }, "references": [ { "url": "https://github.com/bountyyfi/Azure-APIM-Cross-Tenant-Signup-Bypass", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] }, { "url": "https://github.com/bountyyfi/Azure-APIM-Cross-Tenant-Signup-Bypass/security/advisories/GHSA-vcwf-73jp-r7mv", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 945, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-67403", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-08T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-30T14:25:11.674Z", "publisher": "mitre", "title": "Sourcecodester CASAP Automated Enrollment System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17662 }, "nvd": { "published": "2026-07-29T22:16:51.033", "lastModified": "2026-07-30T15:16:23.200", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-67403", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The update_class.php class_name parameter is incorporated into an SQL statement without separating data from SQL grammar.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-update_class.php-class_name-sqli/20250811-casap-automated-enrollment-system-update_class.php-class_name-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 133, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-67404", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-08T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-30T14:27:28.832Z", "publisher": "mitre", "title": "Sourcecodester CASAP Automated Enrollment System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.1766 }, "nvd": { "published": "2026-07-29T22:16:51.163", "lastModified": "2026-07-30T15:16:23.413", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-67404", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The fname, lname, and student_class parameters reach an SQL statement without separation from SQL grammar.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-save_stud.php-fname-sqli/20250811-casap-automated-enrollment-system-save_stud.php-fname-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 152, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-67405", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-08T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-30T13:34:26.035Z", "publisher": "mitre", "title": "Sourcecodester CASAP Automated Enrollment System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00169, "percentile": 0.0656 }, "nvd": { "published": "2026-07-29T22:16:51.283", "lastModified": "2026-07-30T14:16:43.797", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-67405", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The new_password parameter is incorporated into an SQL command without separating data from SQL syntax.", "basis": [ "CNA record", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-update_password.php-new_password-sqli/20250811-casap-automated-enrollment-system-update_password.php-new_password-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 138, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-67406", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-08T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-30T13:32:40.765Z", "publisher": "mitre", "title": "https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code (remote). The component is: control/activate_case.php,?id=1. The attack vector is: A SQL Injection ...", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00203, "percentile": 0.10408 }, "nvd": { "published": "2026-07-29T22:16:51.393", "lastModified": "2026-07-30T14:16:44.050", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-67406", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "CVE-2025-67406 builds an SQL statement from attacker-controlled text without parameterization or SQL-context separation.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/advocate/20250811-advocate-office-management-system-activate_case.php-id-sqli/20250811-advocate-office-management-system-activate_case.php-id-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 1192, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-67407", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-08T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-30T13:30:55.794Z", "publisher": "mitre", "title": "Sourcecodester CASAP Automated Enrollment System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00169, "percentile": 0.0656 }, "nvd": { "published": "2026-07-29T22:16:51.510", "lastModified": "2026-07-30T14:16:44.260", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-67407", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The student update handler inserts the fname and student_class parameters into SQL without separating them from query syntax.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-update_student.php-fname-sqli/20250811-casap-automated-enrollment-system-update_student.php-fname-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 145, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-67408", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-08T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-30T13:28:28.871Z", "publisher": "mitre", "title": "Sourcecodester CASAP Automated Enrollment System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00169, "percentile": 0.0656 }, "nvd": { "published": "2026-07-29T22:16:51.627", "lastModified": "2026-07-30T14:16:44.920", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-67408", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In the affected component, attacker-controlled input reaches an SQL statement without the required parameter binding or SQL-context escaping.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/automated/20250811-casap-automated-enrollment-system-save_user.php-status-sqli/20250811-casap-automated-enrollment-system-save_user.php-status-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 127, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-67649", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-09T19:10:43.240Z", "date_published": "2026-07-31T11:40:25.708Z", "date_updated": "2026-07-31T19:49:42.174Z", "publisher": "CERT-PL", "title": "Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script script", "affected": { "vendors": [ "PHP Jabbers" ], "products": [ { "vendor": "PHP Jabbers", "product": "Car Rental Script" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:cvd@cert.pl", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00274, "percentile": 0.19535 }, "nvd": { "published": "2026-07-31T12:16:48.107", "lastModified": "2026-07-31T20:16:45.553", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-67649", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled query text is concatenated into an SQL statement without parameter binding or equivalent grammar separation.", "basis": [ "CNA record", "NVD", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://cert.pl/en/posts/2026/07/CVE-2025-67649/", "host": "cert.pl", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] }, { "url": "https://www.phpjabbers.com/car-rental-script/", "host": "www.phpjabbers.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 293, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-67650", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-09T19:10:43.240Z", "date_published": "2026-07-31T11:40:40.346Z", "date_updated": "2026-07-31T19:51:58.085Z", "publisher": "CERT-PL", "title": "Authenticated SQL Injection in PHP Jabbers scripts", "affected": { "vendors": [ "PHP Jabbers" ], "products": [ { "vendor": "PHP Jabbers", "product": "Appointment Scheduler" }, { "vendor": "PHP Jabbers", "product": "Bus Reservation System" }, { "vendor": "PHP Jabbers", "product": "Car Park Booking System" }, { "vendor": "PHP Jabbers", "product": "Car Rental Script" }, { "vendor": "PHP Jabbers", "product": "Cinema Booking System" }, { "vendor": "PHP Jabbers", "product": "Event Booking Calendar" }, { "vendor": "PHP Jabbers", "product": "Event Ticketing System" }, { "vendor": "PHP Jabbers", "product": "Hotel Booking System" }, { "vendor": "PHP Jabbers", "product": "Cleaning Business Software" }, { "vendor": "PHP Jabbers", "product": "Equipment Rental Script" }, { "vendor": "PHP Jabbers", "product": "Food Delivery Script" }, { "vendor": "PHP Jabbers", "product": "Member Login Script" }, { "vendor": "PHP Jabbers", "product": "Member Directory Script" }, { "vendor": "PHP Jabbers", "product": "Availability Calendar" }, { "vendor": "PHP Jabbers", "product": "PHP Event Calendar" }, { "vendor": "PHP Jabbers", "product": "PHP Newsletter Script" }, { "vendor": "PHP Jabbers", "product": "Product Comparison Script" }, { "vendor": "PHP Jabbers", "product": "Ticket Support Script" }, { "vendor": "PHP Jabbers", "product": "PHP Shopping Cart" }, { "vendor": "PHP Jabbers", "product": "Auto Classifieds Script" }, { "vendor": "PHP Jabbers", "product": "Business Directory Script" }, { "vendor": "PHP Jabbers", "product": "Availability Booking Calendar" }, { "vendor": "PHP Jabbers", "product": "Time Slots Booking Calendar" }, { "vendor": "PHP Jabbers", "product": "Restaurant Booking System" }, { "vendor": "PHP Jabbers", "product": "Shuttle Booking Software" }, { "vendor": "PHP Jabbers", "product": "Meeting Room Booking System" }, { "vendor": "PHP Jabbers", "product": "Rental Property Booking Calendar" }, { "vendor": "PHP Jabbers", "product": "Service Booking Script" }, { "vendor": "PHP Jabbers", "product": "Limo Booking Software" }, { "vendor": "PHP Jabbers", "product": "Taxi Booking Script" }, { "vendor": "PHP Jabbers", "product": "Job Listing Script" }, { "vendor": "PHP Jabbers", "product": "Property Listing Script" }, { "vendor": "PHP Jabbers", "product": "Travel Tours Script" }, { "vendor": "PHP Jabbers", "product": "Vacation Rental Script" }, { "vendor": "PHP Jabbers", "product": "Yacht Listing Script" } ], "affectedBlockCount": 35, "versionEntryCount": 35, "versionRangeCount": 35, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:cvd@cert.pl", "type": "Secondary", "version": "4.0", "score": 8.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 8.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00279, "percentile": 0.20155 }, "nvd": { "published": "2026-07-31T12:16:48.250", "lastModified": "2026-07-31T20:16:45.683", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-67650", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Authenticated sorting parameters enter SQL without preserving the boundary between parameter data and SQL syntax.", "basis": [ "CNA", "NVD", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://cert.pl/en/posts/2026/07/CVE-2025-67649/", "host": "cert.pl", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] }, { "url": "https://www.phpjabbers.com/", "host": "www.phpjabbers.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 345, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 35, "affectedVersionEntryCount": 35 } }, { "cve_id": "CVE-2025-67651", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-09T19:10:43.240Z", "date_published": "2026-07-31T11:40:44.495Z", "date_updated": "2026-07-31T19:52:27.724Z", "publisher": "CERT-PL", "title": "CSRF in PHP Jabbers scripts", "affected": { "vendors": [ "PHP Jabbers" ], "products": [ { "vendor": "PHP Jabbers", "product": "Appointment Scheduler" }, { "vendor": "PHP Jabbers", "product": "Bus Reservation System" }, { "vendor": "PHP Jabbers", "product": "Car Park Booking System" }, { "vendor": "PHP Jabbers", "product": "Car Rental Script" }, { "vendor": "PHP Jabbers", "product": "Cinema Booking System" }, { "vendor": "PHP Jabbers", "product": "Event Booking Calendar" }, { "vendor": "PHP Jabbers", "product": "Event Ticketing System" }, { "vendor": "PHP Jabbers", "product": "Hotel Booking System" }, { "vendor": "PHP Jabbers", "product": "Cleaning Business Software" }, { "vendor": "PHP Jabbers", "product": "Equipment Rental Script" }, { "vendor": "PHP Jabbers", "product": "Food Delivery Script" }, { "vendor": "PHP Jabbers", "product": "Member Login Script" }, { "vendor": "PHP Jabbers", "product": "Member Directory Script" }, { "vendor": "PHP Jabbers", "product": "Availability Calendar" }, { "vendor": "PHP Jabbers", "product": "PHP Event Calendar" }, { "vendor": "PHP Jabbers", "product": "PHP Newsletter Script" }, { "vendor": "PHP Jabbers", "product": "Product Comparison Script" }, { "vendor": "PHP Jabbers", "product": "Ticket Support Script" }, { "vendor": "PHP Jabbers", "product": "PHP Shopping Cart" }, { "vendor": "PHP Jabbers", "product": "Auto Classifieds Script" }, { "vendor": "PHP Jabbers", "product": "Business Directory Script" }, { "vendor": "PHP Jabbers", "product": "Availability Booking Calendar" }, { "vendor": "PHP Jabbers", "product": "Time Slots Booking Calendar" }, { "vendor": "PHP Jabbers", "product": "Restaurant Booking System" }, { "vendor": "PHP Jabbers", "product": "Shuttle Booking Software" }, { "vendor": "PHP Jabbers", "product": "Meeting Room Booking System" }, { "vendor": "PHP Jabbers", "product": "Rental Property Booking Calendar" }, { "vendor": "PHP Jabbers", "product": "Service Booking Script" }, { "vendor": "PHP Jabbers", "product": "Limo Booking Software" }, { "vendor": "PHP Jabbers", "product": "Taxi Booking Script" }, { "vendor": "PHP Jabbers", "product": "Job Listing Script" }, { "vendor": "PHP Jabbers", "product": "Property Listing Script" }, { "vendor": "PHP Jabbers", "product": "Travel Tours Script" }, { "vendor": "PHP Jabbers", "product": "Vacation Rental Script" }, { "vendor": "PHP Jabbers", "product": "Yacht Listing Script" } ], "affectedBlockCount": 35, "versionEntryCount": 35, "versionRangeCount": 35, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:cvd@cert.pl", "type": "Secondary", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 6.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00166, "percentile": 0.06276 }, "nvd": { "published": "2026-07-31T12:16:48.520", "lastModified": "2026-07-31T20:16:45.923", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-67651", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The affected PHP Jabbers actions accept authenticated state-changing requests without a CSRF token or protective SameSite cookie boundary.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://cert.pl/en/posts/2026/07/CVE-2025-67649/", "host": "cert.pl", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] }, { "url": "https://www.phpjabbers.com/", "host": "www.phpjabbers.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 416, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 35, "affectedVersionEntryCount": 35 } }, { "cve_id": "CVE-2025-68081", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-15T10:01:29.282Z", "date_published": "2026-07-23T11:17:46.637Z", "date_updated": "2026-07-23T14:54:19.963Z", "publisher": "Patchstack", "title": "WordPress WP-Polls plugin <= 2.77.3 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Lester Chan" ], "products": [ { "vendor": "Lester Chan", "product": "WP-Polls" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 5.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00172, "percentile": 0.06853 }, "nvd": { "published": "2026-07-23T12:17:05.170", "lastModified": "2026-07-23T16:17:12.717", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-68081", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The WP-Polls rendering path places attacker-controlled data into executable browser markup without context-appropriate sanitization or escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/wp-polls/vulnerability/wordpress-wp-polls-plugin-2-77-3-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 72, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-68640", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-20T00:00:00.000Z", "date_published": "2026-07-21T00:00:00.000Z", "date_updated": "2026-07-22T15:46:53.127Z", "publisher": "mitre", "title": "The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET (Private Endpoint Token) to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authenti...", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-287", "name": "Improper Authentication", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] }, { "id": "CWE-306", "name": "Missing Authentication for Critical Function", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00283, "percentile": 0.20562 }, "nvd": { "published": "2026-07-21T17:17:04.183", "lastModified": "2026-07-23T18:28:35.280", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-68640", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A valid Private Endpoint Token can enumerate and remove offline devices without proving account ownership or completing two-factor authentication.", "basis": [ "CNA", "CWE-287", "CWE-306" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://gist.github.com/akadriu98/63123df9e7e3f154b3a0d54df178bb42", "host": "gist.github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/akadriu98/OE1102082402813", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 350, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 0, "adpCweCount": 2, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69094", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-29T11:19:21.660Z", "date_published": "2026-07-02T11:14:41.285Z", "date_updated": "2026-07-02T14:54:16.860Z", "publisher": "Patchstack", "title": "WordPress Unicamp theme <= 2.2.2 - SQL Injection vulnerability", "affected": { "vendors": [ "ThemeMove" ], "products": [ { "vendor": "ThemeMove", "product": "Unicamp" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0027, "percentile": 0.18934 }, "nvd": { "published": "2026-07-02T12:16:53.043", "lastModified": "2026-07-02T15:16:56.423", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69094", "family": "INTERPRETER_BOUNDARY", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record says attacker-controlled input reaches executable syntax in Unicamp, while the input field and interpreter sink are not public.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/unicamp/vulnerability/wordpress-unicamp-theme-2-2-2-sql-injection-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 54, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69132", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-29T11:19:37.128Z", "date_published": "2026-07-02T11:14:42.311Z", "date_updated": "2026-07-02T19:42:34.931Z", "publisher": "Patchstack", "title": "WordPress Corpkit theme <= 1.0.5 - Sensitive Data Exposure vulnerability", "affected": { "vendors": [ "Zozothemes" ], "products": [ { "vendor": "Zozothemes", "product": "Corpkit" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-201", "name": "Insertion of Sensitive Information Into Sent Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00345, "percentile": 0.27152 }, "nvd": { "published": "2026-07-02T12:16:53.173", "lastModified": "2026-07-02T20:17:00.170", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69132", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public Patchstack record says a subscriber can obtain sensitive data but does not name the data or returning operation.", "basis": [ "CNA", "CWE-201" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/corpkit/vulnerability/wordpress-corpkit-theme-1-0-5-sensitive-data-exposure-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 64, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69133", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-29T11:19:37.128Z", "date_published": "2026-07-02T11:14:43.488Z", "date_updated": "2026-07-02T15:53:57.062Z", "publisher": "Patchstack", "title": "WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion vulnerability", "affected": { "vendors": [ "GoodLayers" ], "products": [ { "vendor": "GoodLayers", "product": "Tourmaster" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-98", "name": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00388, "percentile": 0.31566 }, "nvd": { "published": "2026-07-02T12:16:53.300", "lastModified": "2026-07-02T16:16:29.217", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69133", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected file operation accepts attacker-controlled path or link components without proving the resolved target remains in the intended namespace.", "basis": [ "CNA", "CWE-98" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/tourmaster/vulnerability/wordpress-tourmaster-plugin-5-4-5-local-file-inclusion-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 64, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69134", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-29T11:19:41.703Z", "date_published": "2026-07-02T11:14:44.457Z", "date_updated": "2026-07-02T12:13:33.033Z", "publisher": "Patchstack", "title": "WordPress OpenAI Chatbot for WordPress – Helper plugin <= 1.1.4 - Arbitrary Content Deletion vulnerability", "affected": { "vendors": [ "Merkulove" ], "products": [ { "vendor": "Merkulove", "product": "OpenAI Chatbot for WordPress – Helper" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00291, "percentile": 0.21325 }, "nvd": { "published": "2026-07-02T12:16:53.450", "lastModified": "2026-07-02T13:58:23.330", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69134", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The affected operation runs without enforcing the required caller permission or object-ownership check.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/helper/vulnerability/wordpress-openai-chatbot-for-wordpress-helper-plugin-1-1-4-arbitrary-content-deletion-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 102, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69152", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-29T11:19:48.753Z", "date_published": "2026-07-02T11:14:45.464Z", "date_updated": "2026-07-02T12:50:09.625Z", "publisher": "Patchstack", "title": "WordPress Artale | Wedding Photography WordPress theme <= 2.2.2 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "ThemeGoods" ], "products": [ { "vendor": "ThemeGoods", "product": "Artale | Wedding Photography WordPress" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00175, "percentile": 0.0717 }, "nvd": { "published": "2026-07-02T12:16:53.583", "lastModified": "2026-07-02T13:58:23.330", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69152", "family": "INTERPRETER_BOUNDARY", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The application renders attacker-controlled content into an HTML or JavaScript context without context-appropriate output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/artale/vulnerability/wordpress-artale-wedding-photography-wordpress-theme-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 103, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69153", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-29T11:19:48.753Z", "date_published": "2026-07-02T11:14:46.468Z", "date_updated": "2026-07-02T14:44:40.367Z", "publisher": "Patchstack", "title": "WordPress Trendy Travel theme <= 6.7 - Reflected Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "designthemes" ], "products": [ { "vendor": "designthemes", "product": "Trendy Travel" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00175, "percentile": 0.0718 }, "nvd": { "published": "2026-07-02T12:16:53.700", "lastModified": "2026-07-02T15:16:56.517", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69153", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "User-controlled content reaches Trendy Travel page output without context-appropriate sanitization or escaping, so the browser interprets it as script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/trendytravel/vulnerability/wordpress-trendy-travel-theme-6-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 76, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69154", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-29T11:19:54.137Z", "date_published": "2026-07-02T11:14:47.632Z", "date_updated": "2026-07-02T14:54:49.155Z", "publisher": "Patchstack", "title": "WordPress SpaLab | Beauty Salon WordPress Theme theme <= 6.7 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "designthemes" ], "products": [ { "vendor": "designthemes", "product": "SpaLab | Beauty Salon WordPress Theme" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00175, "percentile": 0.0717 }, "nvd": { "published": "2026-07-02T12:16:53.820", "lastModified": "2026-07-02T15:16:56.610", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69154", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled theme data reaches a web page without the HTML-context neutralization required to prevent script execution.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/spalab/vulnerability/wordpress-spalab-beauty-salon-wordpress-theme-theme-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 100, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69155", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-29T11:19:54.137Z", "date_published": "2026-07-02T11:14:48.838Z", "date_updated": "2026-07-02T19:42:48.313Z", "publisher": "Patchstack", "title": "WordPress Fitness Zone WordPress Theme theme <= 5.7 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Designthemes" ], "products": [ { "vendor": "Designthemes", "product": "Fitness Zone WordPress Theme" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00175, "percentile": 0.07197 }, "nvd": { "published": "2026-07-02T12:16:53.937", "lastModified": "2026-07-02T20:17:00.300", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69155", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The theme places attacker-controlled content into an HTML or script context without the required contextual neutralization.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/fitnesszone/vulnerability/wordpress-fitness-zone-wordpress-theme-theme-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 91, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69156", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2025-12-29T11:19:54.137Z", "date_published": "2026-07-02T11:14:49.805Z", "date_updated": "2026-07-02T15:53:51.784Z", "publisher": "Patchstack", "title": "WordPress Kids Zone - Children WordPress Theme theme <= 5.4 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Design themes" ], "products": [ { "vendor": "Design themes", "product": "Kids Zone - Children WordPress Theme" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00175, "percentile": 0.07197 }, "nvd": { "published": "2026-07-02T12:16:54.060", "lastModified": "2026-07-02T16:16:29.310", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69156", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "medium", "mechanism": "The theme renders unauthenticated input as executable browser markup, although the public record does not identify the input field or output context.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/kidszone/vulnerability/wordpress-kids-zone-children-wordpress-theme-theme-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 99, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69930", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-07-31T18:24:02.594Z", "publisher": "mitre", "title": "CodeAstro Membership Management System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17661 }, "nvd": { "published": "2026-07-30T21:16:51.893", "lastModified": "2026-07-31T19:17:02.690", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69930", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected component query path incorporates attacker-controlled input into SQL without parameter separation.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-print_membership_card.php-id-sqli/20250811-membership-management-system-print_membership_card.php-id-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 109, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69931", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-08-03T16:27:40.060Z", "publisher": "mitre", "title": "CodeAstro Membership Management System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17665 }, "nvd": { "published": "2026-07-30T21:16:52.007", "lastModified": "2026-08-03T17:16:28.340", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69931", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The id parameter in delete_membership.php reaches an SQL statement without the required query parameter separation.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-delete_membership.php-id-sqli/20250811-membership-management-system-delete_membership.php-id-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 105, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69933", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-07-31T19:01:01.187Z", "publisher": "mitre", "title": "CodeAstro Membership Management System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17662 }, "nvd": { "published": "2026-07-30T21:16:52.120", "lastModified": "2026-07-31T19:17:02.900", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69933", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In the affected component, attacker-controlled values reach an SQL statement without the required escaping or parameter binding.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-memberprofile.php-id-sqli/20250811-membership-management-system-memberprofile.php-id-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 101, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69934", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-07-31T19:00:58.264Z", "publisher": "mitre", "title": "CodeAstro Membership Management System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17664 }, "nvd": { "published": "2026-07-30T21:16:52.223", "lastModified": "2026-07-31T19:17:03.113", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69934", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected component in CVE-2025-69934 incorporates attacker-controlled values or identifiers into a SQL statement without preserving the boundary between query syntax and data.", "basis": [ "CNA", "ADP", "NVD", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-delete_members.php-id-sqli/20250811-membership-management-system-delete_members.php-id-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 102, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69935", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-07-31T19:00:55.601Z", "publisher": "mitre", "title": "CodeAstro Membership Management System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17663 }, "nvd": { "published": "2026-07-30T21:16:52.333", "lastModified": "2026-07-31T19:17:03.420", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69935", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The fromDate parameter reaches SQL in report.php and revenue_report.php without preserving the boundary between data and SQL syntax.", "basis": [ "CNA", "NVD", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-revenue_report.php-fromdate-sqli/20250811-membership-management-system-revenue_report.php-fromdate-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 141, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69936", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-07-31T19:00:52.675Z", "publisher": "mitre", "title": "CodeAstro Membership Management System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17662 }, "nvd": { "published": "2026-07-30T21:16:52.453", "lastModified": "2026-07-31T19:17:03.667", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69936", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "the affected component incorporates attacker-controlled input into an SQL statement without parameterization, allowing input syntax to alter the database query.", "basis": [ "CNA", "ADP", "NVD", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-edit_member.php-id-sqli/20250811-membership-management-system-edit_member.php-id-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 99, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69937", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-07-31T15:59:33.038Z", "publisher": "mitre", "title": "CodeAstro Membership Management System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17663 }, "nvd": { "published": "2026-07-30T21:16:52.563", "lastModified": "2026-07-31T16:16:56.643", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69937", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The edit_type.php endpoint incorporates the id parameter into an SQL statement without preserving the SQL data boundary.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-edit_type.php-id-sqli/20250811-membership-management-system-edit_type.php-id-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 125, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69938", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-07-31T14:32:12.605Z", "publisher": "mitre", "title": "CodeAstro Membership Management System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17662 }, "nvd": { "published": "2026-07-30T21:16:52.670", "lastModified": "2026-07-31T15:16:27.233", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69938", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The renew.php handler incorporates membershipType into an SQL statement without preserving the SQL grammar boundary.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/codeastro/20250811-membership-management-system-renew.php-membershiptype-sqli/20250811-membership-management-system-renew.php-membershiptype-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 120, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69941", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-07-31T15:13:35.803Z", "publisher": "mitre", "title": "SourceCodester Tailor Management System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17664 }, "nvd": { "published": "2026-07-30T21:16:52.777", "lastModified": "2026-07-31T16:16:56.830", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69941", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "addmeasurement.php incorporates the id parameter into an SQL statement without separating data from SQL syntax.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/tailor/20250811-tailor-ms-addmeasurement.php-id-sqli/20250811-tailor-ms-addmeasurement.php-id-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 102, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69942", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-30T17:39:17.241Z", "publisher": "mitre", "title": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.1766 }, "nvd": { "published": "2026-07-29T22:16:51.750", "lastModified": "2026-07-30T19:17:00.953", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69942", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-view-patient.php-viewid-sqli/20250811-hospital-management-system-view-patient.php-viewid-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 114, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69943", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-30T14:10:28.659Z", "publisher": "mitre", "title": "kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00276, "percentile": 0.19794 }, "nvd": { "published": "2026-07-29T22:16:51.870", "lastModified": "2026-07-30T15:16:23.600", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69943", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-get_doctor.php-doctor-sqli/20250811-hospital-management-system-get_doctor.php-doctor-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] }, { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-get_doctor.php-specilizationid-sqli/20250811-hospital-management-system-get_doctor.php-specilizationid-sqli.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 136, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69944", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-29T21:47:20.079Z", "publisher": "mitre", "title": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "epss": { "score": 0.00143, "percentile": 0.04086 }, "nvd": { "published": "2026-07-29T22:16:51.987", "lastModified": "2026-07-30T14:12:18.697", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69944", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The affected endpoint incorporates caller-controlled data into an SQL statement without parameterization.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-view-medhistory.php-viewid-sqli/20250811-hospital-management-system-view-medhistory.php-viewid-sqli.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 134, "referenceCount": 1, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69945", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-30T13:23:26.802Z", "publisher": "mitre", "title": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00169, "percentile": 0.06559 }, "nvd": { "published": "2026-07-29T22:16:52.097", "lastModified": "2026-07-30T14:16:45.127", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69945", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled data is incorporated into an SQL statement without parameter binding or equivalent grammar separation, allowing it to alter the query.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-edit-patient.php-editid-sqli/20250811-hospital-management-system-edit-patient.php-editid-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 110, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69946", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-31T00:00:00.000Z", "date_updated": "2026-08-03T17:03:28.562Z", "publisher": "mitre", "title": "SourceCodester Modern Loan Management System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00337, "percentile": 0.26234 }, "nvd": { "published": "2026-07-31T21:17:29.390", "lastModified": "2026-08-03T17:16:28.520", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69946", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected query incorporates attacker-controlled input without parameterization or context-appropriate SQL escaping.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-district_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-district_id-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] }, { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-division_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-division_id-sqli.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-region_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-region_id-sqli.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-ajaxdata.php-ward_id-sqli/20250811-modern-loan-management-system-ajaxdata.php-ward_id-sqli.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-delete_group.php-id-sqli/20250811-modern-loan-management-system-delete_group.php-id-sqli.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/um-dsp/TaintRadar", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 165, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69947", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-30T00:00:00.000Z", "date_updated": "2026-07-31T15:03:21.965Z", "publisher": "mitre", "title": "SourceCodester Tailor Management System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.1766 }, "nvd": { "published": "2026-07-30T21:16:52.883", "lastModified": "2026-07-31T16:16:56.997", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69947", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The customeredit.php endpoint incorporates its caller-controlled id value into a database query without safe parameter binding.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/tailor/20250811-tailor-ms-customeredit.php-id-sqli/20250811-tailor-ms-customeredit.php-id-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 100, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69948", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-31T00:00:00.000Z", "date_updated": "2026-08-03T17:02:03.179Z", "publisher": "mitre", "title": "SourceCodester Modern Loan Management System 1.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00307, "percentile": 0.23002 }, "nvd": { "published": "2026-07-31T21:17:30.340", "lastModified": "2026-08-03T17:16:28.690", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69948", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The delete_group.php id parameter is incorporated into an SQL statement without separating data from SQL grammar.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/loansystem/20250811-modern-loan-management-system-delete_group.php-id-sqli/20250811-modern-loan-management-system-delete_group.php-id-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] }, { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-check_availability.php-emailid-sqli/20250811-hospital-management-system-check_availability.php-emailid-sqli.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/um-dsp/TaintRadar", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 112, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-69949", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-29T00:00:00.000Z", "date_updated": "2026-07-30T13:20:48.737Z", "publisher": "mitre", "title": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00176, "percentile": 0.07281 }, "nvd": { "published": "2026-07-29T22:16:52.213", "lastModified": "2026-07-30T14:16:45.340", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-69949", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An email parameter reaches an SQL statement without separation from SQL grammar.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-check_availability.php-email-sqli/20250811-hospital-management-system-check_availability.php-email-sqli.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] }, { "url": "https://github.com/um-dsp/TaintRadar/blob/main/sql_injection_cves/hospitalmanagementsystemproject/20250811-hospital-management-system-check_availability.php-emailid-sqli/20250811-hospital-management-system-check_availability.php-emailid-sqli.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 136, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-70796", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-01-09T00:00:00.000Z", "date_published": "2026-07-10T00:00:00.000Z", "date_updated": "2026-07-10T18:05:47.291Z", "publisher": "mitre", "title": "An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology, Inc.", "affected": { "vendors": [ "n/a" ], "products": [ { "vendor": "n/a", "product": "n/a" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00565, "percentile": 0.43701 }, "nvd": { "published": "2026-07-10T17:16:52.767", "lastModified": "2026-07-10T19:17:19.613", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-70796", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Traversal sequences in an unauthenticated web request select files outside the intended web root.", "basis": [ "CNA record", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/LPO26/Path-Traversal-via-Web-Interface-on-WTI-Devices/blob/main/CVE%20Summary", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] }, { "url": "https://github.com/LPO26/Path-Traversal-via-Web-Interface-on-WTI-Devices/tree/main", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 386, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-71342", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T12:48:06.735Z", "date_published": "2026-07-04T01:23:31.768Z", "date_updated": "2026-07-06T16:28:15.247Z", "publisher": "VulnCheck", "title": "picklescan - Undetected Remote Code Execution via idlelib.run.Executive.runcode", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00427, "percentile": 0.3517 }, "nvd": { "published": "2026-07-04T02:16:21.387", "lastModified": "2026-07-06T18:19:55.220", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71342", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "picklescan deserializes attacker-controlled bytes with object semantics that can invoke executable behavior.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m869-42cg-3xwr", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-undetected-remote-code-execution-via-idlelib-run-executive-runcode", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 279, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71343", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T12:48:06.735Z", "date_published": "2026-07-04T01:23:32.430Z", "date_updated": "2026-07-07T02:23:27.888Z", "publisher": "VulnCheck", "title": "picklescan - Arbitrary Code Execution via lib2to3.pgen2.pgen.ParserGenerator.make_label Detection Bypass", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.003, "percentile": 0.22337 }, "nvd": { "published": "2026-07-04T02:16:21.527", "lastModified": "2026-07-07T04:17:17.927", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71343", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The scanner fails to recognize a ParserGenerator.make_label reduction gadget, so a malicious pickle can pass inspection and execute when deserialized.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-p9w7-82w4-7q8m", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-lib2to3-pgen2-pgen-parsergenerator-make-label-detection-bypass", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 299, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71345", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T12:48:06.735Z", "date_published": "2026-07-04T01:23:33.086Z", "date_updated": "2026-07-06T17:08:32.862Z", "publisher": "VulnCheck", "title": "picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_autograd_prof", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00427, "percentile": 0.3517 }, "nvd": { "published": "2026-07-04T02:16:21.670", "lastModified": "2026-07-06T18:19:55.220", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71345", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In picklescan, attacker-controlled serialized data is converted into live objects without restricting the permitted types or behaviors.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-4whj-rm5r-c2v8", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-torch-utils-bottleneck-main-run-autograd-prof", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 257, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71347", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T12:48:06.735Z", "date_published": "2026-07-04T01:23:33.794Z", "date_updated": "2026-07-06T20:24:07.542Z", "publisher": "VulnCheck", "title": "picklescan - Undetected Remote Code Execution via numpy.f2py.crackfortran.param_eval", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00445, "percentile": 0.36529 }, "nvd": { "published": "2026-07-04T02:16:21.803", "lastModified": "2026-07-06T21:16:52.797", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71347", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled serialized data is passed to a native object deserializer that can instantiate executable object graphs.", "basis": [ "CNA record", "NVD", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-cffc-mxrf-mhh4", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-undetected-remote-code-execution-via-numpy-f2py-crackfortran-param-eval", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 356, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71353", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T12:55:02.882Z", "date_published": "2026-07-04T01:23:34.482Z", "date_updated": "2026-07-06T13:17:52.318Z", "publisher": "VulnCheck", "title": "picklescan - Remote Code Execution via torch._dynamo.guards.GuardBuilder.get", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.003, "percentile": 0.22336 }, "nvd": { "published": "2026-07-04T02:16:21.933", "lastModified": "2026-07-06T18:19:55.220", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71353", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The pickle scanner does not recognize a reduce chain using torch._dynamo.guards.GuardBuilder.get, so executable pickle content passes inspection and later runs when loaded.", "basis": [ "CNA", "NVD", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-86cj-95qr-2p4f", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-torch-dynamo-guards-guardbuilder-get", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 272, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71356", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T12:55:02.882Z", "date_published": "2026-07-04T01:23:35.187Z", "date_updated": "2026-07-06T15:03:48.468Z", "publisher": "VulnCheck", "title": "picklescan - Arbitrary Code Execution via torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.003, "percentile": 0.22337 }, "nvd": { "published": "2026-07-04T02:16:22.063", "lastModified": "2026-07-06T18:19:55.220", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71356", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The picklescan path permits an attacker-controlled serialized object graph to reach a code-capable deserializer.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f4x7-rfwp-v3xw", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-torch-fx-experimental-symbolic-shapes-shapeenv-evaluate-guards-expression", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 258, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71359", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T12:55:02.882Z", "date_published": "2026-07-04T01:23:35.892Z", "date_updated": "2026-07-06T16:27:31.500Z", "publisher": "VulnCheck", "title": "picklescan - Unsafe Deserialization via lib2to3.pgen2.grammar.Grammar.loads", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00427, "percentile": 0.35171 }, "nvd": { "published": "2026-07-04T02:16:22.197", "lastModified": "2026-07-06T18:19:55.220", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71359", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Grammar.loads detector can be bypassed so an attacker-controlled pickle is deserialized as an executable object graph.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-f54q-57x4-jg88", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-unsafe-deserialization-via-lib2to3-pgen2-grammar-grammar-loads", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 311, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71360", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T12:55:02.882Z", "date_published": "2026-07-04T01:23:36.583Z", "date_updated": "2026-07-07T02:26:21.516Z", "publisher": "VulnCheck", "title": "picklescan - Remote Code Execution via Undetected idlelib.calltip.get_entity", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.003, "percentile": 0.22336 }, "nvd": { "published": "2026-07-04T02:16:22.327", "lastModified": "2026-07-07T04:17:20.117", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71360", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The picklescan path permits attacker-controlled serialized data or a dangerous object graph to reach a deserializer.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9xph-j2h6-g47v", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-idlelib-calltip-get-entity", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 230, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71362", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T13:01:42.505Z", "date_published": "2026-07-04T01:23:37.271Z", "date_updated": "2026-07-06T17:10:32.237Z", "publisher": "VulnCheck", "title": "picklescan - Arbitrary Code Execution via Unsafe Deserialization in numpy.f2py.crackfortran", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.003, "percentile": 0.22337 }, "nvd": { "published": "2026-07-04T02:16:22.457", "lastModified": "2026-07-06T18:19:55.220", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71362", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "picklescan misses pickle payloads whose NumPy f2py reconstruction path calls eval on attacker-controlled strings.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-r8g5-cgf2-4m4m", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-unsafe-deserialization-in-numpy-f2py-crackfortran", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 235, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71364", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T13:01:42.505Z", "date_published": "2026-07-04T01:23:37.959Z", "date_updated": "2026-07-07T16:58:20.730Z", "publisher": "VulnCheck", "title": "picklescan - Arbitrary Code Execution via Undetected asyncio.unix_events._UnixSubprocessTransport._start", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00555, "percentile": 0.43158 }, "nvd": { "published": "2026-07-04T02:16:22.583", "lastModified": "2026-07-07T18:16:33.800", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71364", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce methods, allowing remote code execution.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-q77w-mwjj-7mqx", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-undetected-asyncio-unix-events-unixsubprocesstransport-start", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 304, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71366", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T13:01:42.505Z", "date_published": "2026-07-04T01:23:38.638Z", "date_updated": "2026-07-06T13:16:00.238Z", "publisher": "VulnCheck", "title": "picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_cprofile", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00445, "percentile": 0.3653 }, "nvd": { "published": "2026-07-04T02:16:22.707", "lastModified": "2026-07-06T18:19:55.220", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71366", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "picklescan fails to reject a callable that can execute while an unsafe pickle is deserialized.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-4r9r-ch6f-vxmx", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-torch-utils-bottleneck-main-run-cprofile", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 295, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71367", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T13:01:42.505Z", "date_published": "2026-07-04T01:23:39.319Z", "date_updated": "2026-07-06T15:02:33.416Z", "publisher": "VulnCheck", "title": "picklescan - Remote Code Execution via _operator.attrgetter Detection Bypass", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00445, "percentile": 0.3653 }, "nvd": { "published": "2026-07-04T02:16:22.833", "lastModified": "2026-07-06T18:19:55.220", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71367", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "picklescan does not recognize _operator.attrgetter as an executable reduce target, so a malicious pickle passes scanning and later executes when loaded.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-46h3-79wf-xr6c", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-operator-attrgetter-detection-bypass", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 302, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71369", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T13:01:42.505Z", "date_published": "2026-07-04T01:23:40.021Z", "date_updated": "2026-07-06T16:26:52.279Z", "publisher": "VulnCheck", "title": "picklescan - Unsafe Deserialization via torch.utils.data.datapipes.utils.decoder.basichandlers", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00445, "percentile": 0.3653 }, "nvd": { "published": "2026-07-04T02:16:22.963", "lastModified": "2026-07-06T18:19:55.220", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71369", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "picklescan's Torch detector misses a reduce invocation expressed through an alternative basic-handler representation, allowing a malicious pickle execution path to evade the scan.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-h3qp-7fh3-f8h4", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-unsafe-deserialization-via-torch-utils-data-datapipes-utils-decoder-basichandlers", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 329, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71372", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T13:11:44.727Z", "date_published": "2026-07-04T01:23:40.728Z", "date_updated": "2026-07-07T02:27:13.076Z", "publisher": "VulnCheck", "title": "Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.getlincoef Gadget", "affected": { "vendors": [ "Picklescan" ], "products": [ { "vendor": "Picklescan", "product": "Picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00379, "percentile": 0.30689 }, "nvd": { "published": "2026-07-04T02:16:23.097", "lastModified": "2026-07-07T04:17:20.237", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71372", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The application deserializes attacker-controlled bytes with object semantics that can invoke executable behavior.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-rrxm-2pvv-m66x", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-numpy-f2py-crackfortran-getlincoef-gadget", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 338, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71373", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T13:11:44.727Z", "date_published": "2026-07-04T01:23:41.446Z", "date_updated": "2026-07-06T18:16:45.056Z", "publisher": "VulnCheck", "title": "picklescan - Remote Code Execution via operator.methodcaller Detection Bypass", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-693", "name": "Protection Mechanism Failure", "abstraction": "Pillar", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00444, "percentile": 0.36488 }, "nvd": { "published": "2026-07-04T02:16:23.220", "lastModified": "2026-07-06T19:16:54.360", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71373", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "picklescan omits operator.methodcaller from its dangerous-call detection, so a malicious pickle can pass validation and later execute attacker-chosen behavior when loaded.", "basis": [ "CNA", "CWE-693" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-x843-g5mx-g377", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-operator-methodcaller-detection-bypass", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 321, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71375", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T13:11:44.727Z", "date_published": "2026-07-04T01:23:42.157Z", "date_updated": "2026-07-07T16:58:14.155Z", "publisher": "VulnCheck", "title": "picklescan - Undetected Remote Code Execution via _operator.methodcaller", "affected": { "vendors": [ "picklescan" ], "products": [ { "vendor": "picklescan", "product": "picklescan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00365, "percentile": 0.29173 }, "nvd": { "published": "2026-07-04T02:16:23.347", "lastModified": "2026-07-07T18:16:33.920", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71375", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The pickle scanner omits _operator.methodcaller from its dangerous-call detection even though pickle loading can invoke it as executable behavior.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-955r-x9j8-7rhh", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/picklescan-undetected-remote-code-execution-via-operator-methodcaller", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 285, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71377", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T13:11:44.728Z", "date_published": "2026-07-16T12:19:14.582Z", "date_updated": "2026-07-20T22:14:11.988Z", "publisher": "VulnCheck", "title": "stoatchat before 20250210-1 Unrestricted Message History Fetch", "affected": { "vendors": [ "stoatchat" ], "products": [ { "vendor": "stoatchat", "product": "stoatchat" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-1025", "name": "Comparison Using Wrong Factors", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 0, "epss": { "score": 0.00383, "percentile": 0.3105 }, "nvd": { "published": "2026-07-16T13:16:24.057", "lastModified": "2026-07-20T23:16:55.133", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71377", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The nearby-message route accepts a limit of zero that the database interprets as unlimited, enabling parallel requests to fetch an entire channel history.", "basis": [ "CNA", "CWE-1025" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h7h6-7pxm-mc66", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://github.com/stoatchat/stoatchat/commit/5f84daa9dba34c103cd83a2ee1f5e5ba900bfe94", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/stoatchat-before-20250210-1-unrestricted-message-history-fetch", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 512, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71380", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-06-20T13:11:44.728Z", "date_published": "2026-07-04T01:23:42.800Z", "date_updated": "2026-07-06T13:13:11.151Z", "publisher": "VulnCheck", "title": "n8n - Arbitrary Command Execution via Execute Command Node", "affected": { "vendors": [ "n8n" ], "products": [ { "vendor": "n8n", "product": "n8n" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00413, "percentile": 0.33979 }, "nvd": { "published": "2026-07-04T02:16:23.477", "lastModified": "2026-07-06T19:01:14.993", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71380", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The deployment exposes host-command execution through the Execute Command node to authenticated users without a publicly identified stronger role or policy check.", "basis": [ "CNA", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-365g-vjw2-grx8", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-arbitrary-command-execution-via-execute-command-node", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 319, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-71385", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-01T15:52:12.626Z", "date_published": "2026-07-02T19:37:42.359Z", "date_updated": "2026-07-14T22:26:10.145Z", "publisher": "VulnCheck", "title": "Netdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint", "affected": { "vendors": [ "netdata" ], "products": [ { "vendor": "netdata", "product": "netdata" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "cna", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 1, "epss": { "score": 0.00237, "percentile": 0.14803 }, "nvd": { "published": "2026-07-02T20:17:00.420", "lastModified": "2026-07-14T23:17:28.950", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2025-71385", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The ilove.svg endpoint inserts the love query value into an SVG text node without XML or HTML escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/netdata/netdata/releases/tag/v2.3.1", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "release-notes" ] }, { "url": "https://github.com/netdata/netdata/pull/19919", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Patch", "issue-tracking" ] }, { "url": "https://github.com/netdata/netdata/commit/f82554fe9b21b5ae51a8663a3f4ddce84cac16af", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "patch" ] }, { "url": "https://www.vulncheck.com/advisories/netdata-reflected-cross-site-scripting-via-love-parameter-in-ilove-svg-endpoint", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "Release Notes", "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 762, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2025-71388", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-16T12:14:41.769Z", "date_published": "2026-07-16T12:19:15.310Z", "date_updated": "2026-07-20T22:14:12.645Z", "publisher": "VulnCheck", "title": "stoatchat 20241213-1 Webhook Token Disclosure via Read Permissions", "affected": { "vendors": [ "stoatchat" ], "products": [ { "vendor": "stoatchat", "product": "stoatchat" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 7.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00275, "percentile": 0.19631 }, "nvd": { "published": "2026-07-16T13:16:24.193", "lastModified": "2026-07-20T23:16:55.253", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71388", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The webhook endpoint checks ViewChannel instead of ManageWebhooks before returning webhook tokens.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/stoatchat/stoatchat/security/advisories/GHSA-8684-rvfj-v3jq", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://github.com/stoatchat/stoatchat/commit/e3723d647effb81ea3d3919d848faf64dbe89829", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/stoatchat-20241213-1-webhook-token-disclosure-via-read-permissions", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 452, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71389", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-16T12:14:41.769Z", "date_published": "2026-07-23T21:16:44.870Z", "date_updated": "2026-07-28T01:48:14.200Z", "publisher": "VulnCheck", "title": "Cal.com before 5.9.9 Remote Code Execution via RSC", "affected": { "vendors": [ "calcom" ], "products": [ { "vendor": "calcom", "product": "cal.diy" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 10, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "cna", "version": "3.1", "score": 10, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 10, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 10, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 10, "cvss_source_score_spread": 0, "epss": { "score": 0.00928, "percentile": 0.57074 }, "nvd": { "published": "2026-07-23T22:16:51.750", "lastModified": "2026-07-30T16:41:25.650", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71389", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In cal.diy, attacker-controlled serialized data is deserialized into live objects during security-sensitive processing.", "basis": [ "CNA", "CWE-94" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/calcom/cal.diy/security/advisories/GHSA-qjx2-5xqp-cpf4", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://github.com/calcom/cal.diy/pull/25592", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "patch" ] }, { "url": "https://github.com/advisories/GHSA-9qr9-h5gf-34mp", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "related" ] }, { "url": "https://www.vulncheck.com/advisories/cal-com-before-remote-code-execution-via-rsc", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 537, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2025-71390", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-16T12:14:41.770Z", "date_published": "2026-07-18T13:10:10.319Z", "date_updated": "2026-07-28T01:48:14.882Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 1, "versionEntryCount": 6, "versionRangeCount": 4, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 5.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00228, "percentile": 0.13713 }, "nvd": { "published": "2026-07-18T14:17:10.300", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71390", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SurrealDB checks the literal host against deny-net before using DNS results, so a permitted name can resolve to a prohibited network destination after the policy decision.", "basis": [ "CNA", "NVD", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m3c3-78fh-w3w7", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-deny-net-bypass-via-dns-resolution", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 558, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2025-71391", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-16T12:14:41.770Z", "date_published": "2026-07-18T13:10:10.977Z", "date_updated": "2026-07-28T01:48:15.557Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.2.2 Denial of Service via /sql endpoint", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-248", "name": "Uncaught Exception", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00266, "percentile": 0.18315 }, "nvd": { "published": "2026-07-18T14:17:10.457", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71391", "family": "OTHER_SPECIFIC", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A null byte in a query to the SQL endpoint escapes the net module as an uncaught exception and terminates the database process.", "basis": [ "CNA", "NVD", "CWE-248" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rq86-9m6r-cm3g", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-sql-endpoint", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 331, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2025-71392", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-16T12:14:41.770Z", "date_published": "2026-07-18T13:10:11.661Z", "date_updated": "2026-07-28T01:48:16.238Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.2.2 SurrealQL Injection via export", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-77", "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00243, "percentile": 0.15578 }, "nvd": { "published": "2026-07-18T14:17:10.580", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71392", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SurrealDB exports attacker-chosen table or field names without SurrealQL escaping, so importing the backup later executes those names as database commands.", "basis": [ "CNA", "NVD", "CWE-77" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-ccj3-5p93-8p42", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-surrealql-injection-via-export", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 628, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2025-71393", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-16T12:14:41.770Z", "date_published": "2026-07-18T13:10:12.360Z", "date_updated": "2026-07-28T01:48:16.910Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-674", "name": "Uncontrolled Recursion", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 6, "cvss_source_score_spread": 0, "epss": { "score": 0.00249, "percentile": 0.1629 }, "nvd": { "published": "2026-07-18T14:17:10.703", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71393", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Native functions can re-enter JavaScript queries without sharing the enforced recursion limit, allowing an authenticated caller to recurse until memory is exhausted.", "basis": [ "CNA", "CWE-674" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m7rc-8w7m-r9qr", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-memory-exhaustion-via-nested-functions", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 324, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2025-71394", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-16T12:14:41.770Z", "date_published": "2026-07-18T13:10:13.041Z", "date_updated": "2026-07-28T01:48:17.603Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 2.3, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 2.3, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 2.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00303, "percentile": 0.22671 }, "nvd": { "published": "2026-07-18T14:17:10.837", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71394", "family": "FILE_OBJECT_SELECTION", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "DEFINE ANALYZER accepts a caller-selected filesystem path outside the intended data namespace and reads the selected file.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-2cvj-g5r5-jrrg", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-local-file-read-via-define-analyzer", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 345, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2025-71395", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-16T12:14:41.770Z", "date_published": "2026-07-18T13:10:13.744Z", "date_updated": "2026-07-28T01:48:18.301Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.2.2 Memory Exhaustion via string::replace", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-789", "name": "Memory Allocation with Excessive Size Value", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00235, "percentile": 0.14458 }, "nvd": { "published": "2026-07-18T14:17:10.963", "lastModified": "2026-07-22T20:16:41.963", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71395", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "SurrealDB string::replace permits a regex replacement result to grow without an effective length or allocation bound.", "basis": [ "CNA", "CWE-789" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3633-g6mg-p6qq", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-memory-exhaustion-via-string-replace", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 323, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2025-71396", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-16T12:14:41.770Z", "date_published": "2026-07-18T13:10:14.441Z", "date_updated": "2026-07-28T01:48:18.985Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 2.3, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 2.3, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 2.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00287, "percentile": 0.20909 }, "nvd": { "published": "2026-07-18T14:17:11.087", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71396", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all).", "basis": [ "CNA", "CWE-770" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-javascript-scripting", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 413, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2025-71397", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-16T12:14:41.770Z", "date_published": "2026-07-18T13:10:15.129Z", "date_updated": "2026-07-28T01:48:19.674Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00287, "percentile": 0.20909 }, "nvd": { "published": "2026-07-18T14:17:11.220", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71397", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "SurrealDB limits each FOR loop but does not bound nested loops as a whole, and configured query timeouts do not stop their execution.", "basis": [ "CNA", "CWE-835" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pxw4-94j3-v9pf", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-cpu-exhaustion-via-nested-for-loops", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 596, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2025-71398", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-18T12:38:41.076Z", "date_published": "2026-07-18T13:10:15.797Z", "date_updated": "2026-07-28T01:48:20.325Z", "publisher": "VulnCheck", "title": "SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass", "affected": { "vendors": [ "surrealdb" ], "products": [ { "vendor": "surrealdb", "product": "surrealdb" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 5.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00228, "percentile": 0.13714 }, "nvd": { "published": "2026-07-18T14:17:11.347", "lastModified": "2026-07-21T18:37:56.803", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71398", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The HTTP helper validates only the initial URL and follows redirects to destinations that the deny-net policy would have rejected.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5q9x-554g-9jgg", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/surrealdb-before-ssrf-via-http-redirect-bypass", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 354, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2025-71408", "id_year": 2025, "state": "PUBLISHED", "date_reserved": "2026-07-24T20:57:08.784Z", "date_published": "2026-07-24T21:07:49.610Z", "date_updated": "2026-07-27T17:22:48.131Z", "publisher": "VulnCheck", "title": "NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments", "affected": { "vendors": [ "ntlk" ], "products": [ { "vendor": "ntlk", "product": "ntlk" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-95", "name": "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 0.7000000000000002, "epss": { "score": 0.00158, "percentile": 0.0541 }, "nvd": { "published": "2026-07-24T22:16:50.063", "lastModified": "2026-07-30T19:56:57.057", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2025-71408", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled input reaches a dynamic code-generation or evaluation path without an effective allowlist, allowing it to run as code.", "basis": [ "CNA", "CWE-95" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://aydinnyunus.github.io/2026/06/07/command-injection-nltk-collocations-eval/", "host": "aydinnyunus.github.io", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://github.com/nltk/nltk/releases/tag/3.9.3", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch", "release-notes" ] }, { "url": "https://github.com/nltk/nltk/pull/3465", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "patch" ] }, { "url": "https://github.com/nltk/nltk/commit/66f14096d952ec8f04934f515e027534bd4eb0ac", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/nltk-eval-injection-via-collocations-py-command-line-arguments", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 573, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-0275", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:34.621Z", "date_published": "2026-07-09T19:19:24.198Z", "date_updated": "2026-07-14T14:32:31.774Z", "publisher": "palo_alto", "title": "Prisma Browser: Local Privilege Escalation on macOS", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Prisma Browser" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-269", "name": "Improper Privilege Management", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 2, "severity": "LOW", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 2, "severity": "LOW", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 6.7, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 6.7, "cvss_source_score_spread": 4.7, "epss": { "score": 0.00112, "percentile": 0.01599 }, "nvd": { "published": "2026-07-09T20:16:24.537", "lastModified": "2026-07-14T16:09:22.297", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0275", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A local administrator can cross the intended filesystem authority boundary and obtain root privileges, but the exact privileged transition is not public.", "basis": [ "CNA", "CWE-269" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0275", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 274, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-0276", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:35.481Z", "date_published": "2026-07-09T19:17:01.145Z", "date_updated": "2026-07-14T14:32:13.977Z", "publisher": "palo_alto", "title": "Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Cortex XDR Broker VM" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-269", "name": "Improper Privilege Management", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 1.1, "severity": "LOW", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 1.1, "severity": "LOW", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 6.699999999999999, "epss": { "score": 0.00098, "percentile": 0.00913 }, "nvd": { "published": "2026-07-09T20:16:24.670", "lastModified": "2026-07-16T14:28:29.443", "vulnStatus": "Undergoing Analysis", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0276", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A locally authenticated user can reach root-authority operations, but the public record does not identify the missing privilege check.", "basis": [ "CNA record", "CWE-269" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0276", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 154, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-0277", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:36.317Z", "date_published": "2026-07-09T19:14:50.806Z", "date_updated": "2026-07-10T14:19:54.495Z", "publisher": "palo_alto", "title": "Prisma Access Agent: Improper Certificate Validation on iOS", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Prisma Access Agent" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-295", "name": "Improper Certificate Validation", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.7, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 5.7, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 5.9, "cvss_source_score_spread": 0.20000000000000018, "epss": { "score": 0.00111, "percentile": 0.01522 }, "nvd": { "published": "2026-07-09T20:16:24.840", "lastModified": "2026-07-16T14:26:06.743", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0277", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Prisma Access Agent accepts a peer certificate without validating it against the intended TLS identity.", "basis": [ "CNA", "CWE-295" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0277", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 266, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-0278", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:37.292Z", "date_published": "2026-07-09T19:12:11.045Z", "date_updated": "2026-07-11T03:55:14.977Z", "publisher": "palo_alto", "title": "Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Prisma Access Agent" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-693", "name": "Protection Mechanism Failure", "abstraction": "Pillar", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:C/RE:H/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 5.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:C/RE:H/U:Amber" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 2, "epss": { "score": 0.00105, "percentile": 0.01244 }, "nvd": { "published": "2026-07-09T20:16:24.983", "lastModified": "2026-07-16T14:17:04.030", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0278", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The public record says a local user can bypass a data-loss-prevention policy but does not disclose the enabling implementation failure.", "basis": [ "CNA", "CWE-693" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0278", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 229, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-0279", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:38.280Z", "date_published": "2026-07-09T19:08:41.656Z", "date_updated": "2026-07-09T19:23:42.200Z", "publisher": "palo_alto", "title": "PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Cloud NGFW" }, { "vendor": "Palo Alto Networks", "product": "PAN-OS" }, { "vendor": "Palo Alto Networks", "product": "Prisma Access" } ], "affectedBlockCount": 3, "versionEntryCount": 8, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 1.3, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "cna", "version": "4.0", "score": 1.2, "severity": "LOW", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "cna", "version": "4.0", "score": 0.4, "severity": "LOW", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 1.3, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 5.699999999999999, "epss": { "score": 0.00322, "percentile": 0.24652 }, "nvd": { "published": "2026-07-09T19:16:58.717", "lastModified": "2026-07-13T12:43:37.907", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0279", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In Cloud NGFW, attacker-controlled markup is rendered without the required HTML-context sanitization or output escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0279", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 856, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 5, "affectedProductCount": 3, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-0280", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:39.119Z", "date_published": "2026-07-09T19:05:24.367Z", "date_updated": "2026-07-09T19:23:56.125Z", "publisher": "palo_alto", "title": "PAN-OS: IPv6 Firewall Policy Bypass", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Cloud NGFW" }, { "vendor": "Palo Alto Networks", "product": "PAN-OS" }, { "vendor": "Palo Alto Networks", "product": "Panorama" }, { "vendor": "Palo Alto Networks", "product": "Prisma Access" } ], "affectedBlockCount": 4, "versionEntryCount": 8, "versionRangeCount": 6, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-131", "name": "Incorrect Calculation of Buffer Size", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 1.7, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/AU:Y/V:D/RE:M/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 1.7, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:M/U:Amber" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 7.2, "cvss_source_score_spread": 5.5, "epss": { "score": 0.00181, "percentile": 0.07909 }, "nvd": { "published": "2026-07-09T19:16:59.280", "lastModified": "2026-07-13T12:36:31.477", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0280", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The public record reports an IPv6 firewall policy bypass but does not identify the packet field, state transition, or comparison that permits the bypass.", "basis": [ "CNA record", "NVD" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0280", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 321, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 4, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-0281", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:40.071Z", "date_published": "2026-07-09T19:03:44.381Z", "date_updated": "2026-07-09T19:24:18.136Z", "publisher": "palo_alto", "title": "PAN-OS: Information Disclosure Vulnerability in Management Web Interface", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Cloud NGFW" }, { "vendor": "Palo Alto Networks", "product": "PAN-OS" }, { "vendor": "Palo Alto Networks", "product": "Prisma Access" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 4, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-524", "name": "Use of Cache Containing Sensitive Information", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 2.1, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:M/U:Amber" }, { "source": "cna", "version": "4.0", "score": 1.7, "severity": "LOW", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:M/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 2.1, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 5.3999999999999995, "epss": { "score": 0.00165, "percentile": 0.06103 }, "nvd": { "published": "2026-07-09T19:16:59.780", "lastModified": "2026-07-13T12:35:08.263", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0281", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A management-interface cache can expose a legitimate user's web session token after that user follows an attacker-supplied link.", "basis": [ "CNA", "NVD", "CWE-524" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0281", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 824, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 3, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-0282", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:41.184Z", "date_published": "2026-07-09T19:02:26.722Z", "date_updated": "2026-07-09T19:24:40.688Z", "publisher": "palo_alto", "title": "PAN-OS: File Deletion Vulnerability in Management Web Interface", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Cloud NGFW" }, { "vendor": "Palo Alto Networks", "product": "PAN-OS" }, { "vendor": "Palo Alto Networks", "product": "Prisma Access" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 4, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-20", "name": "Improper Input Validation", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 2.7, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "cna", "version": "4.0", "score": 1.2, "severity": "LOW", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 2.7, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 5.3, "epss": { "score": 0.00173, "percentile": 0.0701 }, "nvd": { "published": "2026-07-09T19:17:00.110", "lastModified": "2026-07-13T12:32:59.203", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0282", "family": "FILE_OBJECT_SELECTION", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The PAN-OS management interface accepts an unauthenticated file-deletion request whose target can select files in a temporary directory.", "basis": [ "CNA", "CWE-20" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0282", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 735, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 3, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-0283", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:41.929Z", "date_published": "2026-07-09T19:01:34.210Z", "date_updated": "2026-07-09T19:25:07.889Z", "publisher": "palo_alto", "title": "PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Cloud NGFW" }, { "vendor": "Palo Alto Networks", "product": "PAN-OS" }, { "vendor": "Palo Alto Networks", "product": "Prisma Access" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 4, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 4.5, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 4.5, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 7.2, "cvss_source_score_spread": 2.7, "epss": { "score": 0.00204, "percentile": 0.10538 }, "nvd": { "published": "2026-07-09T19:17:00.593", "lastModified": "2026-07-13T12:32:07.593", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0283", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The LSVPN service accepts tunnel establishment without authenticating the connecting party.", "basis": [ "CNA", "CWE-306" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0283", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 330, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 3, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-0284", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:42.748Z", "date_published": "2026-07-09T18:59:57.586Z", "date_updated": "2026-07-09T19:25:27.319Z", "publisher": "palo_alto", "title": "PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Cloud NGFW" }, { "vendor": "Palo Alto Networks", "product": "PAN-OS" }, { "vendor": "Palo Alto Networks", "product": "Prisma Access" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 4, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 4.7, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:L/E:U/AU:N/R:A/V:D/RE:M/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 4.7, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 9.9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L" } ], "max_cvss_observed_across_sources": 9.9, "cvss_source_score_spread": 5.2, "epss": { "score": 0.0027, "percentile": 0.18982 }, "nvd": { "published": "2026-07-09T19:17:01.140", "lastModified": "2026-07-13T12:30:48.863", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0284", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The Cloud NGFW LSVPN path inserts attacker-controlled XML elements into a downstream XML document without preserving the document grammar.", "basis": [ "CNA", "CWE-74", "Palo Alto Networks advisory" ], "deepDive": true, "notes": "Read Palo Alto Networks advisory https://security.paloaltonetworks.com/CVE-2026-0284; it identifies LSVPN with configured satellites and malicious XML, but publishes no parser or source path, and its current CVSS base score is 7.8 rather than the shard maximum of 9.9." }, "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0284", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 379, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 3, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-0285", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:43.620Z", "date_published": "2026-07-09T18:58:14.563Z", "date_updated": "2026-07-09T19:25:44.255Z", "publisher": "palo_alto", "title": "PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Cloud NGFW" }, { "vendor": "Palo Alto Networks", "product": "PAN-OS" }, { "vendor": "Palo Alto Networks", "product": "Prisma Access" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 4, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 4.7, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "cna", "version": "4.0", "score": 4.4, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 4.7, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 4.9, "cvss_source_score_spread": 0.5, "epss": { "score": 0.0022, "percentile": 0.12609 }, "nvd": { "published": "2026-07-09T19:17:01.633", "lastModified": "2026-07-13T12:29:14.653", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0285", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The PAN-OS management interface lets an authenticated administrator direct server-side requests to otherwise unreachable internal services.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0285", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 666, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 3, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-0286", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:44.429Z", "date_published": "2026-07-09T18:56:29.289Z", "date_updated": "2026-07-09T19:26:01.748Z", "publisher": "palo_alto", "title": "PAN-OS: Authenticated Command Injection in CLI", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Cloud NGFW" }, { "vendor": "Palo Alto Networks", "product": "PAN-OS" }, { "vendor": "Palo Alto Networks", "product": "Prisma Access" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 4, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.2, "cvss_source_score_spread": 1.2000000000000002, "epss": { "score": 0.01019, "percentile": 0.59987 }, "nvd": { "published": "2026-07-09T19:17:02.227", "lastModified": "2026-07-13T12:28:26.120", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0286", "family": "INTERPRETER_BOUNDARY", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record says attacker-controlled input reaches executable syntax in Cloud NGFW, while the input field and interpreter sink are not public.", "basis": [ "CNA", "CWE-78" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0286", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 511, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 3, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-0287", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:45.634Z", "date_published": "2026-07-09T18:51:42.539Z", "date_updated": "2026-07-09T19:26:20.257Z", "publisher": "palo_alto", "title": "PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Cloud NGFW" }, { "vendor": "Palo Alto Networks", "product": "PAN-OS" }, { "vendor": "Palo Alto Networks", "product": "Prisma Access" } ], "affectedBlockCount": 3, "versionEntryCount": 7, "versionRangeCount": 6, "defaultStatuses": [ "affected", "unaffected" ] }, "cwes": [ { "id": "CWE-754", "name": "Improper Check for Unusual or Exceptional Conditions", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:C/RE:M/U:Amber" }, { "source": "cna", "version": "4.0", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:C/RE:M/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 2.9000000000000004, "epss": { "score": 0.00304, "percentile": 0.22786 }, "nvd": { "published": "2026-07-09T19:17:02.747", "lastModified": "2026-07-13T12:25:24.793", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0287", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "PAN-OS enters maintenance mode after crafted dataplane traffic, but the public record does not disclose the exhausted resource, invalid state, or memory error.", "basis": [ "CNA", "CWE-754" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0287", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 408, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 3, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-0288", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-11-03T20:44:46.432Z", "date_published": "2026-07-08T20:14:32.405Z", "date_updated": "2026-07-09T18:48:32.880Z", "publisher": "palo_alto", "title": "PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent", "affected": { "vendors": [ "Palo Alto Networks" ], "products": [ { "vendor": "Palo Alto Networks", "product": "Cloud NGFW" }, { "vendor": "Palo Alto Networks", "product": "PAN-OS" }, { "vendor": "Palo Alto Networks", "product": "Prisma Access" } ], "affectedBlockCount": 3, "versionEntryCount": 7, "versionRangeCount": 6, "defaultStatuses": [ "affected", "unaffected" ] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/AU:N/R:U/V:D/RE:M/U:Red" }, { "source": "cna", "version": "4.0", "score": 5.2, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "cna", "version": "4.0", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/AU:N/R:U/V:D/RE:M/U:Amber" }, { "source": "NVD:psirt@paloaltonetworks.com", "type": "Secondary", "version": "4.0", "score": 7.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 2.7, "epss": { "score": 0.00844, "percentile": 0.54417 }, "nvd": { "published": "2026-07-08T21:16:45.590", "lastModified": "2026-07-10T15:45:17.463", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-0288", "family": "MEMORY_LIFETIME", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record identifies a memory-safety failure but does not disclose the exact buffer, lifetime transition, or invalid access.", "basis": [ "CNA", "CWE-787" ], "deepDive": false, "notes": "The public record supports the family and impact but does not identify the failing check, parser rule, resource, or state transition." }, "references": [ { "url": "https://security.paloaltonetworks.com/", "host": "security.paloaltonetworks.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 841, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 5, "affectedProductCount": 3, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-0487", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-12-09T22:06:31.239Z", "date_published": "2026-07-14T00:17:37.478Z", "date_updated": "2026-07-20T14:39:04.209Z", "publisher": "sap", "title": "DLL Hijacking vulnerability in SAProuter on Microsoft Windows", "affected": { "vendors": [ "SAP_SE" ], "products": [ { "vendor": "SAP_SE", "product": "SAProuter on Microsoft Windows" } ], "affectedBlockCount": 1, "versionEntryCount": 13, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-427", "name": "Uncontrolled Search Path Element", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:cna@sap.com", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00158, "percentile": 0.05397 }, "nvd": { "published": "2026-07-14T01:16:16.370", "lastModified": "2026-07-20T16:16:53.983", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-0487", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "SAProuter searches an attacker-influenced directory for a DLL before a trusted system location, allowing the untrusted library to load with SAProuter's privileges.", "basis": [ "CNA", "CWE-427" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://me.sap.com/notes/3692165", "host": "me.sap.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://url.sap/sapsecuritypatchday", "host": "url.sap", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/piuppi/Proof-of-Concepts/blob/main/SAP/CVE-2026-0487.md", "host": "github.com", "sources": [ "adp:1", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 362, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 13 } }, { "cve_id": "CVE-2026-0515", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2025-12-10T15:04:59.507Z", "date_published": "2026-07-14T17:13:07.258Z", "date_updated": "2026-07-14T23:35:27.900Z", "publisher": "blackberry", "title": "Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety", "affected": { "vendors": [ "BlackBerry Ltd", "BlackBerry Ltd." ], "products": [ { "vendor": "BlackBerry Ltd", "product": "QNX Software Development Platform" }, { "vendor": "BlackBerry Ltd", "product": "QNX OS for Safety" }, { "vendor": "BlackBerry Ltd.", "product": "QNX OS for Medical" } ], "affectedBlockCount": 3, "versionEntryCount": 12, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-233", "name": "Improper Handling of Parameters", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:secure@blackberry.com", "type": "Secondary", "version": "3.1", "score": 6.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 6.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00112, "percentile": 0.01586 }, "nvd": { "published": "2026-07-14T18:17:10.650", "lastModified": "2026-07-15T16:24:31.140", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-0515", "family": "OTHER_SPECIFIC", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "SchedGet accepts a locally supplied parameter without the validation needed to reject a kernel-crashing value.", "basis": [ "CNA", "CWE-233" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.blackberry.com/pkb/s/article/141213", "host": "support.blackberry.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 150, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-0667", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-01-07T15:42:11.892Z", "date_published": "2026-07-29T12:35:34.208Z", "date_updated": "2026-07-29T14:20:14.876Z", "publisher": "schneider", "title": "CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over the Modbus TCP protocol.", "affected": { "vendors": [ "Schneider Electric" ], "products": [ { "vendor": "Schneider Electric", "product": "SCADAPack 47x" }, { "vendor": "Schneider Electric", "product": "SCADAPack 47xi" }, { "vendor": "Schneider Electric", "product": "SCADAPack 57x" }, { "vendor": "Schneider Electric", "product": "RemoteConnect" } ], "affectedBlockCount": 4, "versionEntryCount": 4, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-754", "name": "Improper Check for Unusual or Exceptional Conditions", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:cybersecurity@se.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00369, "percentile": 0.29569 }, "nvd": { "published": "2026-07-29T13:17:29.180", "lastModified": "2026-07-30T16:43:03.817", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-0667", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The public notice attributes the Modbus TCP flaw to an exceptional-condition check but does not disclose the condition, parser state, or failing branch.", "basis": [ "CNA", "CWE-754", "Schneider Electric security notification" ], "deepDive": true, "notes": "Inspected https://www.se.com/us/en/download/document/SEVD-2026-041-01/; the official notice names the RTUs, Modbus TCP context, CWE-754, impact, and fixed releases but does not disclose the exceptional condition or failing branch." }, "references": [ { "url": "https://download.se.com/files?p_Doc_Ref=SEVD-2026-041-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-041-01.pdf", "host": "download.se.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 225, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-1239", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-01-20T17:56:47.784Z", "date_published": "2026-07-01T05:35:30.183Z", "date_updated": "2026-07-01T10:42:10.311Z", "publisher": "Wordfence", "title": "Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint", "affected": { "vendors": [ "kstover" ], "products": [ { "vendor": "kstover", "product": "Ninja Forms – The Contact Form Builder That Grows With You" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00298, "percentile": 0.22107 }, "nvd": { "published": "2026-07-01T07:16:22.983", "lastModified": "2026-07-01T13:56:17.493", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1239", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The affected operation does not bind the requested object, action, or privilege to the authenticated caller's permitted scope.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/973ebafc-85c0-4cc5-b307-2fdb0a4a7577?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3489168/ninja-forms", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 400, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1359", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-01-22T21:20:10.240Z", "date_published": "2026-07-11T07:47:54.892Z", "date_updated": "2026-07-13T14:27:24.334Z", "publisher": "Wordfence", "title": "Genolve – AI image AI video generation <= 5.0.5 - Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation via theopt", "affected": { "vendors": [ "genolve" ], "products": [ { "vendor": "genolve", "product": "Genolve – Genolve AI Business Graphics, AI Images" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00305, "percentile": 0.22848 }, "nvd": { "published": "2026-07-11T09:16:16.020", "lastModified": "2026-07-13T16:59:13.647", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1359", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "genolve_setOpt lacks a capability check and lets a contributor change security-sensitive global WordPress options.", "basis": [ "CNA record", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8f64361a-e5b5-4481-b25c-bdffeb80c198?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3460465%40genolve-toolkit&old=3432371%40genolve-toolkit", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 477, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1360", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-01-22T22:06:16.508Z", "date_published": "2026-07-30T04:03:14.202Z", "date_updated": "2026-07-30T14:03:13.114Z", "publisher": "Wordfence", "title": "BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data", "affected": { "vendors": [ "buddypress" ], "products": [ { "vendor": "buddypress", "product": "BuddyPress" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00569, "percentile": 0.43907 }, "nvd": { "published": "2026-07-30T05:16:34.657", "lastModified": "2026-07-30T15:16:31.530", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1360", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "BuddyPress unserializes XProfile data without restricting the classes that the serialized stream may instantiate.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/467dd833-2f47-43cd-8d13-dffdad394b3c?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/bp-xprofile-template.php#L1000", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/buddypress/tags/14.4.0/bp-xprofile/bp-xprofile-template.php#L1000", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/classes/class-bp-rest-xprofile-fields-endpoint.php#L866", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/buddypress/trunk/bp-xprofile/bp-xprofile-functions.php#L519", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection", "host": "owasp.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.php.net/manual/en/function.unserialize.php", "host": "www.php.net", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fbuddypress/tags/14.4.0&new_path=%2Fbuddypress/tags/14.5.0", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 557, "referenceCount": 8, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1365", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-01-23T08:12:17.605Z", "date_published": "2026-07-09T08:45:20.971Z", "date_updated": "2026-07-09T12:35:01.242Z", "publisher": "TR-CERT", "title": "Information Disclosure in Sayax's OSOS", "affected": { "vendors": [ "Sayax Energy Technologies Inc." ], "products": [ { "vendor": "Sayax Energy Technologies Inc.", "product": "OSOS" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-201", "name": "Insertion of Sensitive Information Into Sent Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00269, "percentile": 0.18914 }, "nvd": { "published": "2026-07-09T10:16:25.573", "lastModified": "2026-07-09T16:21:30.600", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1365", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The application inserts sensitive information into transmitted data that an unintended observer can receive.", "basis": [ "CNA", "CWE-201" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0520", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 267, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1372", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-01-23T16:40:12.784Z", "date_published": "2026-07-21T07:51:21.731Z", "date_updated": "2026-07-22T16:08:10.195Z", "publisher": "Wordfence", "title": "Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation", "affected": { "vendors": [ "themeum" ], "products": [ { "vendor": "themeum", "product": "Tutor LMS Elementor Addons" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00204, "percentile": 0.10519 }, "nvd": { "published": "2026-07-21T09:16:53.813", "lastModified": "2026-07-22T17:16:56.000", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1372", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The activate_tutor_free() and activate_elementor_free() admin-action handlers activate plugins without checking the caller's capability.", "basis": [ "CNA", "NVD", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8a276a3e-12c3-4af7-9eb8-a25d20563de7?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/tutor-lms-elementor-addons/tags/3.0.1/classes/Installer.php#L213", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/tutor-lms-elementor-addons/tags/3.0.1/classes/Installer.php#L222", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/tutor-lms-elementor-addons/tags/3.0.1/classes/Installer.php#L29", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Ftutor-lms-elementor-addons/tags/3.0.1&new_path=%2Ftutor-lms-elementor-addons/tags/3.0.2", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Ftutor-lms-elementor-addons/tags/3.0.2&new_path=%2Ftutor-lms-elementor-addons/tags/4.0.0", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 459, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1382", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-01-23T18:46:51.014Z", "date_published": "2026-07-11T05:35:47.586Z", "date_updated": "2026-07-14T14:28:46.630Z", "publisher": "Wordfence", "title": "fresh Podcaster <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'freshpodcaster' Shortcode Attributes", "affected": { "vendors": [ "freshlabs" ], "products": [ { "vendor": "freshlabs", "product": "fresh Podcaster" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00188, "percentile": 0.08635 }, "nvd": { "published": "2026-07-11T07:16:46.307", "lastModified": "2026-07-14T15:17:01.190", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1382", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The fresh Podcaster rendering path places attacker-controlled data into executable browser markup without context-appropriate sanitization or escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4bf80767-4b11-49cd-acf5-7437aa89cc0f?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/fresh-podcaster/trunk/public/class-fresh-podcaster-shortcodes.php#L73", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/fresh-podcaster/trunk/public/partials/fresh-podcaster-public-display.php#L25", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/fresh-podcaster/tags/1.0.7/public/partials/fresh-podcaster-public-display.php#L25", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 447, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1433", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-01-26T12:49:23.159Z", "date_published": "2026-07-06T08:12:49.571Z", "date_updated": "2026-07-06T18:54:02.174Z", "publisher": "Canon_EMEA", "title": "uniFLOW Universal Login Manager (ULM) Standalone Improper Protection of Sensitive Information Leads to Information Disclosure", "affected": { "vendors": [ "NT-ware" ], "products": [ { "vendor": "NT-ware", "product": "uniFLOW ULM (Universal Login Manager) Standalone" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-522", "name": "Insufficiently Protected Credentials", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" }, { "source": "NVD:4586e0a2-224d-4f8a-9cb4-8882b208c0b3", "type": "Secondary", "version": "4.0", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 4.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00208, "percentile": 0.11073 }, "nvd": { "published": "2026-07-06T09:16:34.877", "lastModified": "2026-07-06T19:17:00.013", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1433", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The affected response, log, or client-visible object emits sensitive data without the required redaction or audience restriction.", "basis": [ "CNA", "CWE-522" ], "deepDive": false, "notes": "The public record supports the family and impact but does not identify the failing check, parser rule, or state transition." }, "references": [ { "url": "https://www.canon-europe.com/psirt/advisory-information", "host": "www.canon-europe.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://ntware.atlassian.net/wiki/spaces/SA/pages/13659504652/2026+Security+Advisory+ULM+Potential+Information+Disclosure", "host": "ntware.atlassian.net", "sources": [ "cna", "nvd" ], "tags": [ "mitigation", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 441, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1562", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-01-28T19:59:23.519Z", "date_published": "2026-07-15T16:37:13.384Z", "date_updated": "2026-07-15T18:13:03.446Z", "publisher": "Pega", "title": "Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.", "affected": { "vendors": [ "Pegasystems" ], "products": [ { "vendor": "Pegasystems", "product": "Pega Infinity" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:security@pega.com", "type": "Secondary", "version": "4.0", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.8, "cvss_source_score_spread": 0.20000000000000018, "epss": { "score": 0.00173, "percentile": 0.06977 }, "nvd": { "published": "2026-07-15T17:16:46.737", "lastModified": "2026-07-21T16:55:39.150", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-1562", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In Pega Infinity, attacker-controlled markup is stored and later rendered without the required HTML-context sanitization or output escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.pega.com/support-doc/pega-security-advisory-e26-vulnerability-remediation-note", "host": "support.pega.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 196, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1563", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-01-28T19:59:24.829Z", "date_published": "2026-07-15T16:38:21.778Z", "date_updated": "2026-07-15T18:12:40.935Z", "publisher": "Pega", "title": "Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.", "affected": { "vendors": [ "Pegasystems" ], "products": [ { "vendor": "Pegasystems", "product": "Pega Infinity" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:security@pega.com", "type": "Secondary", "version": "4.0", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00173, "percentile": 0.06976 }, "nvd": { "published": "2026-07-15T17:16:46.863", "lastModified": "2026-07-21T16:54:21.517", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-1563", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled content reaches an HTML, SVG or DOM output context without context-appropriate escaping, so the browser can interpret it as active script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.pega.com/support-doc/pega-security-advisory-e26-vulnerability-remediation-note", "host": "support.pega.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 199, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1609", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-01-29T12:08:57.214Z", "date_published": "2026-07-16T00:26:10.772Z", "date_updated": "2026-07-16T15:11:51.549Z", "publisher": "redhat", "title": "Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users", "affected": { "vendors": [ "Keycloak", "Red Hat" ], "products": [ { "vendor": "Keycloak", "product": "Keycloak" }, { "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8" }, { "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack" } ], "affectedBlockCount": 7, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "adp", "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": "adp:0", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:secalert@redhat.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00506, "percentile": 0.4045 }, "nvd": { "published": "2026-07-16T01:16:30.380", "lastModified": "2026-07-16T16:19:01.120", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1609", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The JWT authorization-grant preview path validates an external assertion without checking that the mapped local user is still enabled.", "basis": [ "CNA", "NVD", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2026-1609", "host": "access.redhat.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435257", "host": "bugzilla.redhat.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "issue-tracking", "x_refsource_REDHAT" ] }, { "url": "https://github.com/keycloak/keycloak/issues/46144", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/keycloak/keycloak/releases/tag/26.5.3", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1609.json", "host": "security.access.redhat.com", "sources": [ "adp:0", "nvd" ], "tags": [ "x_sadp-csaf-vex" ] } ], "record_shape": { "descriptionChars": 494, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 3, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1617", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-01-29T13:28:08.249Z", "date_published": "2026-07-21T11:07:22.695Z", "date_updated": "2026-07-21T12:13:03.826Z", "publisher": "TR-CERT", "title": "SQLi in Turkmesh's Turkhotspot 5651 Loglama", "affected": { "vendors": [ "Turkmesh Communication Services Inc." ], "products": [ { "vendor": "Turkmesh Communication Services Inc.", "product": "Turkhotspot 5651 Loglama" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17659 }, "nvd": { "published": "2026-07-21T12:17:21.173", "lastModified": "2026-07-21T17:08:18.343", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1617", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled Turkhotspot input reaches an SQL command without the required SQL-context separation.", "basis": [ "CNA", "NVD", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0584", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 256, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1667", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-01-29T21:38:19.441Z", "date_published": "2026-07-10T16:32:13.358Z", "date_updated": "2026-07-10T18:17:29.926Z", "publisher": "Wordfence", "title": "SEO Plugin by Squirrly SEO <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()", "affected": { "vendors": [ "cifi" ], "products": [ { "vendor": "cifi", "product": "GEO Plugin by Squirrly SEO" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 7.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00186, "percentile": 0.08415 }, "nvd": { "published": "2026-07-10T17:16:54.597", "lastModified": "2026-07-10T19:17:21.050", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1667", "family": "CRYPTO_SECRET", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The plugin leaks an API token that an unauthenticated attacker can reuse to create posts, with unsanitized post content also reaching a stored HTML output path.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aebdd464-10b9-4d43-bf38-f0e8ae25625f?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3586051%40squirrly-seo&old=3474256%40squirrly-seo", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 505, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1771", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-02T16:15:31.315Z", "date_published": "2026-07-21T07:51:22.165Z", "date_updated": "2026-07-22T13:59:17.647Z", "publisher": "Wordfence", "title": "MapSVG <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint", "affected": { "vendors": [ "oyatek" ], "products": [ { "vendor": "oyatek", "product": "MapSVG – Vector maps, Image maps, Google Maps" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-20", "name": "Improper Input Validation", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00586, "percentile": 0.4469 }, "nvd": { "published": "2026-07-21T09:16:53.947", "lastModified": "2026-07-22T15:16:54.083", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1771", "family": "FILE_OBJECT_SELECTION", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An incorrect condition skips file-type validation in SVGFile and permits an administrator to store an executable upload.", "basis": [ "CNA", "CWE-20" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f098b9-eca3-41c7-9c74-0f4b3f75c915?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/trunk/php/Domain/SVGFile/SVGFile.php#L24", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/tags/8.9.1/php/Domain/SVGFile/SVGFile.php#L24", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/tags/8.9.1/php/Router.php#L641", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/tags/8.9.1/php/Domain/File/FilesRepository.php#L166", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3608308/mapsvg-lite-interactive-vector-maps/trunk/php/Domain/SVGFile/SVGFile.php", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fmapsvg-lite-interactive-vector-maps/tags/8.14.0&new_path=%2Fmapsvg-lite-interactive-vector-maps/tags/8.14.1", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 472, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1832", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-03T14:48:59.230Z", "date_published": "2026-07-11T03:44:25.835Z", "date_updated": "2026-07-13T14:18:51.341Z", "publisher": "Wordfence", "title": "ThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion", "affected": { "vendors": [ "thrivedesk" ], "products": [ { "vendor": "thrivedesk", "product": "Agentic Help Desk Plugin for WordPress – Live Chat, AI Chatbot & Ticketing – ThriveDesk" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00204, "percentile": 0.10553 }, "nvd": { "published": "2026-07-11T05:16:33.043", "lastModified": "2026-07-13T16:59:13.647", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1832", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The Agentic Help Desk Plugin for WordPress – Live Chat, AI Chatbot & Ticketing – ThriveDesk operation does not enforce the caller's role or permission against the requested object and action.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec4bc1d4-2f14-4f3e-85ed-8737c56f905c?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/thrivedesk/trunk/includes/helper.php#L238", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/thrivedesk/tags/2.1.5/includes/helper.php#L238", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://cwe.mitre.org/data/definitions/862.html", "host": "cwe.mitre.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3512748%40thrivedesk&new=3512748%40thrivedesk", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/thrivedesk/tags/2.2.0/includes/helper.php#L238", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 375, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1918", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-04T16:31:22.993Z", "date_published": "2026-07-28T19:45:06.755Z", "date_updated": "2026-07-29T15:24:46.500Z", "publisher": "ibm", "title": "IBM Sterling B2B Integrator and IBM Sterling File Gateway store sensitive information in a log file", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "Sterling B2B Integrator" }, { "vendor": "IBM", "product": "Sterling File Gateway" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:psirt@us.ibm.com", "type": "Secondary", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00289, "percentile": 0.21182 }, "nvd": { "published": "2026-07-28T20:17:24.377", "lastModified": "2026-08-03T14:45:44.320", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-1918", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Sterling writes potentially sensitive values to log files readable by privileged users.", "basis": [ "CNA", "CWE-532" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7280658", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 320, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-1946", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-04T22:01:50.781Z", "date_published": "2026-07-10T07:48:42.276Z", "date_updated": "2026-07-14T01:34:54.013Z", "publisher": "Wordfence", "title": "GW AI Website Builder <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion", "affected": { "vendors": [ "nandhiniwp" ], "products": [ { "vendor": "nandhiniwp", "product": "GW AI Website Builder" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00222, "percentile": 0.12801 }, "nvd": { "published": "2026-07-10T09:16:53.540", "lastModified": "2026-07-14T02:16:54.707", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1946", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "GW AI Website Builder exposes its disconnect handler without the capability check required for the state-changing action.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/49405ba1-b0fd-429b-a30a-95c8d3f26545?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/gw-ai-website-builder/trunk/API/api-functions.php#L4069", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/gw-ai-website-builder/tags/1.0.1/API/api-functions.php#L4069", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/gw-ai-website-builder/trunk/API/api-functions.php#L4253", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/gw-ai-website-builder/tags/1.0.1/API/api-functions.php#L4253", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3481065%40gw-ai-website-builder&new=3481065%40gw-ai-website-builder", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 426, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1982", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-05T14:44:02.400Z", "date_published": "2026-07-30T03:03:21.778Z", "date_updated": "2026-07-30T15:51:47.194Z", "publisher": "Wordfence", "title": "Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget", "affected": { "vendors": [ "mohammadr3z" ], "products": [ { "vendor": "mohammadr3z", "product": "المنتور فارسی" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-472", "name": "External Control of Assumed-Immutable Web Parameter", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00196, "percentile": 0.09501 }, "nvd": { "published": "2026-07-30T03:16:24.647", "lastModified": "2026-07-30T16:17:10.337", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1982", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "This is due to the plugin trusting a user-supplied payment amount without server-side validation against the configured ZarinPal widget price.", "basis": [ "CNA", "CWE-472" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/da675a50-c7ac-4859-9795-4b0f1dc56c7b?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3613858/persian-elementor", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 423, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-1989", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-05T15:22:11.030Z", "date_published": "2026-07-09T08:56:37.717Z", "date_updated": "2026-07-09T12:33:51.423Z", "publisher": "TR-CERT", "title": "IDOR in PAVO Inc.'s PAVO Pay", "affected": { "vendors": [ "PAVO Financial Technology Solutions Inc." ], "products": [ { "vendor": "PAVO Financial Technology Solutions Inc.", "product": "PAVO Pay" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00251, "percentile": 0.16497 }, "nvd": { "published": "2026-07-09T10:16:25.710", "lastModified": "2026-07-09T16:21:30.600", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-1989", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "PAVO Pay accepts a user-controlled record key without binding the requested object to the caller.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0521", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 298, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-2342", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-11T13:38:05.266Z", "date_published": "2026-07-09T09:07:24.403Z", "date_updated": "2026-07-09T12:32:19.467Z", "publisher": "TR-CERT", "title": "XSS in Oceanicsoft's ValeApp", "affected": { "vendors": [ "OceanicSoft Informatics Systems Ltd." ], "products": [ { "vendor": "OceanicSoft Informatics Systems Ltd.", "product": "ValeApp" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0, "epss": { "score": 0.0022, "percentile": 0.12666 }, "nvd": { "published": "2026-07-09T10:16:25.833", "lastModified": "2026-07-09T16:21:30.600", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-2342", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The ValeApp page renders attacker-controlled data as HTML or JavaScript without context-appropriate escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0522", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 303, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-2354", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-11T16:47:19.850Z", "date_published": "2026-07-11T03:44:21.070Z", "date_updated": "2026-07-13T14:39:51.179Z", "publisher": "Wordfence", "title": "Swiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload_extension_files()", "affected": { "vendors": [ "wpmessiah" ], "products": [ { "vendor": "wpmessiah", "product": "Swiss Toolkit For WP" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00537, "percentile": 0.42243 }, "nvd": { "published": "2026-07-11T05:16:33.777", "lastModified": "2026-07-13T16:59:13.647", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-2354", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Swiss Toolkit For WP accepts an uploaded file without enforcing the type, destination, or execution restrictions required for that upload boundary.", "basis": [ "CNA", "NVD", "CWE-434" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/06bccd2e-6891-433a-9f5b-3ec0c30afef4?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/swiss-toolkit-for-wp/tags/1.4.2/includes/plugins/class-boomdevs-swiss-toolkit-extension-supports.php#L95", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/swiss-toolkit-for-wp/tags/1.4.2/includes/plugins/class-boomdevs-swiss-toolkit-extension-supports.php#L49", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/swiss-toolkit-for-wp/trunk/includes/plugins/class-boomdevs-swiss-toolkit-extension-supports.php#L95", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/swiss-toolkit-for-wp/trunk/includes/plugins/class-boomdevs-swiss-toolkit-extension-supports.php#L49", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 787, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-2387", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-12T00:39:03.296Z", "date_published": "2026-07-01T04:32:26.499Z", "date_updated": "2026-07-01T10:42:11.421Z", "publisher": "Wordfence", "title": "Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode", "affected": { "vendors": [ "stephenharris" ], "products": [ { "vendor": "stephenharris", "product": "Event Organiser" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00152, "percentile": 0.04826 }, "nvd": { "published": "2026-07-01T05:16:19.600", "lastModified": "2026-07-01T13:56:17.493", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-2387", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled content reaches an HTML, SVG or DOM output context without context-appropriate escaping, so the browser can interpret it as active script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3f417afd-2822-412f-b68a-f09c013d6049?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3589132/event-organiser", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 483, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-2395", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-12T12:48:07.234Z", "date_published": "2026-07-22T14:02:07.808Z", "date_updated": "2026-07-30T11:25:33.239Z", "publisher": "TR-CERT", "title": "SQLi in Xpoda Türkiye Informatics Technology's No Code Platform", "affected": { "vendors": [ "Xpoda Türkiye Informatics Technology Inc." ], "products": [ { "vendor": "Xpoda Türkiye Informatics Technology Inc.", "product": "No Code Platform" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00354, "percentile": 0.28117 }, "nvd": { "published": "2026-07-22T15:16:54.193", "lastModified": "2026-07-30T12:18:02.457", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-2395", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A caller-controlled value is incorporated into a No Code Platform database query without safe parameter binding, allowing query syntax injection.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0608", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 245, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-2397", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-12T12:58:46.087Z", "date_published": "2026-07-10T17:29:42.453Z", "date_updated": "2026-07-16T12:58:22.125Z", "publisher": "TR-CERT", "title": "SQLi in AdamPOS' MobilMen 20T", "affected": { "vendors": [ "Adam Retail Automation Ltd." ], "products": [ { "vendor": "Adam Retail Automation Ltd.", "product": "MobilMen 20T" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00265, "percentile": 0.1822 }, "nvd": { "published": "2026-07-10T18:16:20.613", "lastModified": "2026-07-10T19:17:22.593", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-2397", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "MobilMen 20T incorporates attacker input into an SQL statement without separating data from SQL grammar.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0526", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 315, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-2398", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-12T12:58:51.972Z", "date_published": "2026-07-10T17:02:34.594Z", "date_updated": "2026-07-16T12:59:18.926Z", "publisher": "TR-CERT", "title": "IDOR in AdamPOS' MobilMen 20T", "affected": { "vendors": [ "Adam Retail Automation Ltd." ], "products": [ { "vendor": "Adam Retail Automation Ltd.", "product": "MobilMen 20T" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0025, "percentile": 0.16473 }, "nvd": { "published": "2026-07-10T17:16:56.320", "lastModified": "2026-07-10T18:16:20.733", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-2398", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A request selects another user's object without an ownership check.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0526", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 286, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-2406", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-12T13:25:58.515Z", "date_published": "2026-07-22T08:51:21.311Z", "date_updated": "2026-07-22T08:51:21.311Z", "publisher": "TR-CERT", "title": "IDOR in Universe Software's Online Registration and Workflow Management System", "affected": { "vendors": [ "Universe Software Computer Marketing Trade and Industry Inc." ], "products": [ { "vendor": "Universe Software Computer Marketing Trade and Industry Inc.", "product": "Online Registration and Workflow Management System" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Primary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00291, "percentile": 0.21365 }, "nvd": { "published": "2026-07-22T09:16:28.903", "lastModified": "2026-07-22T16:21:53.517", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-2406", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Online Registration and Workflow Management System handler trusts a caller-controlled object identifier without binding it to the caller's permitted objects.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0594", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 302, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-2445", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-13T07:48:55.362Z", "date_published": "2026-07-20T08:06:39.095Z", "date_updated": "2026-07-20T13:52:59.977Z", "publisher": "WSO2", "title": "Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification", "affected": { "vendors": [ "WSO2" ], "products": [ { "vendor": "WSO2", "product": "WSO2 API Manager" }, { "vendor": "WSO2", "product": "WSO2 API Control Plane" }, { "vendor": "WSO2", "product": "WSO2 Identity Server" } ], "affectedBlockCount": 3, "versionEntryCount": 12, "versionRangeCount": 12, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00149, "percentile": 0.04579 }, "nvd": { "published": "2026-07-20T08:16:30.143", "lastModified": "2026-07-23T15:27:53.473", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-2445", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Reflected input is rendered without the browser-context separation required to prevent script execution.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/", "host": "security.docs.wso2.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 573, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-2482", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-13T18:39:00.390Z", "date_published": "2026-07-29T18:19:36.707Z", "date_updated": "2026-07-30T15:19:30.028Z", "publisher": "ibm", "title": "IBM WebSphere Application Server Liberty is affected by a cross-site request forgery", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "WebSphere Application Server - Liberty" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 3.1, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "source": "NVD:psirt@us.ibm.com", "type": "Secondary", "version": "3.1", "score": 3.1, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 5.700000000000001, "epss": { "score": 0.00086, "percentile": 0.00404 }, "nvd": { "published": "2026-07-29T19:16:45.597", "lastModified": "2026-08-04T14:10:12.610", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-2482", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Liberty accepts a victim browser request that can perform a state-changing action without an effective anti-CSRF check.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7281651", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 237, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-2594", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-16T17:19:23.910Z", "date_published": "2026-07-17T01:30:50.365Z", "date_updated": "2026-07-17T15:07:53.149Z", "publisher": "Wordfence", "title": "Smart Custom Fields <= 5.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title", "affected": { "vendors": [ "inc2734" ], "products": [ { "vendor": "inc2734", "product": "Smart Custom Fields" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.0024, "percentile": 0.15188 }, "nvd": { "published": "2026-07-17T02:18:05.607", "lastModified": "2026-07-17T16:17:14.623", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-2594", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Smart Custom Fields stores attacker-controlled content and later emits it as active browser markup without complete sanitization and escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/110a1b28-50e0-430e-82d4-c254d73836e2?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3485210/smart-custom-fields", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3609564/smart-custom-fields", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 481, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-2891", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-20T17:49:42.020Z", "date_published": "2026-07-01T14:08:45.511Z", "date_updated": "2026-07-01T14:55:54.454Z", "publisher": "hp", "title": "Poly Voice Devices (CCX, Trio, Edge E) – Potential Denial of Service", "affected": { "vendors": [ "HP Inc" ], "products": [ { "vendor": "HP Inc", "product": "CCX" }, { "vendor": "HP Inc", "product": "Trio C60" }, { "vendor": "HP Inc", "product": "Edge E" } ], "affectedBlockCount": 3, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-400", "name": "Uncontrolled Resource Consumption", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:hp-security-alert@hp.com", "type": "Secondary", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00253, "percentile": 0.16739 }, "nvd": { "published": "2026-07-01T15:17:06.960", "lastModified": "2026-07-02T17:47:43.557", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-2891", "family": "RESOURCE_CONTROL", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A Poly phone that connects to a malicious SIP server can be made inoperable by malformed SIP data, but the record does not identify the exhausted resource.", "basis": [ "CNA", "CWE-400" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hp.com/us-en/document/ish_15222895-15222917-16/hpsbpy04096", "host": "support.hp.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 218, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-3014", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-23T09:28:18.635Z", "date_published": "2026-07-14T09:45:22.651Z", "date_updated": "2026-07-16T12:40:32.623Z", "publisher": "Milestone", "title": "Remote Code Execution by administrative user on the Management Server", "affected": { "vendors": [ "Milestone Systems" ], "products": [ { "vendor": "Milestone Systems", "product": "XProtect Management Server" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H" }, { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:cf45122d-9d50-442a-9b23-e05cde9943d8", "type": "Secondary", "version": "4.0", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:cf45122d-9d50-442a-9b23-e05cde9943d8", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 2.6999999999999993, "epss": { "score": 0.00476, "percentile": 0.38632 }, "nvd": { "published": "2026-07-14T10:16:32.917", "lastModified": "2026-07-16T13:16:31.513", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-3014", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An edit-capable Management Server user can place input into an operating-system command context without the required command-grammar separation.", "basis": [ "CNA", "NVD", "CWE-78" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.milestonesys.com/article/CVE-2026-3014-potential-remote-code-execution-by-admin-user-on-Management-Server", "host": "support.milestonesys.com", "sources": [ "cna", "nvd" ], "tags": [ "permissions-required" ] }, { "url": "https://doc.milestonesys.com/en-US/bundle/sec1504_latest/page/milestone_security_advisory_CVE-2026-3014_potential_remote_code_execution_by_admin_user_on_Management_Server.html", "host": "doc.milestonesys.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 310, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-3031", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-23T14:42:48.259Z", "date_published": "2026-07-16T16:22:38.557Z", "date_updated": "2026-07-17T18:07:02.432Z", "publisher": "CPANSec", "title": "Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library", "affected": { "vendors": [ "TOKUHIROM" ], "products": [ { "vendor": "TOKUHIROM", "product": "Image::EPEG" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-1104", "name": "Use of Unmaintained Third Party Components", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00402, "percentile": 0.32932 }, "nvd": { "published": "2026-07-16T17:16:55.633", "lastModified": "2026-07-17T19:17:13.403", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-3031", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Image::EPEG embeds an unsupported dependency whose security defects can no longer be reliably maintained or updated.", "basis": [ "CNA", "NVD", "CWE-1104" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://backpan.metacpan.org/authors/id/T/TO/TOKUHIROM/Image-Epeg-0.15.readme", "host": "backpan.metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://backpan.metacpan.org/authors/id/T/TO/TOKUHIROM/Image-Epeg-0.15.tar.gz", "host": "backpan.metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://sourceforge.net/projects/enlightenment/files/OldFiles/epeg-0.9.0.tar.gz/download", "host": "sourceforge.net", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 246, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-3093", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-24T02:34:16.776Z", "date_published": "2026-07-29T19:02:11.038Z", "date_updated": "2026-07-29T19:34:59.534Z", "publisher": "GitLab", "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab", "affected": { "vendors": [ "GitLab" ], "products": [ { "vendor": "GitLab", "product": "GitLab" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.7, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:cve@gitlab.com", "type": "Secondary", "version": "3.1", "score": 4.7, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.7, "cvss_source_score_spread": 0, "epss": { "score": 0.00238, "percentile": 0.14955 }, "nvd": { "published": "2026-07-29T20:17:03.137", "lastModified": "2026-08-03T14:04:02.133", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-3093", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled data reaches an HTML or DOM sink without context-appropriate sanitization and output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://hackerone.com/reports/3539833", "host": "hackerone.com", "sources": [ "cna", "nvd" ], "tags": [ "Permissions Required", "exploit", "permissions-required", "technical-description" ] }, { "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/591274", "host": "gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Broken Link" ] }, { "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/", "host": "docs.gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 330, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-3144", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-24T19:53:12.296Z", "date_published": "2026-07-08T15:22:31.263Z", "date_updated": "2026-07-09T03:55:48.309Z", "publisher": "ibm", "title": "IBM API Connect Default Credentials", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "API Connect" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-1392", "name": "Use of Default Credentials", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:psirt@us.ibm.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 1.700000000000001, "epss": { "score": 0.00234, "percentile": 0.14384 }, "nvd": { "published": "2026-07-08T16:16:28.463", "lastModified": "2026-07-10T17:01:12.167", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-3144", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "API Connect ships known default credentials that remain usable on the deployed service.", "basis": [ "CNA", "CWE-1392" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7278909", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 191, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-3157", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-24T20:52:02.974Z", "date_published": "2026-07-28T19:40:18.276Z", "date_updated": "2026-07-29T14:03:29.656Z", "publisher": "ibm", "title": "Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure in mailbox UI", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "Sterling B2B Integrator" }, { "vendor": "IBM", "product": "Sterling File Gateway" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-615", "name": "Inclusion of Sensitive Information in Source Code Comments", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:psirt@us.ibm.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00219, "percentile": 0.12507 }, "nvd": { "published": "2026-07-28T20:17:24.677", "lastModified": "2026-08-03T14:38:50.243", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-3157", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Mailbox source-code comments embed sensitive information that is delivered to users who can inspect the page source.", "basis": [ "CNA", "CWE-615" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7280665", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 364, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-3158", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-24T20:59:24.546Z", "date_published": "2026-07-28T19:38:38.218Z", "date_updated": "2026-07-29T13:55:30.106Z", "publisher": "ibm", "title": "Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "Sterling B2B Integrator" }, { "vendor": "IBM", "product": "Sterling File Gateway" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-615", "name": "Inclusion of Sensitive Information in Source Code Comments", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:psirt@us.ibm.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.0018, "percentile": 0.07818 }, "nvd": { "published": "2026-07-28T20:17:24.823", "lastModified": "2026-08-03T14:27:47.300", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-3158", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Sensitive values are embedded in source-code comments delivered to clients.", "basis": [ "CNA", "CWE-615" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7280661", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 366, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-3182", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-25T07:08:29.976Z", "date_published": "2026-07-21T05:30:33.481Z", "date_updated": "2026-07-21T15:03:24.772Z", "publisher": "Zohocorp", "title": "Sensitive Data Exposure", "affected": { "vendors": [ "Zohocorp" ], "products": [ { "vendor": "Zohocorp", "product": "ManageEngine Endpoint Central" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-319", "name": "Cleartext Transmission of Sensitive Information", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00277, "percentile": 0.19906 }, "nvd": { "published": "2026-07-21T06:16:28.890", "lastModified": "2026-07-21T18:34:20.010", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-3182", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Endpoint Central transmits sensitive configuration data over a cleartext channel.", "basis": [ "CNA record", "CWE-319" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.manageengine.com/products/desktop-central/mail-configuration-data.html", "host": "www.manageengine.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 146, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-3183", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-25T07:08:40.731Z", "date_published": "2026-07-21T06:58:53.375Z", "date_updated": "2026-07-21T12:18:37.554Z", "publisher": "Zohocorp", "title": "Multi Factor Auth Bypass", "affected": { "vendors": [ "Zohocorp" ], "products": [ { "vendor": "Zohocorp", "product": "ManageEngine ADSelfService Plus" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-290", "name": "Authentication Bypass by Spoofing", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" }, { "source": "NVD:0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00481, "percentile": 0.38931 }, "nvd": { "published": "2026-07-21T08:16:33.880", "lastModified": "2026-07-21T18:34:20.010", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-3183", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record shows that ManageEngine ADSelfService Plus permits an unauthorized operation but does not identify the endpoint, protected object, or failing identity or privilege check.", "basis": [ "CNA", "CWE-290" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.manageengine.com/products/self-service-password/advisory/CVE-2026-3183.html", "host": "www.manageengine.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 115, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-3251", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-26T08:10:20.666Z", "date_published": "2026-07-10T16:39:44.837Z", "date_updated": "2026-07-10T17:41:50.418Z", "publisher": "TR-CERT", "title": "XSS in Webremium's Mezunum Satiyorum", "affected": { "vendors": [ "Webremium Istanbul Web Design" ], "products": [ { "vendor": "Webremium Istanbul Web Design", "product": "Mezunum Satiyorum" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00148, "percentile": 0.04479 }, "nvd": { "published": "2026-07-10T17:16:57.367", "lastModified": "2026-07-10T18:16:21.927", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-3251", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Untrusted data reaches an executable interpreter grammar without the required neutralization.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0525", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 329, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-3367", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-02-27T20:56:31.267Z", "date_published": "2026-07-11T02:31:17.819Z", "date_updated": "2026-07-13T14:26:53.516Z", "publisher": "Wordfence", "title": "Lockme OAuth2 calendars integration <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting", "affected": { "vendors": [ "lustmored" ], "products": [ { "vendor": "lustmored", "product": "Lockme calendars integration" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00256, "percentile": 0.17157 }, "nvd": { "published": "2026-07-11T04:17:23.670", "lastModified": "2026-07-13T16:59:13.647", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-3367", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "User-controlled content reaches Lockme calendars integration page output without context-appropriate sanitization or escaping, so the browser interprets it as script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/800b1a44-4173-4b8e-bc69-9a64218e64d6?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/lockme-calendars-integration/trunk/src/Plugin.php#L212", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/lockme-calendars-integration/tags/2.9.3/src/Plugin.php#L212", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/lockme-calendars-integration/trunk/src/Plugin.php#L223", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/lockme-calendars-integration/tags/2.9.3/src/Plugin.php#L223", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/lockme-calendars-integration/trunk/src/Plugin.php#L245", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/lockme-calendars-integration/tags/2.9.3/src/Plugin.php#L245", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/lockme-calendars-integration/trunk/src/Plugin.php#L256", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/lockme-calendars-integration/tags/2.9.3/src/Plugin.php#L256", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/lockme-calendars-integration/trunk/src/Plugin.php#L197", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/lockme-calendars-integration/tags/2.9.3/src/Plugin.php#L197", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/lockme-calendars-integration/trunk/src/Plugin.php#L54", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/lockme-calendars-integration/tags/2.9.3/src/Plugin.php#L54", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3495564%40lockme-calendars-integration&new=3495564%40lockme-calendars-integration", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1055, "referenceCount": 14, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-3482", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-03T14:50:55.686Z", "date_published": "2026-07-22T18:06:00.762Z", "date_updated": "2026-07-23T13:58:49.327Z", "publisher": "ibm", "title": "IBM Sterling B2B Integrator and IBM Sterling File Gateway Authorization Bypass", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "Sterling B2B Integrator" }, { "vendor": "IBM", "product": "Sterling File Gateway" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:psirt@us.ibm.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00274, "percentile": 0.19531 }, "nvd": { "published": "2026-07-22T19:17:03.233", "lastModified": "2026-07-23T14:17:12.807", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-3482", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record states that a crafted HTTP request bypasses authentication, while it does not identify the user-controlled key or validation step referenced by CWE-639.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7280657", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 279, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-3552", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-04T18:52:25.601Z", "date_published": "2026-07-11T03:44:21.730Z", "date_updated": "2026-07-13T17:52:58.355Z", "publisher": "Wordfence", "title": "SurfLink < 2.6.0 - Missing Authorization to Authenticated (Subscriber+) 410 Gone URL Import via 'surfl_import_410' AJAX Action", "affected": { "vendors": [ "surflabtech" ], "products": [ { "vendor": "surflabtech", "product": "SurfLink – Link Manager & Backup Restore" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00214, "percentile": 0.11777 }, "nvd": { "published": "2026-07-11T05:16:33.897", "lastModified": "2026-07-13T19:17:06.193", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-3552", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ajax_import_410 lacks both a capability check and nonce verification, allowing a subscriber to modify the global 410 URL table.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/22e0060d-7852-4326-98bc-1c49bebe6205?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/surflink/trunk/includes/class-surfl-410.php#L585", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/surflink/tags/2.4.1/includes/class-surfl-410.php#L585", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/surflink/trunk/includes/class-surfl-410.php#L513", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/surflink/tags/2.4.1/includes/class-surfl-410.php#L513", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/surflink/trunk/includes/class-surfl-410.php#L32", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/surflink/tags/2.4.1/includes/class-surfl-410.php#L32", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3542304%40surflink&new=3542304%40surflink", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 977, "referenceCount": 8, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-3576", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-04T21:44:03.501Z", "date_published": "2026-07-11T03:44:22.441Z", "date_updated": "2026-07-13T16:13:57.980Z", "publisher": "Wordfence", "title": "Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter", "affected": { "vendors": [ "xtreeme" ], "products": [ { "vendor": "xtreeme", "product": "Planyo online reservation system" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-20", "name": "Improper Input Validation", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 7.2, "cvss_source_score_spread": 0, "epss": { "score": 0.0039, "percentile": 0.31794 }, "nvd": { "published": "2026-07-11T05:16:34.013", "lastModified": "2026-07-13T17:17:19.787", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-3576", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The proxy allowlists localhost but fails to restrict the URL scheme, so file URLs select local resources through an HTTP-facing request.", "basis": [ "CNA", "CWE-20" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5038d12a-e119-4ab7-aadc-69b765ae7027?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/planyo-online-reservation-system/trunk/ulap.php#L84", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/planyo-online-reservation-system/tags/2.7/ulap.php#L84", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/planyo-online-reservation-system/trunk/ulap.php#L96", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/planyo-online-reservation-system/tags/2.7/ulap.php#L96", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/planyo-online-reservation-system/trunk/ulap.php#L59", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/planyo-online-reservation-system/tags/2.7/ulap.php#L59", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/planyo-online-reservation-system/trunk/ulap.php#L120", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/planyo-online-reservation-system/tags/2.7/ulap.php#L120", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/planyo-online-reservation-system/trunk/ulap.php#L118", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/planyo-online-reservation-system/tags/2.7/ulap.php#L118", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3488647%40planyo-online-reservation-system&new=3488647%40planyo-online-reservation-system", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1065, "referenceCount": 12, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-3688", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-06T23:43:39.850Z", "date_published": "2026-07-08T11:35:40.708Z", "date_updated": "2026-07-08T15:01:02.908Z", "publisher": "Wordfence", "title": "WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite", "affected": { "vendors": [ "wclovers" ], "products": [ { "vendor": "wclovers", "product": "WCFM Membership – WooCommerce Memberships for Multivendor Marketplace" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00216, "percentile": 0.12133 }, "nvd": { "published": "2026-07-08T12:17:20.430", "lastModified": "2026-07-08T16:16:28.610", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-3688", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The operation accepts a caller-supplied object identifier without binding the selected object to the authenticated caller.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8a934ccd-9330-4585-9994-838940d24980?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3520777/wc-multivendor-membership", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 469, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-3821", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-09T02:52:17.984Z", "date_published": "2026-07-22T06:15:31.648Z", "date_updated": "2026-07-22T12:57:22.874Z", "publisher": "Supermicro", "title": "Supermicro SMASH service contain an Arbitrary code execution issue", "affected": { "vendors": [ "SMCI" ], "products": [ { "vendor": "SMCI", "product": "X14DBG-DAP,X14DBI" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:def9a96e-e099-41a9-bfac-30fd4f82c411", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00355, "percentile": 0.28206 }, "nvd": { "published": "2026-07-22T07:16:35.413", "lastModified": "2026-07-23T15:33:09.233", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-3821", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Untrusted input crosses into an executable grammar without context-appropriate separation.", "basis": [ "CNA", "CWE-78" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Jul_2026", "host": "www.supermicro.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 248, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-3842", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-09T18:04:03.609Z", "date_published": "2026-07-16T00:20:02.910Z", "date_updated": "2026-07-16T12:42:09.780Z", "publisher": "fedora", "title": "Qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob write", "affected": { "vendors": [ "Red Hat" ], "products": [ { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9" }, { "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4" } ], "affectedBlockCount": 8, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "adp:0", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:patrick@puiterwijk.org", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00121, "percentile": 0.02277 }, "nvd": { "published": "2026-07-16T01:16:30.697", "lastModified": "2026-07-16T13:51:12.157", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-3842", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Red Hat Enterprise Linux 10 path computes or trusts a write extent that can exceed the destination object's bounds.", "basis": [ "CNA", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2026-3842", "host": "access.redhat.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458150", "host": "bugzilla.redhat.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "issue-tracking", "x_refsource_REDHAT" ] }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3842.json", "host": "security.access.redhat.com", "sources": [ "adp:0", "nvd" ], "tags": [ "x_sadp-csaf-vex" ] } ], "record_shape": { "descriptionChars": 468, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 6, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-3907", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-10T20:46:25.456Z", "date_published": "2026-07-10T07:48:41.019Z", "date_updated": "2026-07-10T14:39:09.572Z", "publisher": "Wordfence", "title": "Hostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode", "affected": { "vendors": [ "prasunsen" ], "products": [ { "vendor": "prasunsen", "product": "Hostel" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00255, "percentile": 0.17017 }, "nvd": { "published": "2026-07-10T09:16:53.677", "lastModified": "2026-07-10T15:43:30.330", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-3907", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "User-controlled content reaches Hostel page output without context-appropriate sanitization or escaping, so the browser interprets it as script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30339c0d-6632-4073-b4d5-3bb4a5b8a58d?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/models/hostel.php#L195", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/hostel/trunk/controllers/shortcodes.php#L91", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/controllers/shortcodes.php#L91", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/hostel/trunk/controllers/shortcodes.php#L79", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/hostel/tags/1.1.6/controllers/shortcodes.php#L79", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/hostel/trunk/models/hostel.php#L195", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3480942%40hostel&new=3480942%40hostel", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 698, "referenceCount": 8, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4017", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-11T19:20:13.205Z", "date_published": "2026-07-14T17:25:13.128Z", "date_updated": "2026-07-14T23:36:28.181Z", "publisher": "blackberry", "title": "Buffer overflow in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety", "affected": { "vendors": [ "BlackBerry Ltd", "BlackBerry Ltd." ], "products": [ { "vendor": "BlackBerry Ltd", "product": "QNX Software Development Platform" }, { "vendor": "BlackBerry Ltd", "product": "QNX OS for Safety" }, { "vendor": "BlackBerry Ltd.", "product": "QNX OS for Medical" } ], "affectedBlockCount": 3, "versionEntryCount": 12, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-121", "name": "Stack-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:secure@blackberry.com", "type": "Secondary", "version": "3.1", "score": 7.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.4, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.0212 }, "nvd": { "published": "2026-07-14T18:17:26.820", "lastModified": "2026-07-15T16:24:31.140", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4017", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.", "basis": [ "CNA", "CWE-121" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.blackberry.com/pkb/s/article/141213", "host": "support.blackberry.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 197, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-4018", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-11T19:24:46.531Z", "date_published": "2026-07-14T17:34:01.952Z", "date_updated": "2026-07-15T14:01:13.318Z", "publisher": "blackberry", "title": "TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety", "affected": { "vendors": [ "BlackBerry Ltd", "BlackBerry Ltd." ], "products": [ { "vendor": "BlackBerry Ltd", "product": "QNX Software Development Platform" }, { "vendor": "BlackBerry Ltd", "product": "QNX OS for Safety" }, { "vendor": "BlackBerry Ltd.", "product": "QNX OS for Medical" } ], "affectedBlockCount": 3, "versionEntryCount": 12, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-367", "name": "Time-of-check Time-of-use (TOCTOU) Race Condition", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:secure@blackberry.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00092, "percentile": 0.0062 }, "nvd": { "published": "2026-07-14T18:17:26.943", "lastModified": "2026-07-15T16:24:31.140", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4018", "family": "STATE_SEQUENCE", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.", "basis": [ "CNA", "CWE-367" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.blackberry.com/pkb/s/article/141213", "host": "support.blackberry.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 249, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-4249", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-16T05:47:35.673Z", "date_published": "2026-07-06T10:16:56.055Z", "date_updated": "2026-07-06T11:03:48.847Z", "publisher": "WSO2", "title": "Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption", "affected": { "vendors": [ "WSO2" ], "products": [ { "vendor": "WSO2", "product": "WSO2 Universal Gateway" }, { "vendor": "WSO2", "product": "WSO2 Traffic Manager" }, { "vendor": "WSO2", "product": "WSO2 API Control Plane" }, { "vendor": "WSO2", "product": "WSO2 API Manager" } ], "affectedBlockCount": 4, "versionEntryCount": 20, "versionRangeCount": 20, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-707", "name": "Improper Neutralization", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H" }, { "source": "NVD:ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00339, "percentile": 0.26493 }, "nvd": { "published": "2026-07-06T11:16:30.433", "lastModified": "2026-07-09T13:04:57.540", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-4249", "family": "OTHER_SPECIFIC", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The throttling-event handler accepts structurally invalid attacker JSON into persistent processing state, but the public advisory does not disclose the failing parser or recovery transition.", "basis": [ "CNA", "NVD", "CWE-707" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/", "host": "security.docs.wso2.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 572, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-4256", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-16T07:44:00.802Z", "date_published": "2026-07-09T13:15:55.283Z", "date_updated": "2026-07-09T13:42:03.407Z", "publisher": "TR-CERT", "title": "LDAP Injection in PEAKUP's PassGate", "affected": { "vendors": [ "PEAKUP Technology Inc." ], "products": [ { "vendor": "PEAKUP Technology Inc.", "product": "PassGate" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-90", "name": "Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00213, "percentile": 0.11692 }, "nvd": { "published": "2026-07-09T14:16:32.640", "lastModified": "2026-07-09T16:21:30.600", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4256", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The application inserts attacker-controlled text into an LDAP filter without separating the value from LDAP query syntax.", "basis": [ "CNA", "CWE-90" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0523", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 204, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4275", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-16T15:20:23.202Z", "date_published": "2026-07-09T09:31:21.638Z", "date_updated": "2026-07-09T17:22:23.953Z", "publisher": "Wordfence", "title": "Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint", "affected": { "vendors": [ "badhonrocks" ], "products": [ { "vendor": "badhonrocks", "product": "Divi Torque Lite – Divi Modules for the Divi Builder & Theme" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00187, "percentile": 0.08494 }, "nvd": { "published": "2026-07-09T11:16:39.630", "lastModified": "2026-07-09T18:16:52.267", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4275", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "REST install and activate routes use an always-allow permission callback, so a cross-site request can ride an administrator's cookies without a REST nonce.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8be98cba-b891-42cf-8a6c-8fe05f27c9c3?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/addons-for-divi/tags/4.2.2/includes/rest-api.php#L81", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/rest-api.php#L81", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/rest-api.php#L230", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/addons-for-divi/tags/4.2.2/includes/rest-api.php#L230", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/rest-api.php#L75", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/addons-for-divi/tags/4.2.2/includes/rest-api.php#L75", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3559041%40addons-for-divi&new=3559041%40addons-for-divi", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 722, "referenceCount": 8, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4298", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-16T19:14:02.711Z", "date_published": "2026-07-09T09:31:21.285Z", "date_updated": "2026-07-09T14:39:42.090Z", "publisher": "Wordfence", "title": "DSGVO All in one for WP <= 4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset", "affected": { "vendors": [ "mlfactory" ], "products": [ { "vendor": "mlfactory", "product": "DSGVO All in one for WP" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00204, "percentile": 0.10518 }, "nvd": { "published": "2026-07-09T11:16:39.757", "lastModified": "2026-07-09T16:19:45.567", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4298", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "dsgvo_reset_policy_service_func resets plugin settings without either a capability check or nonce verification.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8a5268-03a2-48c6-9c59-840a11e7a34f?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/trunk/dsgvo_all_in_one_wp.php#L1123", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/tags/4.9/dsgvo_all_in_one_wp.php#L1123", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/trunk/dsgvo_all_in_one_wp.php#L56", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/tags/4.9/dsgvo_all_in_one_wp.php#L56", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3503821%40dsgvo-all-in-one-for-wp&new=3503821%40dsgvo-all-in-one-for-wp", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 568, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4321", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-17T11:53:19.729Z", "date_published": "2026-07-03T08:54:03.784Z", "date_updated": "2026-07-06T17:30:17.328Z", "publisher": "TR-CERT", "title": "SQLi in Raera's Destekz", "affected": { "vendors": [ "Raera - Ankara Web Design and Digital Advertising Agency" ], "products": [ { "vendor": "Raera - Ankara Web Design and Digital Advertising Agency", "product": "Destekz" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00266, "percentile": 0.18313 }, "nvd": { "published": "2026-07-03T10:16:32.760", "lastModified": "2026-07-06T18:16:46.247", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4321", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency Destekz allows SQL Injection.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0488", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 320, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4322", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-17T12:19:47.203Z", "date_published": "2026-07-03T08:58:08.339Z", "date_updated": "2026-07-06T17:29:49.531Z", "publisher": "TR-CERT", "title": "XSS in Raera's Destekz", "affected": { "vendors": [ "Raera - Ankara Web Design and Digital Advertising Agency" ], "products": [ { "vendor": "Raera - Ankara Web Design and Digital Advertising Agency", "product": "Destekz" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00149, "percentile": 0.04576 }, "nvd": { "published": "2026-07-03T10:16:32.993", "lastModified": "2026-07-06T18:16:46.353", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4322", "family": "INTERPRETER_BOUNDARY", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Attacker-controlled data reaches an HTML or DOM sink without context-appropriate sanitization and output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "The public record supports the family and impact but does not identify the failing check, parser rule, or state transition." }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0488", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 320, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4375", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-18T12:16:21.066Z", "date_published": "2026-07-07T06:00:01.899Z", "date_updated": "2026-07-07T13:18:43.079Z", "publisher": "WPScan", "title": "DoLeads Integrator <= 1.2.2 & wp2epub <= 0.65 - Unauthenticated RCE", "affected": { "vendors": [ "Unknown" ], "products": [ { "vendor": "Unknown", "product": "DoLeads Integrator" }, { "vendor": "Unknown", "product": "wp2epub" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9, "cvss_source_score_spread": 0, "epss": { "score": 0.00248, "percentile": 0.16191 }, "nvd": { "published": "2026-07-07T06:16:22.360", "lastModified": "2026-07-07T14:16:32.257", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4375", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The public record says the plugins have been used after unauthorized installation to obtain code execution but identifies no defective check or execution boundary in either plugin.", "basis": [ "CNA", "WPScan advisory" ], "deepDive": true, "notes": "Inspected https://wpscan.com/vulnerability/dd043e6c-e6c6-4c8d-aab0-5265d28f5cf6/; it repeats the embedded description, withholds the proof of concept, lists no known fix, and links no vendor source." }, "references": [ { "url": "https://wpscan.com/vulnerability/dd043e6c-e6c6-4c8d-aab0-5265d28f5cf6/", "host": "wpscan.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description", "vdb-entry" ] } ], "record_shape": { "descriptionChars": 290, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-4604", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-22T20:18:40.722Z", "date_published": "2026-07-29T09:31:13.403Z", "date_updated": "2026-07-29T12:10:02.325Z", "publisher": "Wordfence", "title": "Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update", "affected": { "vendors": [ "klubraum" ], "products": [ { "vendor": "klubraum", "product": "Klubraum Membership Request" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00235, "percentile": 0.14486 }, "nvd": { "published": "2026-07-29T11:16:49.390", "lastModified": "2026-07-30T14:01:30.413", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4604", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Klubraum Membership Request fails to enforce the required capability, object ownership, tenant, role, or scope check at the affected operation, allowing a caller outside that authority boundary to invoke it.", "basis": [ "CNA", "NVD", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/09e158d2-f9a6-41a6-a91f-1763a1a44b04?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/klubraum-membership-request/trunk/admin/class-klubraum-membership-request-widget-admin.php#L152", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/klubraum-membership-request/tags/1.1.0/admin/class-klubraum-membership-request-widget-admin.php#L152", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/klubraum-membership-request/tags/1.1.0/admin/class-klubraum-membership-request-widget-admin.php#L151", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3491619%40klubraum-membership-request%2Ftrunk%2Fadmin%2Fclass-klubraum-membership-request-widget-admin.php&old=2512635%40klubraum-membership-request%2Ftrunk%2Fadmin%2Fclass-klubraum-membership-request-widget-admin.php", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 439, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4648", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-23T12:50:31.162Z", "date_published": "2026-07-28T11:41:15.571Z", "date_updated": "2026-07-28T12:04:41.531Z", "publisher": "INCIBE", "title": "Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands", "affected": { "vendors": [ "CasfID Servicios Tecnológicos" ], "products": [ { "vendor": "CasfID Servicios Tecnológicos", "product": "NFC Wristbands" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-326", "name": "Inadequate Encryption Strength", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:cve-coordination@incibe.es", "type": "Secondary", "version": "4.0", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 6.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00118, "percentile": 0.02027 }, "nvd": { "published": "2026-07-28T12:16:36.467", "lastModified": "2026-07-28T16:20:10.853", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4648", "family": "CRYPTO_SECRET", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The wristband uses a weak MIFARE Classic authentication algorithm whose keys can be recovered and cloned.", "basis": [ "CNA", "CWE-326" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/insufficient-encryption-level-casfid-servicios-tecnologicos-nfc", "host": "www.incibe.es", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 728, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4653", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-23T14:53:50.936Z", "date_published": "2026-07-09T06:52:44.374Z", "date_updated": "2026-07-09T14:09:46.935Z", "publisher": "Wordfence", "title": "Block, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter", "affected": { "vendors": [ "bouncingsprout" ], "products": [ { "vendor": "bouncingsprout", "product": "Block, Suspend, Report for BuddyPress" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00195, "percentile": 0.09452 }, "nvd": { "published": "2026-07-09T08:16:48.373", "lastModified": "2026-07-09T16:19:45.567", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4653", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The BuddyPress reporting plugin stores the link parameter and later renders it as active browser markup without sufficient sanitization and escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/01cd05c3-9629-4da4-ae9d-f99003253b95?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/bp-toolkit/trunk/admin/partials/report-cpt-main-metabox.php#L115", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/bp-toolkit/tags/3.6.4/admin/partials/report-cpt-main-metabox.php#L115", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/bp-toolkit/trunk/includes/class-bp-toolkit-report.php#L260", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/bp-toolkit/tags/3.6.4/includes/class-bp-toolkit-report.php#L260", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3523211%40bp-toolkit&new=3523211%40bp-toolkit", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 431, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4661", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-23T16:11:31.414Z", "date_published": "2026-07-11T05:35:48.631Z", "date_updated": "2026-07-13T14:29:23.768Z", "publisher": "Wordfence", "title": "WP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter", "affected": { "vendors": [ "blendmedia" ], "products": [ { "vendor": "blendmedia", "product": "WP CTA – Call Now Button, Sticky Button & Call to Action Builder" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00327, "percentile": 0.25195 }, "nvd": { "published": "2026-07-11T07:16:46.513", "lastModified": "2026-07-13T16:59:13.647", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4661", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The WP CTA – Call Now Button, Sticky Button & Call to Action Builder data path incorporates attacker-controlled text into a database query without parameter binding.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e963601-dc41-4218-9119-708c74e51bc2?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-sticky-sidebar/tags/1.7.4/inc/ClassActions.php#L193", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-sticky-sidebar/tags/1.7.4/inc/ClassActions.php#L186", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-sticky-sidebar/tags/1.7.4/inc/ClassActions.php#L17", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3524743%40easy-sticky-sidebar&new=3524743%40easy-sticky-sidebar", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 737, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4672", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-23T21:03:56.356Z", "date_published": "2026-07-29T19:01:31.039Z", "date_updated": "2026-07-29T19:35:54.247Z", "publisher": "GitLab", "title": "Missing Authorization in GitLab", "affected": { "vendors": [ "GitLab" ], "products": [ { "vendor": "GitLab", "product": "GitLab" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:cve@gitlab.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00285, "percentile": 0.20753 }, "nvd": { "published": "2026-07-29T20:17:03.963", "lastModified": "2026-08-03T14:03:16.267", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-4672", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The affected operation runs without enforcing the required caller permission or object-ownership check.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/594528", "host": "gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Broken Link" ] }, { "url": "https://hackerone.com/reports/3617676", "host": "hackerone.com", "sources": [ "cna", "nvd" ], "tags": [ "Permissions Required", "exploit", "permissions-required", "technical-description" ] }, { "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/", "host": "docs.gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 344, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-4765", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-24T11:45:47.723Z", "date_published": "2026-07-13T10:16:33.027Z", "date_updated": "2026-07-13T13:14:19.490Z", "publisher": "INCIBE", "title": "Stored Cross-Site Scripting (XSS) in Tallos Chat by RD Station Conversas", "affected": { "vendors": [ "RD Station Conversas" ], "products": [ { "vendor": "RD Station Conversas", "product": "Tallos Chat" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "source": "NVD:cve-coordination@incibe.es", "type": "Secondary", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 5.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00272, "percentile": 0.1939 }, "nvd": { "published": "2026-07-13T11:16:27.450", "lastModified": "2026-07-13T18:05:36.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4765", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Tallos Chat rendering path places attacker-controlled data into executable browser markup without context-appropriate sanitization or escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-tallos-chat-rd-station-conversas", "host": "www.incibe.es", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 527, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4767", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-24T12:59:26.386Z", "date_published": "2026-07-02T13:12:30.753Z", "date_updated": "2026-07-02T13:48:08.975Z", "publisher": "TR-CERT", "title": "Improper Access Control in TR7's WAF-ASP", "affected": { "vendors": [ "TR7 Cyber ​​Defense Inc." ], "products": [ { "vendor": "TR7 Cyber ​​Defense Inc.", "product": "WAF-ASP" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00333, "percentile": 0.25835 }, "nvd": { "published": "2026-07-02T14:16:25.527", "lastModified": "2026-07-02T15:17:02.350", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4767", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A security-sensitive function can be invoked without enforcing the caller authentication required for that operation.", "basis": [ "CNA", "CWE-306" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0487", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 189, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4769", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-24T13:19:36.714Z", "date_published": "2026-07-13T06:35:01.116Z", "date_updated": "2026-07-13T14:44:48.962Z", "publisher": "CERTVDE", "title": "Unauthenticated Access to Internal Diagnostic Interface", "affected": { "vendors": [ "WAGO" ], "products": [ { "vendor": "WAGO", "product": "0765-110x/0100-0000" }, { "vendor": "WAGO", "product": "0765-120x/0100-0000" }, { "vendor": "WAGO", "product": "0765-150x/0100-0000" }, { "vendor": "WAGO", "product": "0765-2101/0100-0000" }, { "vendor": "WAGO", "product": "0765-2102/0100-0000" }, { "vendor": "WAGO", "product": "0765-410x/0100-0000" }, { "vendor": "WAGO", "product": "0765-420x/0100-0000" }, { "vendor": "WAGO", "product": "0765-450x/0100-0000" } ], "affectedBlockCount": 8, "versionEntryCount": 8, "versionRangeCount": 8, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-912", "name": "Hidden Functionality", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:info@cert.vde.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:info@cert.vde.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00447, "percentile": 0.36717 }, "nvd": { "published": "2026-07-13T08:16:21.343", "lastModified": "2026-07-13T19:58:29.933", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4769", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Production devices expose an undocumented unauthenticated diagnostic service during an early boot window.", "basis": [ "CNA", "CWE-912" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.certvde.com/en/advisories/VDE-2026-031/", "host": "www.certvde.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 409, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 8, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-4770", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-24T13:29:09.973Z", "date_published": "2026-07-02T12:37:13.555Z", "date_updated": "2026-07-02T13:15:06.196Z", "publisher": "TR-CERT", "title": "DOM-Based XSS in TR7's WAF-ASP", "affected": { "vendors": [ "TR7 Cyber ​​Defense Inc." ], "products": [ { "vendor": "TR7 Cyber ​​Defense Inc.", "product": "WAF-ASP" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00133, "percentile": 0.03235 }, "nvd": { "published": "2026-07-02T13:16:55.170", "lastModified": "2026-07-02T15:13:11.783", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4770", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Client-side code in WAF-ASP places attacker-controlled data into an executable DOM context without sufficient sanitization.", "basis": [ "CNA", "NVD", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0487", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 255, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4772", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-24T13:35:28.124Z", "date_published": "2026-07-02T12:50:55.561Z", "date_updated": "2026-07-02T13:15:20.596Z", "publisher": "TR-CERT", "title": "Stored XSS in TR7's WAF-ASP", "affected": { "vendors": [ "TR7 Cyber ​​Defense Inc." ], "products": [ { "vendor": "TR7 Cyber ​​Defense Inc.", "product": "WAF-ASP" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00133, "percentile": 0.03236 }, "nvd": { "published": "2026-07-02T13:16:55.293", "lastModified": "2026-07-02T15:13:11.783", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4772", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "WAF-ASP stores attacker-controlled browser content without the neutralization required before HTML rendering.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0487", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 219, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4773", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-24T13:41:44.976Z", "date_published": "2026-07-22T12:08:20.308Z", "date_updated": "2026-07-22T12:43:01.406Z", "publisher": "TR-CERT", "title": "OTP Bypass in Magarsus' IDM-MFA", "affected": { "vendors": [ "Magarsus Consulting Ltd. Co." ], "products": [ { "vendor": "Magarsus Consulting Ltd. Co.", "product": "IDM-MFA" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-1287", "name": "Improper Validation of Specified Type of Input", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00319, "percentile": 0.24358 }, "nvd": { "published": "2026-07-22T12:18:12.587", "lastModified": "2026-07-22T16:21:53.517", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4773", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "medium", "mechanism": "IDM-MFA accepts an OTP value whose specified input type has not been validated, allowing the authentication decision to be bypassed.", "basis": [ "CNA record", "CWE-1287" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0607", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 194, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4804", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-25T11:38:39.477Z", "date_published": "2026-07-03T07:53:09.987Z", "date_updated": "2026-07-06T16:25:45.616Z", "publisher": "Wordfence", "title": "Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API", "affected": { "vendors": [ "themegrill" ], "products": [ { "vendor": "themegrill", "product": "Zakra" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00177, "percentile": 0.07493 }, "nvd": { "published": "2026-07-03T09:16:37.520", "lastModified": "2026-07-06T18:02:49.450", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4804", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "REST-writable post metadata bypasses sanitization and is concatenated into inline CSS without escaping, enabling stored script execution.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bbda67a3-0413-4d8e-8157-84c9c87b8695?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://themes.trac.wordpress.org/changeset?reponame=&new=330192%40zakra%2F4.2.1&old=297420%40zakra%2F4.2.0#file39", "host": "themes.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 941, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4912", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-26T16:24:34.319Z", "date_published": "2026-07-28T18:35:52.515Z", "date_updated": "2026-07-28T19:37:49.185Z", "publisher": "Wordfence", "title": "Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery", "affected": { "vendors": [ "tigroumeow" ], "products": [ { "vendor": "tigroumeow", "product": "Media Cleaner: Clean your WordPress!" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0024, "percentile": 0.15197 }, "nvd": { "published": "2026-07-28T19:17:36.147", "lastModified": "2026-07-28T20:34:39.437", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4912", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Media Cleaner: Clean your WordPress! follows a caller-controlled server-side URL without restricting the resolved destination to an allowed network scope.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c9214d-45d4-4477-8244-7802a4901114?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/media-cleaner/tags/7.0.3/classes/core.php#L565", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/media-cleaner/tags/7.0.3/classes/core.php#L570", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/media-cleaner/tags/7.0.3/classes/rest.php#L118", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&n%20ew3492257%40media-cleaner%2Ftrunk&old=3447443%40media-cleaner%2Ftrunk&sfp_ema%20il=&sfph_mail=", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 619, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4932", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-26T19:43:02.211Z", "date_published": "2026-07-28T18:09:32.739Z", "date_updated": "2026-07-28T18:46:57.145Z", "publisher": "ibm", "title": "This Power System update is being released to address Insufficient Entropy", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "PowerVM Hypervisor" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-331", "name": "Insufficient Entropy", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:psirt@us.ibm.com", "type": "Primary", "version": "3.1", "score": 4.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00081, "percentile": 0.00257 }, "nvd": { "published": "2026-07-28T19:17:36.287", "lastModified": "2026-07-28T20:36:09.267", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4932", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The memory-encryption design derives protection from insufficient entropy, weakening the secrecy of encrypted memory.", "basis": [ "CNA record", "NVD", "CWE-331" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7280632", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 251, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-4938", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-26T21:00:56.474Z", "date_published": "2026-07-17T19:34:14.956Z", "date_updated": "2026-07-28T18:08:00.558Z", "publisher": "ibm", "title": "Incorrect Authorization in IBM Verify Identity Access and IBM Security Verify Access", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "Verify Identity Access" }, { "vendor": "IBM", "product": "Security Verify Access" }, { "vendor": "IBM", "product": "Verify Identity Access Container" }, { "vendor": "IBM", "product": "Security Verify Access Container" } ], "affectedBlockCount": 4, "versionEntryCount": 4, "versionRangeCount": 4, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": "NVD:psirt@us.ibm.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00174, "percentile": 0.07128 }, "nvd": { "published": "2026-07-17T20:17:23.410", "lastModified": "2026-07-30T13:07:59.197", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-4938", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow an attacker with read-only privileges to make unauthorized modifications and deployments outside of their assigned permissions.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7279510", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 363, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-4942", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-26T21:14:44.344Z", "date_published": "2026-07-17T19:32:02.440Z", "date_updated": "2026-07-20T13:52:49.123Z", "publisher": "ibm", "title": "IBM i is Affected by Algorithm Downgrade in Transport Layer Security []", "affected": { "vendors": [ "IBM" ], "products": [ { "vendor": "IBM", "product": "i" } ], "affectedBlockCount": 1, "versionEntryCount": 4, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-757", "name": "Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:psirt@us.ibm.com", "type": "Secondary", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00253, "percentile": 0.16788 }, "nvd": { "published": "2026-07-17T20:17:23.560", "lastModified": "2026-07-20T17:15:53.673", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4942", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "IBM i can negotiate a TLS version that server configuration explicitly disabled when processing a crafted peer message.", "basis": [ "CNA", "CWE-757" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ibm.com/support/pages/node/7278992", "host": "www.ibm.com", "sources": [ "cna", "nvd" ], "tags": [ "patch", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 206, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-4967", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-27T08:39:20.675Z", "date_published": "2026-07-03T05:52:23.325Z", "date_updated": "2026-07-06T17:33:00.630Z", "publisher": "Unisoc", "title": "In IMS, there is a possible out of bounds read due to a missing bounds check.", "affected": { "vendors": [ "Unisoc (Shanghai) Technologies Co., Ltd." ], "products": [ { "vendor": "Unisoc (Shanghai) Technologies Co., Ltd.", "product": "SC7731E/SC9832E/SC9863A/T310/T610/T618/T7200/T7225/T7250/T7255/T7280/T7300/T8100/T9100/T8200/T8300" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-121", "name": "Stack-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:security@unisoc.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00403, "percentile": 0.33161 }, "nvd": { "published": "2026-07-03T07:16:24.333", "lastModified": "2026-07-06T19:46:08.807", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4967", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "IMS reads beyond an input buffer because it omits a required bounds check.", "basis": [ "CNA", "CWE-121" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.unisoc.com/en/support/product-security-bulletin/2072920457676509185", "host": "www.unisoc.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 169, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-4978", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-27T10:24:26.424Z", "date_published": "2026-07-30T14:53:36.922Z", "date_updated": "2026-07-30T16:10:12.292Z", "publisher": "TR-CERT", "title": "SQLi in UMAI Vision's Traffic Analysis System", "affected": { "vendors": [ "UMAI Vision" ], "products": [ { "vendor": "UMAI Vision", "product": "Traffic Analysis System" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Primary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.1766 }, "nvd": { "published": "2026-07-30T16:17:12.933", "lastModified": "2026-07-30T16:55:34.270", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-4978", "family": "INTERPRETER_BOUNDARY", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The affected endpoint incorporates caller-controlled data into an SQL statement without parameterization.", "basis": [ "CNA", "CWE-89", "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0703" ], "deepDive": true, "notes": "Reviewed https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0703. The Turkish Cyber Security Presidency page exposed no readable technical detail beyond the linked record, so the SQL construction remains undisclosed." }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0703", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 223, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5005", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-27T13:52:23.527Z", "date_published": "2026-07-09T14:13:00.362Z", "date_updated": "2026-07-14T07:43:40.417Z", "publisher": "TR-CERT", "title": "Stored XSS in Twiser's OKRs & Goals", "affected": { "vendors": [ "Twiser Informatics Technology Consulting, Trade and Education Inc." ], "products": [ { "vendor": "Twiser Informatics Technology Consulting, Trade and Education Inc.", "product": "OKRs & Goals" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00133, "percentile": 0.03235 }, "nvd": { "published": "2026-07-09T15:16:40.943", "lastModified": "2026-07-09T16:21:30.600", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5005", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The OKRs and Goals application stores attacker-controlled content and renders it into a browser-executable page without sufficient neutralization.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0524", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 259, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5040", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-27T16:26:49.615Z", "date_published": "2026-07-14T18:00:32.162Z", "date_updated": "2026-07-15T10:27:47.808Z", "publisher": "TPLink", "title": "Weak Password Hashing Mechanism in TP-Link Deco M5", "affected": { "vendors": [ "TP-Link Systems Inc." ], "products": [ { "vendor": "TP-Link Systems Inc.", "product": "Deco M5 Deco M5 V1" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-916", "name": "Use of Password Hash With Insufficient Computational Effort", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00093, "percentile": 0.00675 }, "nvd": { "published": "2026-07-14T19:18:03.213", "lastModified": "2026-07-15T20:08:02.787", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5040", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The device stores passwords with a weak hash that permits practical offline brute-force or dictionary recovery after hash disclosure.", "basis": [ "CNA", "CWE-916" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.tp-link.com/us/support/download/deco-m5/v1/#Firmware", "host": "www.tp-link.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.tp-link.com/en/support/download/deco-m5/v1/#Firmware", "host": "www.tp-link.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.tp-link.com/us/support/faq/5190/", "host": "www.tp-link.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 489, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5051", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-27T17:45:14.081Z", "date_published": "2026-07-01T17:10:56.918Z", "date_updated": "2026-07-01T17:54:43.314Z", "publisher": "HashiCorp", "title": "Audit Log Plugin Directory Guard Bypass via Legacy path Option", "affected": { "vendors": [ "HashiCorp" ], "products": [ { "vendor": "HashiCorp", "product": "Vault" }, { "vendor": "HashiCorp", "product": "Vault Enterprise" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:security@hashicorp.com", "type": "Secondary", "version": "3.1", "score": 4.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00278, "percentile": 0.20089 }, "nvd": { "published": "2026-07-01T18:16:36.227", "lastModified": "2026-07-02T17:54:27.573", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5051", "family": "FILE_OBJECT_SELECTION", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://discuss.hashicorp.com/t/hcsec-2026-16-vault-audit-device-plugin-directory-guard-bypass-via-legacy-path-option/77536", "host": "discuss.hashicorp.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 272, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-5056", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-27T18:07:56.748Z", "date_published": "2026-07-29T19:10:33.316Z", "date_updated": "2026-07-30T03:55:38.937Z", "publisher": "zdi", "title": "GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability", "affected": { "vendors": [ "GStreamer" ], "products": [ { "vendor": "GStreamer", "product": "GStreamer" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-121", "name": "Stack-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.0", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:zdi-disclosures@trendmicro.com", "type": "Secondary", "version": "3.0", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00426, "percentile": 0.35055 }, "nvd": { "published": "2026-07-29T20:17:05.337", "lastModified": "2026-07-30T14:19:24.857", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5056", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "qtdemux copies an attacker-supplied UncompressedFrameConfigBox length into a fixed stack buffer without validating the length.", "basis": [ "CNA", "CWE-121" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-283/", "host": "www.zerodayinitiative.com", "sources": [ "cna", "nvd" ], "tags": [ "x_research-advisory" ] }, { "url": "https://gitlab.freedesktop.org/api/v4/projects/gstreamer%2Fgstreamer/repository/files/security-advisories%2Fsa-2026-0016.md/raw?ref=main", "host": "gitlab.freedesktop.org", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/05/01/1", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 676, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5057", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-27T18:08:40.710Z", "date_published": "2026-07-29T19:10:50.040Z", "date_updated": "2026-07-29T19:40:52.379Z", "publisher": "zdi", "title": "ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability", "affected": { "vendors": [ "ATEN" ], "products": [ { "vendor": "ATEN", "product": "Unizon" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.0", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:zdi-disclosures@trendmicro.com", "type": "Secondary", "version": "3.0", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00484, "percentile": 0.39142 }, "nvd": { "published": "2026-07-29T20:17:05.497", "lastModified": "2026-07-30T14:19:24.857", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5057", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "ATEN Unizon exposes the RpcProvider operation without requiring authentication.", "basis": [ "CNA", "CWE-306" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-272/", "host": "www.zerodayinitiative.com", "sources": [ "cna", "nvd" ], "tags": [ "x_research-advisory" ] }, { "url": "https://www.aten.com/global/en/supportcenter/info/security-advisory/26/", "host": "www.aten.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 533, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5060", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-27T18:10:20.617Z", "date_published": "2026-07-29T09:31:14.881Z", "date_updated": "2026-07-29T15:07:22.056Z", "publisher": "Wordfence", "title": "MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion", "affected": { "vendors": [ "stylemix" ], "products": [ { "vendor": "stylemix", "product": "MasterStudy LMS WordPress Plugin – for Online Courses and Education" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0022, "percentile": 0.12665 }, "nvd": { "published": "2026-07-29T11:16:50.093", "lastModified": "2026-07-30T14:01:30.413", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5060", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "This is due to the `stm_lms_delete_cover()` function lacking ownership validation on the `file_id` parameter before passing it to `wp_delete_attachment()`.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/de11c9ad-0b9f-4934-8dc9-dc324d77d702?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/masterstudy-lms-learning-management-system/tags/3.7.14/_core/lms/classes/user.php#L2107", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/masterstudy-lms-learning-management-system/tags/3.7.14/_core/lms/classes/user.php#L2093", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3501788%40masterstudy-lms-learning-management-system%2Ftrunk&old=3496678%40masterstudy-lms-learning-management-system%2Ftrunk&sfp_email=&sfph_mail=", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 532, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5069", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-27T22:53:28.217Z", "date_published": "2026-07-10T02:30:39.977Z", "date_updated": "2026-07-10T18:02:38.866Z", "publisher": "Wordfence", "title": "Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'", "affected": { "vendors": [ "wpmanageninja" ], "products": [ { "vendor": "wpmanageninja", "product": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00171, "percentile": 0.06768 }, "nvd": { "published": "2026-07-10T04:17:52.833", "lastModified": "2026-07-10T19:17:27.203", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5069", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The subscription operation accepts an object identifier without checking that the caller owns that subscription.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e7521577-ce13-4b60-ae11-9c0f9c077cf9?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3513845/fluentform", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 409, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5114", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-29T21:55:12.924Z", "date_published": "2026-07-28T18:35:52.121Z", "date_updated": "2026-07-29T15:25:11.301Z", "publisher": "Wordfence", "title": "SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read", "affected": { "vendors": [ "softaculous" ], "products": [ { "vendor": "softaculous", "product": "SpeedyCache – Cache, Optimization, Performance" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.9, "cvss_source_score_spread": 0, "epss": { "score": 0.0034, "percentile": 0.26636 }, "nvd": { "published": "2026-07-28T19:17:39.880", "lastModified": "2026-07-29T16:17:55.300", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5114", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "SpeedyCache validates a CSS URL before stripping its query string, then reads the resolved non-CSS path without confining it to an allowed file type or root.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cfefcc38-764d-4dd9-b098-cdcad475d634?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/speedycache/tags/1.3.7/main/css.php#L137", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/speedycache/tags/1.3.7/main/util.php#L75", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 662, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5120", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-30T07:15:44.963Z", "date_published": "2026-07-01T12:16:57.432Z", "date_updated": "2026-07-01T13:36:37.270Z", "publisher": "3DS", "title": "Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026", "affected": { "vendors": [ "Dassault Systèmes" ], "products": [ { "vendor": "Dassault Systèmes", "product": "BIOVIA Workbook" } ], "affectedBlockCount": 1, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:3DS.Information-Security@3ds.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0019, "percentile": 0.08845 }, "nvd": { "published": "2026-07-01T13:17:48.033", "lastModified": "2026-07-02T17:39:57.427", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5120", "family": "STATE_SEQUENCE", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Workbook has a race that can expose one user's data to another, but the record does not identify the shared state or interleaving.", "basis": [ "CNA record", "NVD", "CWE-362" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2026-5120", "host": "www.3ds.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 161, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-5135", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-30T10:42:55.307Z", "date_published": "2026-07-01T14:08:39.712Z", "date_updated": "2026-07-01T23:53:14.087Z", "publisher": "redhat", "title": "Foreman: foreman: unauthorized modification of host configurations via broken access control", "affected": { "vendors": [ "Red Hat" ], "products": [ { "vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 8" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.17 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.18 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.19 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6" } ], "affectedBlockCount": 6, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": "NVD:secalert@redhat.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00266, "percentile": 0.18304 }, "nvd": { "published": "2026-07-01T15:17:11.740", "lastModified": "2026-07-09T02:39:11.320", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-5135", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Foreman lets a host editor retarget a lookup override by changing its nested match field without checking the new host's organization and location scope.", "basis": [ "CNA", "NVD", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://access.redhat.com/errata/RHSA-2026:34365", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:34366", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:34367", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:34368", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5135", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452230", "host": "bugzilla.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Vendor Advisory", "issue-tracking", "x_refsource_REDHAT" ] } ], "record_shape": { "descriptionChars": 465, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 6, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-5136", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-30T10:47:46.043Z", "date_published": "2026-07-01T13:28:00.316Z", "date_updated": "2026-07-02T03:56:14.203Z", "publisher": "redhat", "title": "Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation", "affected": { "vendors": [ "Red Hat" ], "products": [ { "vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 8" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.17 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.18 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.19 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6" } ], "affectedBlockCount": 6, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-266", "name": "Incorrect Privilege Assignment", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:secalert@redhat.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00326, "percentile": 0.25155 }, "nvd": { "published": "2026-07-01T14:16:47.277", "lastModified": "2026-07-09T02:39:36.490", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-5136", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Red Hat Satellite 6.16 for RHEL 8 role-assignment path grants a role that the requesting user lacks authority to assign.", "basis": [ "CNA", "CWE-266" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://access.redhat.com/errata/RHSA-2026:34365", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:34366", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:34367", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:34368", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5136", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452970", "host": "bugzilla.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Vendor Advisory", "issue-tracking", "x_refsource_REDHAT" ] } ], "record_shape": { "descriptionChars": 459, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 6, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-5137", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-30T10:48:18.196Z", "date_published": "2026-07-03T09:31:52.399Z", "date_updated": "2026-07-06T14:44:45.786Z", "publisher": "Wordfence", "title": "RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter", "affected": { "vendors": [ "rometheme" ], "products": [ { "vendor": "rometheme", "product": "RTMKit" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-98", "name": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00266, "percentile": 0.18377 }, "nvd": { "published": "2026-07-03T10:16:33.113", "lastModified": "2026-07-06T18:02:49.450", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5137", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An attacker can select a filesystem path outside the directory intended for the operation.", "basis": [ "CNA", "CWE-98" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/22172d16-bcde-4516-bce0-222fbb7a76f7?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/tags/2.0.3/Inc/Modules/Templatekits/TemplatekitAPI.php#L39", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/rometheme-for-elementor/trunk/Inc/Modules/Templatekits/TemplatekitAPI.php#L39", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3568335/rometheme-for-elementor/trunk/Inc/Modules/Templatekits/TemplatekitAPI.php", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Frometheme-for-elementor/tags/2.0.7&new_path=%2Frometheme-for-elementor/tags/2.0.8", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 539, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5138", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-30T10:53:25.776Z", "date_published": "2026-07-01T14:08:43.978Z", "date_updated": "2026-07-01T23:53:14.772Z", "publisher": "redhat", "title": "Foreman: foreman: information disclosure via improper validation of nested request parameters", "affected": { "vendors": [ "Red Hat" ], "products": [ { "vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 8" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.17 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.18 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.19 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6" } ], "affectedBlockCount": 6, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:secalert@redhat.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00249, "percentile": 0.16256 }, "nvd": { "published": "2026-07-01T15:17:11.860", "lastModified": "2026-07-09T02:38:49.453", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-5138", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Red Hat Satellite 6.16 for RHEL 8 request path accepts an attacker-selected object identifier without binding that object to the caller's tenant, owner, or permitted scope.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://access.redhat.com/errata/RHSA-2026:34365", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:34366", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:34367", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:34368", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5138", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452971", "host": "bugzilla.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Vendor Advisory", "issue-tracking", "x_refsource_REDHAT" ] } ], "record_shape": { "descriptionChars": 543, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 6, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-5142", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-30T12:08:56.764Z", "date_published": "2026-07-01T14:07:55.662Z", "date_updated": "2026-07-01T23:53:16.614Z", "publisher": "redhat", "title": "Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass", "affected": { "vendors": [ "Red Hat" ], "products": [ { "vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 8" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.16 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.17 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.18 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6.19 for RHEL 9" }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6" } ], "affectedBlockCount": 6, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:secalert@redhat.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00278, "percentile": 0.19972 }, "nvd": { "published": "2026-07-01T15:17:11.977", "lastModified": "2026-07-09T02:38:36.480", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-5142", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure Shell) keys from other organizations by directly querying key pair IDs.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://access.redhat.com/errata/RHSA-2026:34365", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:34366", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:34367", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:34368", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5142", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452999", "host": "bugzilla.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Vendor Advisory", "issue-tracking", "x_refsource_REDHAT" ] } ], "record_shape": { "descriptionChars": 359, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 6, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-5219", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-31T11:50:13.083Z", "date_published": "2026-07-30T13:43:14.891Z", "date_updated": "2026-07-31T13:27:29.128Z", "publisher": "TR-CERT", "title": "CSRF in Softtr's E-Commerce Pack", "affected": { "vendors": [ "Softtr Information Technology Trade Ltd. Co." ], "products": [ { "vendor": "Softtr Information Technology Trade Ltd. Co.", "product": "E-Commerce Pack" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 8.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L" } ], "max_cvss_observed_across_sources": 8.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00134, "percentile": 0.03318 }, "nvd": { "published": "2026-07-30T14:17:01.747", "lastModified": "2026-07-31T14:16:50.457", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5219", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "A state-changing e-commerce request can be submitted from another site without a reliable request-origin token.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0702", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 202, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5220", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-31T11:56:09.964Z", "date_published": "2026-07-01T14:12:54.765Z", "date_updated": "2026-07-01T14:55:07.615Z", "publisher": "TR-CERT", "title": "Stored XSS in DivvyDrive Information Technologies' DivvyDrive", "affected": { "vendors": [ "DivvyDrive Information Technologies Inc." ], "products": [ { "vendor": "DivvyDrive Information Technologies Inc.", "product": "DivvyDrive" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00148, "percentile": 0.04479 }, "nvd": { "published": "2026-07-01T15:17:12.090", "lastModified": "2026-07-01T16:16:52.967", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5220", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In DivvyDrive, attacker-controlled markup is stored and later rendered without the required HTML-context sanitization or output escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0475", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 236, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5268", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-31T19:44:32.296Z", "date_published": "2026-07-06T15:25:56.938Z", "date_updated": "2026-07-08T20:18:06.557Z", "publisher": "Ciena", "title": "SFTP Server Authentication Weakness", "affected": { "vendors": [ "CIENA" ], "products": [ { "vendor": "CIENA", "product": "6500 S-Series" }, { "vendor": "CIENA", "product": "6500 T-Series" }, { "vendor": "CIENA", "product": "PTS" }, { "vendor": "CIENA", "product": "CPL" } ], "affectedBlockCount": 4, "versionEntryCount": 4, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-288", "name": "Authentication Bypass Using an Alternate Path or Channel", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0042, "percentile": 0.34588 }, "nvd": { "published": "2026-07-06T16:16:38.433", "lastModified": "2026-07-08T21:16:54.663", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5268", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Ciena's default SFTP server permits unauthenticated filesystem access, but the official advisory does not disclose the alternate path, credential decision, or failing authentication check.", "basis": [ "CNA", "CWE-288", "Ciena Product Security" ], "deepDive": true, "notes": "https://www.ciena.com/product-security - Ciena confirms an authentication bypass in the default SFTP server, affected product lines, filesystem impact, and remediation, but does not disclose the alternate path, credential decision, or failing check." }, "references": [ { "url": "https://www.ciena.com/product-security", "host": "www.ciena.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 353, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-5269", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-31T19:44:35.713Z", "date_published": "2026-07-14T22:25:55.317Z", "date_updated": "2026-07-15T14:30:50.769Z", "publisher": "Ciena", "title": "Navigator NCS and MCP System Accounts with Default Passwords", "affected": { "vendors": [ "CIENA" ], "products": [ { "vendor": "CIENA", "product": "Navigator NCS" }, { "vendor": "CIENA", "product": "MCP" }, { "vendor": "CIENA", "product": "Planner Plus OnPrem" } ], "affectedBlockCount": 3, "versionEntryCount": 3, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-1393", "name": "Use of Default Password", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00274, "percentile": 0.19549 }, "nvd": { "published": "2026-07-14T23:17:34.453", "lastModified": "2026-07-15T20:08:02.787", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5269", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Navigator NCS deployment includes predictable default credentials on hidden system accounts.", "basis": [ "CNA", "CWE-1393" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ciena.com/product-security", "host": "www.ciena.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 479, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-5270", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-03-31T19:44:41.118Z", "date_published": "2026-07-14T22:24:34.750Z", "date_updated": "2026-07-15T12:39:32.248Z", "publisher": "Ciena", "title": "Authentication Bypass in Navigator and Blue Planet Products", "affected": { "vendors": [ "Blue Planet", "CIENA" ], "products": [ { "vendor": "CIENA", "product": "Navigator NCS" }, { "vendor": "CIENA", "product": "MCP" }, { "vendor": "CIENA", "product": "Planner Plus OnPrem" }, { "vendor": "Blue Planet", "product": "Inventory" }, { "vendor": "Blue Planet", "product": "Orchestration" }, { "vendor": "Blue Planet", "product": "Route Optimization & Analysis" }, { "vendor": "Blue Planet", "product": "Unified Assurance & Analytics" } ], "affectedBlockCount": 7, "versionEntryCount": 18, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-287", "name": "Improper Authentication", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00452, "percentile": 0.3703 }, "nvd": { "published": "2026-07-14T23:17:34.570", "lastModified": "2026-07-15T20:08:02.787", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5270", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Ciena's authentication layer interprets crafted HTTP paths and headers inconsistently, allowing a request to bypass authentication and audit logging.", "basis": [ "CNA", "CWE-287" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.ciena.com/product-security", "host": "www.ciena.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 386, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 7, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-5348", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-01T16:39:04.047Z", "date_published": "2026-07-02T05:35:13.968Z", "date_updated": "2026-07-02T14:52:06.995Z", "publisher": "Wordfence", "title": "Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure", "affected": { "vendors": [ "kodezen" ], "products": [ { "vendor": "kodezen", "product": "Academy LMS – WordPress LMS Plugin for Complete eLearning Solution" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00262, "percentile": 0.17866 }, "nvd": { "published": "2026-07-02T06:16:14.073", "lastModified": "2026-07-02T15:17:11.593", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5348", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The topics API uses an always-allow permission callback and does not check course visibility or enrollment before returning private curriculum data.", "basis": [ "CNA", "NVD", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b84ae3e0-de4f-41d6-8944-fadaf6fdcf79?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/academy/trunk/includes/api/course.php#L50", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/academy/tags/3.5.3/includes/api/course.php#L50", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/academy/trunk/includes/api/course.php#L77", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/academy/tags/3.5.3/includes/api/course.php#L77", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/academy/trunk/includes/traits/courses.php#L1514", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/academy/tags/3.5.3/includes/traits/courses.php#L1514", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3592849%40academy&new=3592849%40academy&sfp_email=&sfph_mail=", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 601, "referenceCount": 8, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5356", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-01T16:48:04.044Z", "date_published": "2026-07-08T12:33:15.433Z", "date_updated": "2026-07-08T15:02:28.830Z", "publisher": "Wordfence", "title": "LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass", "affected": { "vendors": [ "latepoint" ], "products": [ { "vendor": "latepoint", "product": "LatePoint – Calendar Booking Plugin for Appointments and Events" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0021, "percentile": 0.11347 }, "nvd": { "published": "2026-07-08T13:16:56.767", "lastModified": "2026-07-08T16:16:34.673", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5356", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "LatePoint accepts a previously succeeded client-supplied PaymentIntent without binding it to the current booking amount.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1b1338c4-36a8-47b0-b3cf-c5dc690f8c1c?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3509569/latepoint", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 420, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5459", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-02T22:38:21.515Z", "date_published": "2026-07-08T12:33:16.401Z", "date_updated": "2026-07-08T14:00:54.082Z", "publisher": "Wordfence", "title": "User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite", "affected": { "vendors": [ "wedevs" ], "products": [ { "vendor": "wedevs", "product": "User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00183, "percentile": 0.08132 }, "nvd": { "published": "2026-07-08T13:16:56.887", "lastModified": "2026-07-08T14:55:07.843", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5459", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "payment_page accepts a caller-controlled user_id without binding the selected payment record to that user.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a02d9a01-1104-4935-8074-af4367c66278?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3514258/wp-user-frontend", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 510, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5487", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-03T14:31:51.826Z", "date_published": "2026-07-29T19:09:41.325Z", "date_updated": "2026-07-30T13:43:37.580Z", "publisher": "zdi", "title": "DriveLock Directory Traversal Information Disclosure Vulnerability", "affected": { "vendors": [ "DriveLock" ], "products": [ { "vendor": "DriveLock", "product": "DriveLock" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.0", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:zdi-disclosures@trendmicro.com", "type": "Secondary", "version": "3.0", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.01535, "percentile": 0.72361 }, "nvd": { "published": "2026-07-29T20:17:05.653", "lastModified": "2026-07-30T14:18:46.477", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5487", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "DriveLock allows attacker-controlled path or filename components to escape the intended directory or select a different file object than the operation was authorized to access.", "basis": [ "CNA", "NVD", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-284/", "host": "www.zerodayinitiative.com", "sources": [ "cna", "nvd" ], "tags": [ "x_research-advisory" ] }, { "url": "https://www.drivelock.help/sb/Content/SecurityBulletins/26-003-PathValidation.htm", "host": "www.drivelock.help", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 580, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5489", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-03T14:32:26.162Z", "date_published": "2026-07-29T19:09:50.068Z", "date_updated": "2026-07-30T13:46:25.972Z", "publisher": "zdi", "title": "DriveLock Directory Traversal Information Disclosure Vulnerability", "affected": { "vendors": [ "DriveLock" ], "products": [ { "vendor": "DriveLock", "product": "DriveLock" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:zdi-disclosures@trendmicro.com", "type": "Secondary", "version": "3.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.01266, "percentile": 0.66863 }, "nvd": { "published": "2026-07-29T20:17:05.777", "lastModified": "2026-07-30T14:18:46.477", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5489", "family": "FILE_OBJECT_SELECTION", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The DriveLock web service uses a caller-supplied path in file operations without confining it to an allowed directory.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-285/", "host": "www.zerodayinitiative.com", "sources": [ "cna", "nvd" ], "tags": [ "x_research-advisory" ] }, { "url": "https://www.drivelock.help/sb/Content/SecurityBulletins/26-001-DESForwarding.htm", "host": "www.drivelock.help", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 580, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5490", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-03T14:32:38.204Z", "date_published": "2026-07-29T19:09:57.872Z", "date_updated": "2026-07-31T03:56:15.195Z", "publisher": "zdi", "title": "DriveLock SQL Injection Privilege Escalation Vulnerability", "affected": { "vendors": [ "DriveLock" ], "products": [ { "vendor": "DriveLock", "product": "DriveLock" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.0", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:zdi-disclosures@trendmicro.com", "type": "Secondary", "version": "3.0", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00481, "percentile": 0.38945 }, "nvd": { "published": "2026-07-29T20:17:05.893", "lastModified": "2026-07-31T04:17:24.013", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5490", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected endpoint incorporates caller-controlled data into an SQL statement without parameterization.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-286/", "host": "www.zerodayinitiative.com", "sources": [ "cna", "nvd" ], "tags": [ "x_research-advisory" ] }, { "url": "https://drivelock.help/sb/Content/SecurityBulletins/26-002-SQLInjection.htm", "host": "drivelock.help", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 572, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5491", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-03T14:32:58.570Z", "date_published": "2026-07-29T19:10:05.631Z", "date_updated": "2026-07-30T13:53:05.508Z", "publisher": "zdi", "title": "DriveLock Directory Traversal Information Disclosure Vulnerability", "affected": { "vendors": [ "DriveLock" ], "products": [ { "vendor": "DriveLock", "product": "DriveLock" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.0", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:zdi-disclosures@trendmicro.com", "type": "Secondary", "version": "3.0", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.01539, "percentile": 0.72433 }, "nvd": { "published": "2026-07-29T20:17:06.020", "lastModified": "2026-07-30T14:18:46.477", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5491", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "DriveLock accepts a caller-controlled path without confining resolution to the intended directory namespace.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-287/", "host": "www.zerodayinitiative.com", "sources": [ "cna", "nvd" ], "tags": [ "x_research-advisory" ] }, { "url": "https://www.drivelock.help/sb/Content/SecurityBulletins/26-003-PathValidation.htm", "host": "www.drivelock.help", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 580, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5492", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-03T14:33:24.878Z", "date_published": "2026-07-29T19:10:14.174Z", "date_updated": "2026-07-29T19:47:06.945Z", "publisher": "zdi", "title": "DriveLock Directory Traversal Information Disclosure Vulnerability", "affected": { "vendors": [ "DriveLock" ], "products": [ { "vendor": "DriveLock", "product": "DriveLock" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.0", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:zdi-disclosures@trendmicro.com", "type": "Secondary", "version": "3.0", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.016, "percentile": 0.73387 }, "nvd": { "published": "2026-07-29T20:17:06.140", "lastModified": "2026-07-30T14:18:46.477", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5492", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The port 4568 web service uses an authenticated caller's path in file operations without confining it to the intended directory.", "basis": [ "CNA record", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-288/", "host": "www.zerodayinitiative.com", "sources": [ "cna", "nvd" ], "tags": [ "x_research-advisory" ] }, { "url": "https://www.drivelock.help/sb/Content/SecurityBulletins/26-003-PathValidation.htm", "host": "www.drivelock.help", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 576, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5523", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-04T00:04:43.797Z", "date_published": "2026-07-09T04:32:54.346Z", "date_updated": "2026-07-09T12:52:15.148Z", "publisher": "Wordfence", "title": "Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form", "affected": { "vendors": [ "Divi Engine" ], "products": [ { "vendor": "Divi Engine", "product": "Divi Form Builder" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00301, "percentile": 0.22346 }, "nvd": { "published": "2026-07-09T06:16:21.300", "lastModified": "2026-07-09T16:20:12.533", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5523", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Profile-update functions accept a caller-supplied user ID and check only that some user is logged in, without authorizing changes to the target profile.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cb158acc-69d7-4a7d-b356-7de1f6b37019?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://diviengine.com/divi-form-builder-changelog/", "host": "diviengine.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 674, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5524", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-04T01:50:49.629Z", "date_published": "2026-07-02T12:34:40.602Z", "date_updated": "2026-07-02T15:00:12.782Z", "publisher": "Wordfence", "title": "Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter", "affected": { "vendors": [ "Divi Engine" ], "products": [ { "vendor": "Divi Engine", "product": "Divi Form Builder" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00723, "percentile": 0.50461 }, "nvd": { "published": "2026-07-02T13:17:00.587", "lastModified": "2026-07-02T15:17:11.707", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5524", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "do_image_upload lets the caller define the file-extension validation regex and stores PHP-executable extensions in a public upload directory.", "basis": [ "CNA", "CWE-434" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9692deb2-2526-4983-8a13-93a382e230c8?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://diviengine.com/divi-form-builder-changelog/", "host": "diviengine.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1054, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5582", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-04T17:46:28.655Z", "date_published": "2026-07-30T12:05:02.762Z", "date_updated": "2026-07-31T22:49:40.115Z", "publisher": "Wordfence", "title": "FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle", "affected": { "vendors": [ "fusewp" ], "products": [ { "vendor": "fusewp", "product": "FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00132, "percentile": 0.03155 }, "nvd": { "published": "2026-07-30T12:19:03.080", "lastModified": "2026-07-31T23:17:25.817", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5582", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A state-changing request lacks a nonce or equivalent cross-site request proof.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1ff5889e-b9fd-494f-b25d-78e85e94d34c?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://wordpress.org/plugins/fusewp/", "host": "wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/fusewp/trunk/src/core/src/AjaxHandler.php#L149", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/fusewp/tags/1.1.24.2/src/core/src/AjaxHandler.php#L149", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3505110@fusewp/trunk/src/core/src/AjaxHandler.php&old=3172907@fusewp/trunk/src/core/src/AjaxHandler.php&sfp_email=&sfph_mail=", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 427, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5626", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-05T18:05:22.216Z", "date_published": "2026-07-29T02:31:39.742Z", "date_updated": "2026-07-29T14:24:16.632Z", "publisher": "Wordfence", "title": "Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export", "affected": { "vendors": [ "bplugins" ], "products": [ { "vendor": "bplugins", "product": "Survey Form Block – collect answers and insights from your audience" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00199, "percentile": 0.09966 }, "nvd": { "published": "2026-07-29T04:17:13.503", "lastModified": "2026-07-30T14:01:30.413", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5626", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The application permits a protected action without binding the caller's privilege to the requested operation.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e98d4f04-74cd-486f-bb2f-fad76895f386?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/survey-form-block/trunk/inc/SVBAjax.php#L52", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/survey-form-block/tags/1.0.1/inc/SVBAjax.php#L52", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://wordpress.org/plugins/survey-form-block/", "host": "wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3502334%40survey-form-block%2Ftrunk%2Finc%2FSVBAjax.php&old=3223297%40survey-form-block%2Ftrunk%2Finc%2FSVBAjax.php", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 347, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5674", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-06T09:07:33.494Z", "date_published": "2026-07-16T13:26:44.534Z", "date_updated": "2026-08-03T07:09:51.075Z", "publisher": "redhat", "title": "Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading", "affected": { "vendors": [ "Red Hat" ], "products": [ { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8" } ], "affectedBlockCount": 9, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "affected", "unaffected" ] }, "cwes": [ { "id": "CWE-427", "name": "Uncontrolled Search Path Element", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:secalert@redhat.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.0273 }, "nvd": { "published": "2026-07-16T14:16:56.070", "lastModified": "2026-08-03T08:17:20.920", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5674", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Red Hat Enterprise Linux 10 runtime searches an attacker-influenced library path and can load code from outside the trusted installation.", "basis": [ "CNA", "CWE-427" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://access.redhat.com/errata/RHSA-2026:47082", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:47083", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5674", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455341", "host": "bugzilla.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "x_refsource_REDHAT" ] } ], "record_shape": { "descriptionChars": 397, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-5730", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-07T12:08:28.185Z", "date_published": "2026-07-07T06:45:41.937Z", "date_updated": "2026-07-07T13:25:37.426Z", "publisher": "TR-CERT", "title": "IDOR in Idvlabs' Ontime", "affected": { "vendors": [ "Idvlabs Software and Consulting Services Inc." ], "products": [ { "vendor": "Idvlabs Software and Consulting Services Inc.", "product": "Ontime" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00246, "percentile": 0.15966 }, "nvd": { "published": "2026-07-07T08:16:25.540", "lastModified": "2026-07-07T14:16:34.343", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5730", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A request selects another user's object without an ownership check.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0503", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 208, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5743", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-07T13:48:55.983Z", "date_published": "2026-07-11T02:31:16.457Z", "date_updated": "2026-07-13T14:40:00.739Z", "publisher": "Wordfence", "title": "Mixed Media Gallery Blocks <= 3.3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via sliderMaxHeight Block Attribute", "affected": { "vendors": [ "gallerycreator" ], "products": [ { "vendor": "gallerycreator", "product": "SimpLy Gallery" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00252, "percentile": 0.16609 }, "nvd": { "published": "2026-07-11T04:17:23.843", "lastModified": "2026-07-13T16:59:13.647", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5743", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A regex sanitizer removes only quoted event-handler attributes, so an unquoted handler in sliderMaxHeight survives and is rendered as executable HTML.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/29b1984d-e6da-49d5-8b40-cdf2f1bcc1bb?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/tags/3.3.2.2/blocks/init.php#L95", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/blocks/init.php#L95", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/blocks/init.php#L122", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/tags/3.3.2.2/blocks/init.php#L122", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/blocks/init.php#L142", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/tags/3.3.2.2/blocks/init.php#L142", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/blocks/init.php#L151", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/simply-gallery-block/tags/3.3.2.2/blocks/init.php#L151", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3581386%40simply-gallery-block&new=3581386%40simply-gallery-block", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 846, "referenceCount": 10, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5793", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-08T13:03:45.307Z", "date_published": "2026-07-09T08:22:59.096Z", "date_updated": "2026-07-09T12:39:41.345Z", "publisher": "TR-CERT", "title": "XSS in Inrove Software's BiEticaret", "affected": { "vendors": [ "Inrove Software and Internet Services" ], "products": [ { "vendor": "Inrove Software and Internet Services", "product": "BiEticaret" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00149, "percentile": 0.04571 }, "nvd": { "published": "2026-07-09T10:16:27.320", "lastModified": "2026-07-09T16:21:30.600", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5793", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "BiEticaret reflects attacker-controlled input into generated HTML without the required browser-context neutralization.", "basis": [ "CNA", "NVD", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0519", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 220, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5799", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-08T14:17:21.176Z", "date_published": "2026-07-07T06:49:02.017Z", "date_updated": "2026-07-07T13:26:51.694Z", "publisher": "TR-CERT", "title": "IDOR in Idvlabs' Ontime", "affected": { "vendors": [ "Idvlabs Software and Consulting Services Inc." ], "products": [ { "vendor": "Idvlabs Software and Consulting Services Inc.", "product": "Ontime" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00251, "percentile": 0.16593 }, "nvd": { "published": "2026-07-07T08:16:25.677", "lastModified": "2026-07-07T14:16:34.440", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5799", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Ontime accepts a caller-controlled object key without verifying that the authenticated user is authorized for the referenced object.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0503", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 208, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5801", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-08T14:18:28.380Z", "date_published": "2026-07-10T18:07:44.714Z", "date_updated": "2026-07-10T19:06:18.464Z", "publisher": "TR-CERT", "title": "SQLi in Semtek Informatics' SEM-PMP", "affected": { "vendors": [ "Semtek Informatics Software Consulting Trade Ltd. Co." ], "products": [ { "vendor": "Semtek Informatics Software Consulting Trade Ltd. Co.", "product": "SEM-PMP" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00404, "percentile": 0.33188 }, "nvd": { "published": "2026-07-10T19:17:27.323", "lastModified": "2026-07-10T20:16:48.923", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5801", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled input reaches an SQL statement without separation from SQL grammar.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0527", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 263, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5821", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-08T16:28:00.923Z", "date_published": "2026-07-02T05:35:07.753Z", "date_updated": "2026-07-02T12:37:03.815Z", "publisher": "Wordfence", "title": "Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection", "affected": { "vendors": [ "elemntor" ], "products": [ { "vendor": "elemntor", "product": "Image Optimizer – Optimize Images and Convert to WebP or AVIF" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-73", "name": "External Control of File Name or Path", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00344, "percentile": 0.26995 }, "nvd": { "published": "2026-07-02T06:16:14.220", "lastModified": "2026-07-02T13:58:56.870", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5821", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Image Optimizer – Optimize Images and Convert to WebP or AVIF uses an attacker-controlled filename or path directly for a filesystem operation.", "basis": [ "CNA", "CWE-73" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a00374-e9d6-46f9-a28c-cb7768505787?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/image-optimization/trunk/classes/image/image-backup.php#L117", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/image-optimization/tags/1.7.3/classes/image/image-backup.php#L117", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/image-optimization/trunk/modules/backups/components/handle-backups-removing.php#L19", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/image-optimization/tags/1.7.3/modules/backups/components/handle-backups-removing.php#L19", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/image-optimization/trunk/classes/image/image-meta.php#L97", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/image-optimization/tags/1.7.3/classes/image/image-meta.php#L97", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3557772%40image-optimization&new=3557772%40image-optimization&sfp_email=&sfph_mail=", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1131, "referenceCount": 8, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-5846", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-08T18:55:38.436Z", "date_published": "2026-07-30T21:12:42.825Z", "date_updated": "2026-07-31T20:12:49.282Z", "publisher": "icscert", "title": "Hard-coded Cryptographic Key in Watchfire Controllers", "affected": { "vendors": [ "Watchfire" ], "products": [ { "vendor": "Watchfire", "product": "BC550" }, { "vendor": "Watchfire", "product": "BC750" }, { "vendor": "Watchfire", "product": "BC760" }, { "vendor": "Watchfire", "product": "BC760DC" } ], "affectedBlockCount": 4, "versionEntryCount": 12, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-321", "name": "Use of Hard-coded Cryptographic Key", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.7, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N" }, { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:ics-cert@hq.dhs.gov", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:ics-cert@hq.dhs.gov", "type": "Secondary", "version": "3.1", "score": 5.7, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 7.6, "cvss_source_score_spread": 1.8999999999999995, "epss": { "score": 0.00163, "percentile": 0.05929 }, "nvd": { "published": "2026-07-30T22:16:55.107", "lastModified": "2026-07-31T16:17:08.500", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5846", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The firmware ships the same plaintext RSA private keys and certificates used to authenticate and encrypt every controller management interface.", "basis": [ "CNA", "CWE-321" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-09", "host": "www.cisa.gov", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-09.json", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 387, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 4, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-5922", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-08T21:33:29.346Z", "date_published": "2026-07-08T21:39:06.676Z", "date_updated": "2026-07-09T13:53:34.577Z", "publisher": "hp", "title": "Poly Voice – Potential Unauthorized Modification of WebUI using XSS Attack", "affected": { "vendors": [ "HP Inc." ], "products": [ { "vendor": "HP Inc.", "product": "Poly CCX" }, { "vendor": "HP Inc.", "product": "Poly Edge E" }, { "vendor": "HP Inc.", "product": "Poly Trio C60" } ], "affectedBlockCount": 3, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:hp-security-alert@hp.com", "type": "Secondary", "version": "4.0", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 5.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00234, "percentile": 0.1439 }, "nvd": { "published": "2026-07-08T22:17:16.193", "lastModified": "2026-07-09T16:39:17.737", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5922", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Poly CCX places attacker-controlled markup, attributes, or URLs into an HTML or DOM rendering context without the required sanitization or output encoding.", "basis": [ "CNA", "NVD", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hp.com/us-en/document/ish_15255534-15255565-16/hpsbpy04108", "host": "support.hp.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 123, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-5923", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-08T21:33:32.687Z", "date_published": "2026-07-08T21:29:42.801Z", "date_updated": "2026-07-09T13:53:11.528Z", "publisher": "hp", "title": "Poly Voice – Potential Unauthorized Modification of WebUI using CSRF Attack", "affected": { "vendors": [ "HP Inc." ], "products": [ { "vendor": "HP Inc.", "product": "Poly CCX" }, { "vendor": "HP Inc.", "product": "Poly Edge E" }, { "vendor": "HP Inc.", "product": "Poly Trio C60" } ], "affectedBlockCount": 3, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:hp-security-alert@hp.com", "type": "Secondary", "version": "4.0", "score": 6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 6, "cvss_source_score_spread": 0, "epss": { "score": 0.00139, "percentile": 0.03758 }, "nvd": { "published": "2026-07-08T22:17:16.480", "lastModified": "2026-07-09T16:39:17.737", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5923", "family": "REQUEST_CHANNEL_TRUST", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The advisory states that a stolen session cookie can authorize changes to the phone's web page, while it does not disclose the request validation or cookie binding that fails.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.hp.com/us-en/document/ish_15255241-15255270-16/hpsbpy04109", "host": "support.hp.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 101, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-5955", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-09T07:42:27.443Z", "date_published": "2026-07-09T08:26:06.075Z", "date_updated": "2026-07-09T12:35:54.233Z", "publisher": "TR-CERT", "title": "SQLi in Inrove Software's BiEticaret", "affected": { "vendors": [ "Inrove Software and Internet Services" ], "products": [ { "vendor": "Inrove Software and Internet Services", "product": "BiEticaret" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00275, "percentile": 0.19678 }, "nvd": { "published": "2026-07-09T10:16:27.427", "lastModified": "2026-07-09T16:21:30.600", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-5955", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "BiEticaret accepts attacker input into an SQL statement without separating data from SQL grammar.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0519", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 220, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6070", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-10T13:34:33.261Z", "date_published": "2026-07-01T04:32:27.988Z", "date_updated": "2026-07-01T10:42:10.837Z", "publisher": "Wordfence", "title": "WP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' Parameter", "affected": { "vendors": [ "cmsjunkie" ], "products": [ { "vendor": "cmsjunkie", "product": "WP-BusinessDirectory – Business directory plugin for WordPress" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-73", "name": "External Control of File Name or Path", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00409, "percentile": 0.33617 }, "nvd": { "published": "2026-07-01T05:16:23.277", "lastModified": "2026-07-01T13:56:17.493", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6070", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The upload deletion endpoint passes a traversal-bearing _filename to unlink without containing it under the plugin directory.", "basis": [ "CNA", "CWE-73" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d68f43-2a57-4352-8aae-0657b386ac7c?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/wp-businessdirectory/trunk/site/controllers/upload.php#L450", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/wp-businessdirectory/tags/4.0.0/site/controllers/upload.php#L450", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/wp-businessdirectory/trunk/site/controllers/upload.php#L127", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/wp-businessdirectory/tags/4.0.0/site/controllers/upload.php#L127", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1043, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6089", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-10T15:43:59.831Z", "date_published": "2026-07-29T09:31:15.249Z", "date_updated": "2026-07-29T14:29:39.227Z", "publisher": "Wordfence", "title": "WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery", "affected": { "vendors": [ "blendmedia" ], "products": [ { "vendor": "blendmedia", "product": "WP CTA – Call Now Button, Sticky Button & Call to Action Builder" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00278, "percentile": 0.19976 }, "nvd": { "published": "2026-07-29T11:16:50.423", "lastModified": "2026-07-30T14:01:30.413", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6089", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The WP CTA – Call Now Button, Sticky Button & Call to Action Builder request path lets a caller choose a server-side destination outside the intended network boundary.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/df5fc86f-e4ba-424b-bece-79abd763cf74?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-sticky-sidebar/trunk/inc/import-export.php#L97", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3491924%40easy-sticky-sidebar%2Ftrunk&old=3459250%40easy-sticky-sidebar%2Ftrunk&sfp_email=&sfph_mail=", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 713, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6101", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-10T23:33:50.597Z", "date_published": "2026-07-07T13:32:10.414Z", "date_updated": "2026-07-07T14:14:00.335Z", "publisher": "Wordfence", "title": "AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload", "affected": { "vendors": [ "mohammed_kaludi" ], "products": [ { "vendor": "mohammed_kaludi", "product": "AMP for WP – Accelerated Mobile Pages" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-73", "name": "External Control of File Name or Path", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00628, "percentile": 0.46633 }, "nvd": { "published": "2026-07-07T14:16:34.543", "lastModified": "2026-07-07T15:16:49.807", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6101", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Unsafe ZIP extraction lets an authorized author place nested files in a web-accessible location outside the intended extraction set.", "basis": [ "CNA", "CWE-73" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b594d0e9-d805-48b9-bfd4-4cc77dd3a70e?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/accelerated-moblie-pages.php#L1616", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.12/accelerated-moblie-pages.php#L1616", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/includes/options/redux-core/framework.php#L2832", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.12/includes/options/redux-core/framework.php#L2832", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/includes/options/admin-config.php#L1700", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.12/includes/options/admin-config.php#L1700", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/includes/options/redux-core/core/panel.php#L175", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.12/includes/options/redux-core/core/panel.php#L175", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3512870/", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 614, "referenceCount": 10, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6102", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-11T00:19:18.083Z", "date_published": "2026-07-29T19:09:04.626Z", "date_updated": "2026-07-31T03:56:14.448Z", "publisher": "zdi", "title": "MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability", "affected": { "vendors": [ "MSI" ], "products": [ { "vendor": "MSI", "product": "MSI Center" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-346", "name": "Origin Validation Error", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.0", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:zdi-disclosures@trendmicro.com", "type": "Secondary", "version": "3.0", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00086, "percentile": 0.00422 }, "nvd": { "published": "2026-07-29T20:17:12.980", "lastModified": "2026-07-31T04:17:24.730", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6102", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The MSI NTIOLib_X64 driver accepts privileged commands from a low-privileged local origin without validating that command source.", "basis": [ "CNA", "CWE-346" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-430/", "host": "www.zerodayinitiative.com", "sources": [ "cna", "nvd" ], "tags": [ "x_research-advisory" ] } ], "record_shape": { "descriptionChars": 602, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6212", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-13T12:17:13.977Z", "date_published": "2026-07-10T18:35:43.613Z", "date_updated": "2026-07-10T19:13:49.677Z", "publisher": "TR-CERT", "title": "IDOR in Teracity's TeraMIS", "affected": { "vendors": [ "Teracity Software Technologies Inc." ], "products": [ { "vendor": "Teracity Software Technologies Inc.", "product": "TeraMIS" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00251, "percentile": 0.16576 }, "nvd": { "published": "2026-07-10T19:17:27.840", "lastModified": "2026-07-10T20:16:49.257", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6212", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The operation trusts a caller-supplied object identifier without verifying that the selected object belongs to the caller's permitted scope.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0528", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 200, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6230", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-13T14:27:51.115Z", "date_published": "2026-07-08T11:30:32.366Z", "date_updated": "2026-07-08T14:00:11.719Z", "publisher": "Wordfence", "title": "Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter", "affected": { "vendors": [ "tainacan" ], "products": [ { "vendor": "tainacan", "product": "Tainacan" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00273, "percentile": 0.19423 }, "nvd": { "published": "2026-07-08T12:17:20.660", "lastModified": "2026-07-08T14:55:07.843", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6230", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/241d9cd3-9331-49b2-8083-dc646070488e?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/tainacan/tainacan/commit/579d28d7752b27ed3407f5197abb6349b3efc3c9", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 459, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6251", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-13T19:04:06.546Z", "date_published": "2026-07-28T05:39:41.989Z", "date_updated": "2026-07-28T13:38:16.409Z", "publisher": "Wordfence", "title": "Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter", "affected": { "vendors": [ "Chaty" ], "products": [ { "vendor": "Chaty", "product": "Chaty Pro" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00249, "percentile": 0.16262 }, "nvd": { "published": "2026-07-28T07:16:42.920", "lastModified": "2026-07-28T16:07:15.840", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6251", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "fetch_custom_field concatenates widget_id into SQL before checking the nonce and without parameterization or integer casting.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/582fa92d-8e52-49a9-94ce-f1b49229f591?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/chaty-pro/trunk/admin/class-admin-base.php#L3626", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/chaty-pro/tags/3.5.0/admin/class-admin-base.php#L3626", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/chaty-pro/trunk/admin/class-admin-base.php#L3623", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/chaty-pro/tags/3.5.0/admin/class-admin-base.php#L3623", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 820, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6267", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-14T08:04:23.830Z", "date_published": "2026-07-29T19:01:16.040Z", "date_updated": "2026-07-31T16:10:45.590Z", "publisher": "GitLab", "title": "Insertion of Sensitive Information Into Sent Data in GitLab", "affected": { "vendors": [ "GitLab" ], "products": [ { "vendor": "GitLab", "product": "GitLab" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-201", "name": "Insertion of Sensitive Information Into Sent Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:cve@gitlab.com", "type": "Secondary", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 3.2, "epss": { "score": 0.00333, "percentile": 0.25841 }, "nvd": { "published": "2026-07-29T20:17:13.123", "lastModified": "2026-08-03T14:02:29.670", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-6267", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record says GitLab discloses protected data, but does not identify the output, cache, or memory path that exposes it.", "basis": [ "CNA", "NVD", "CWE-201" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/596606", "host": "gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Broken Link" ] }, { "url": "https://hackerone.com/reports/3658324", "host": "hackerone.com", "sources": [ "cna", "nvd" ], "tags": [ "Permissions Required", "exploit", "permissions-required", "technical-description" ] }, { "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/", "host": "docs.gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 331, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-6280", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-14T14:24:35.901Z", "date_published": "2026-07-08T08:45:18.361Z", "date_updated": "2026-07-08T12:09:27.160Z", "publisher": "TR-CERT", "title": "Improper Access Control in Nomysoft Informatics' Nomysem", "affected": { "vendors": [ "NOMYSOFT Informatics Education and Consulting Inc." ], "products": [ { "vendor": "NOMYSOFT Informatics Education and Consulting Inc.", "product": "Nomysem" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-213", "name": "Exposure of Sensitive Information Due to Incompatible Policies", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00227, "percentile": 0.13532 }, "nvd": { "published": "2026-07-08T09:16:34.403", "lastModified": "2026-07-08T14:57:28.893", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6280", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Nomysem applies incompatible access policies that leave sensitive functionality reachable outside the intended ACL.", "basis": [ "CNA", "CWE-213" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0516", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 341, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6283", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-14T15:03:55.739Z", "date_published": "2026-07-01T14:19:20.177Z", "date_updated": "2026-07-01T14:54:14.126Z", "publisher": "TR-CERT", "title": "Stored XSS in DivvyDrive Information Technologies' DivvyDrive", "affected": { "vendors": [ "DivvyDrive Information Technologies Inc." ], "products": [ { "vendor": "DivvyDrive Information Technologies Inc.", "product": "DivvyDrive" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00133, "percentile": 0.03234 }, "nvd": { "published": "2026-07-01T15:17:12.207", "lastModified": "2026-07-01T16:16:53.063", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6283", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The application renders attacker-controlled content into an HTML or JavaScript context without context-appropriate output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0475", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 238, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6336", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-15T09:04:52.019Z", "date_published": "2026-07-29T19:01:06.041Z", "date_updated": "2026-07-29T19:40:48.747Z", "publisher": "GitLab", "title": "Incorrect Authorization in GitLab", "affected": { "vendors": [ "GitLab" ], "products": [ { "vendor": "GitLab", "product": "GitLab" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:cve@gitlab.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00255, "percentile": 0.16997 }, "nvd": { "published": "2026-07-29T20:17:13.270", "lastModified": "2026-08-03T13:58:30.287", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-6336", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "GitLab returns project import source information without the authorization check required for the requesting user.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/596762", "host": "gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Broken Link" ] }, { "url": "https://hackerone.com/reports/3661988", "host": "hackerone.com", "sources": [ "cna", "nvd" ], "tags": [ "Permissions Required", "exploit", "permissions-required", "technical-description" ] }, { "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/", "host": "docs.gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 287, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-6352", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-15T13:03:48.044Z", "date_published": "2026-07-08T20:46:43.862Z", "date_updated": "2026-07-09T14:13:17.427Z", "publisher": "GitLab", "title": "Incorrect Authorization in GitLab", "affected": { "vendors": [ "GitLab" ], "products": [ { "vendor": "GitLab", "product": "GitLab" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 2.7, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:cve@gitlab.com", "type": "Secondary", "version": "3.1", "score": 2.7, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 2.7, "cvss_source_score_spread": 0, "epss": { "score": 0.00264, "percentile": 0.18148 }, "nvd": { "published": "2026-07-08T21:16:54.960", "lastModified": "2026-07-09T20:36:00.707", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-6352", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "GitLab permits an auditor-role user to execute a GraphQL mutation that should be outside the auditor's read-only authority.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/596789", "host": "gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Broken Link" ] }, { "url": "https://hackerone.com/reports/3631344", "host": "hackerone.com", "sources": [ "cna", "nvd" ], "tags": [ "Permissions Required", "exploit", "permissions-required", "technical-description" ] }, { "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/", "host": "docs.gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 332, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-6371", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-15T16:02:57.878Z", "date_published": "2026-07-08T11:51:47.325Z", "date_updated": "2026-07-20T11:41:40.392Z", "publisher": "TR-CERT", "title": "Stored XSS in Limatek's LimRAD NAC", "affected": { "vendors": [ "Limatek System Inc." ], "products": [ { "vendor": "Limatek System Inc.", "product": "LimRAD NAC" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00148, "percentile": 0.04544 }, "nvd": { "published": "2026-07-08T12:17:20.780", "lastModified": "2026-07-20T12:19:48.690", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6371", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "User-controlled content reaches LimRAD NAC page output without context-appropriate sanitization or escaping, so the browser interprets it as script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0517", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 201, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6382", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-15T17:44:55.095Z", "date_published": "2026-07-06T06:00:02.217Z", "date_updated": "2026-07-06T11:59:43.823Z", "publisher": "WPScan", "title": "Multiple elFinder Plugins - Authenticated OS Command Injection", "affected": { "vendors": [ "Unknown" ], "products": [ { "vendor": "Unknown", "product": "FileOrganizer" }, { "vendor": "Unknown", "product": "Advanced File Manager" }, { "vendor": "Unknown", "product": "File Manager Pro" }, { "vendor": "Unknown", "product": "File Manager" } ], "affectedBlockCount": 4, "versionEntryCount": 4, "versionRangeCount": 4, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00902, "percentile": 0.5627 }, "nvd": { "published": "2026-07-06T08:16:36.447", "lastModified": "2026-07-06T18:37:01.220", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6382", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An image parameter reaches a shell command without neutralizing command-substitution syntax.", "basis": [ "CNA", "CWE-94" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://wpscan.com/vulnerability/a27f70b7-a4cc-42fa-88c1-19adfe1593a8/", "host": "wpscan.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description", "vdb-entry" ] } ], "record_shape": { "descriptionChars": 484, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-6390", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-15T19:42:07.154Z", "date_published": "2026-07-23T03:55:42.246Z", "date_updated": "2026-07-23T13:43:29.133Z", "publisher": "redhat", "title": "Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.", "affected": { "vendors": [ "Red Hat" ], "products": [ { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9" }, { "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4" } ], "affectedBlockCount": 6, "versionEntryCount": 0, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-134", "name": "Use of Externally-Controlled Format String", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H" }, { "source": "NVD:secalert@redhat.com", "type": "Secondary", "version": "3.1", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H" } ], "max_cvss_observed_across_sources": 6.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00107, "percentile": 0.01337 }, "nvd": { "published": "2026-07-23T05:16:38.360", "lastModified": "2026-07-23T15:33:09.233", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6390", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Red Hat Enterprise Linux 10 error path reinterprets an attacker-controlled filename as a printf format string.", "basis": [ "CNA", "CWE-134" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2026-6390", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458767", "host": "bugzilla.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "x_refsource_REDHAT" ] } ], "record_shape": { "descriptionChars": 416, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 6, "affectedVersionEntryCount": 0 } }, { "cve_id": "CVE-2026-6423", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-16T08:03:11.185Z", "date_published": "2026-07-16T07:56:20.026Z", "date_updated": "2026-07-16T12:34:49.159Z", "publisher": "ESET", "title": "Local privilege escalation via unauthenticated ALPC in ESET Inspect Connector", "affected": { "vendors": [ "ESET, spol. s.r.o." ], "products": [ { "vendor": "ESET, spol. s.r.o.", "product": "ESET Inspect Connector" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-269", "name": "Improper Privilege Management", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:security@eset.com", "type": "Secondary", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00145, "percentile": 0.04196 }, "nvd": { "published": "2026-07-16T09:16:19.273", "lastModified": "2026-07-16T13:49:40.270", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6423", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ESET Inspect Connector accepts messages on a privileged ALPC channel without authenticating the local peer.", "basis": [ "CNA", "NVD", "CWE-269" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.eset.com/en/ca8970-eset-customer-advisory-local-privilege-escalation-via-unauthenticated-alpc-in-eset-inspect-connector-for-windows-fixed", "host": "support.eset.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 145, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6424", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-16T08:13:25.859Z", "date_published": "2026-07-16T08:28:43.649Z", "date_updated": "2026-07-16T12:17:48.734Z", "publisher": "ESET", "title": "Use-after-free vulnerability in ESET security products for Linux", "affected": { "vendors": [ "ESET, spol. s.r.o." ], "products": [ { "vendor": "ESET, spol. s.r.o.", "product": "ESET Endpoint Antivirus for Linux" }, { "vendor": "ESET, spol. s.r.o.", "product": "ESET Server Security for Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 10, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-416", "name": "Use After Free", "abstraction": "Variant", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.7, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:security@eset.com", "type": "Secondary", "version": "4.0", "score": 6.7, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 6.7, "cvss_source_score_spread": 0, "epss": { "score": 0.00112, "percentile": 0.01567 }, "nvd": { "published": "2026-07-16T09:16:19.403", "lastModified": "2026-07-16T13:49:40.270", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6424", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The ESET Linux component dereferences kernel memory after the associated object has been freed.", "basis": [ "CNA", "CWE-416" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.eset.com/en/ca8972-eset-customer-advisory-use-after-free-vulnerability-in-eset-security-products-for-linux-fixed", "host": "support.eset.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 121, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-6440", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-16T18:12:33.622Z", "date_published": "2026-07-10T07:48:44.122Z", "date_updated": "2026-07-10T17:01:30.572Z", "publisher": "Wordfence", "title": "GoodMeet <= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential'", "affected": { "vendors": [ "sovlix" ], "products": [ { "vendor": "sovlix", "product": "GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00158, "percentile": 0.05425 }, "nvd": { "published": "2026-07-10T09:16:53.820", "lastModified": "2026-07-10T17:17:03.997", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6440", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference accepts a state-changing browser request without validating an unforgeable anti-CSRF token or equivalent origin proof.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dc9e818d-811e-4732-9c74-8eb6753a1706?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/goodmeet/trunk/includes/Goodmeet_Ajax.php#L140", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/goodmeet/tags/1.1.6/includes/Goodmeet_Ajax.php#L140", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/goodmeet/trunk/includes/Goodmeet_Ajax.php#L38", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/goodmeet/tags/1.1.6/includes/Goodmeet_Ajax.php#L38", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/goodmeet/trunk/includes/Googlemeet/Goodmeet_Meet.php#L544", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/goodmeet/tags/1.1.6/includes/Googlemeet/Goodmeet_Meet.php#L544", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3525854%40goodmeet&new=3525854%40goodmeet", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 801, "referenceCount": 8, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6454", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-16T20:08:18.705Z", "date_published": "2026-07-24T02:31:58.797Z", "date_updated": "2026-07-24T12:22:43.270Z", "publisher": "Wordfence", "title": "Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute", "affected": { "vendors": [ "firelightwp" ], "products": [ { "vendor": "firelightwp", "product": "Firelight Lightbox" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00206, "percentile": 0.10764 }, "nvd": { "published": "2026-07-24T04:16:52.023", "lastModified": "2026-07-24T20:45:45.697", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6454", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled data reaches an HTML or DOM sink without context-appropriate sanitization and output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8396c124-9c72-4801-8964-1cd5fbd52d20?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/trunk/inc/fancybox-2.php#L322", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/trunk/fancybox/2.2.0/jquery.fancybox.js#L280", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/trunk/fancybox/2.2.0/jquery.fancybox.js#L1235", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/tags/2.3.18/inc/fancybox-2.php#L322", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/tags/2.3.18/fancybox/2.2.0/jquery.fancybox.js#L280", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-fancybox/tags/2.3.18/fancybox/2.2.0/jquery.fancybox.js#L1235", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3610643%40easy-fancybox&new=3610643%40easy-fancybox", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 720, "referenceCount": 8, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6459", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-16T23:08:24.493Z", "date_published": "2026-07-08T12:33:16.005Z", "date_updated": "2026-07-08T14:11:23.298Z", "publisher": "Wordfence", "title": "Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup", "affected": { "vendors": [ "wpdevteam" ], "products": [ { "vendor": "wpdevteam", "product": "Essential Addons for Elementor – Popular Elementor Templates & Widgets" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00181, "percentile": 0.0794 }, "nvd": { "published": "2026-07-08T13:16:57.380", "lastModified": "2026-07-08T15:16:32.627", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6459", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Event titles are stored and rendered by the Elementor calendar popup without sufficient input sanitization or output escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5b3214a5-7044-4005-a200-c969d4487be2?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://research.cleantalk.org/cve-2026-6459", "host": "research.cleantalk.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3519453/essential-addons-for-elementor-lite", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 513, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6509", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-17T11:33:53.261Z", "date_published": "2026-07-05T14:48:43.725Z", "date_updated": "2026-07-06T13:21:56.311Z", "publisher": "TR-CERT", "title": "Privilege Escalation in TUBITAK BILGEM's Pardus Update", "affected": { "vendors": [ "TUBITAK BILGEM Software Technologies Research Institute" ], "products": [ { "vendor": "TUBITAK BILGEM Software Technologies Research Institute", "product": "Pardus Update" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00101, "percentile": 0.01037 }, "nvd": { "published": "2026-07-05T15:16:57.687", "lastModified": "2026-07-06T18:16:45.163", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6509", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Pardus Update exposes a privilege-changing operation without the authorization check required for the caller, while the exact operation is not public.", "basis": [ "CNA", "NVD", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0501", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 199, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6511", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-17T13:03:29.141Z", "date_published": "2026-07-16T16:48:30.481Z", "date_updated": "2026-07-16T17:59:36.981Z", "publisher": "lenovo", "title": "During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a local authenticated user to access files owned by a different user on the sam...", "affected": { "vendors": [ "Lenovo" ], "products": [ { "vendor": "Lenovo", "product": "Smart Connect" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:psirt@lenovo.com", "type": "Secondary", "version": "4.0", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:psirt@lenovo.com", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.8, "cvss_source_score_spread": 1.2999999999999998, "epss": { "score": 0.00094, "percentile": 0.00715 }, "nvd": { "published": "2026-07-16T17:16:58.970", "lastModified": "2026-07-16T19:16:51.217", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6511", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A local user can select and access files belonging to another user because the file operation is not bound to the requesting identity.", "basis": [ "CNA", "CWE-306" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.lenovo.com/us/en/product_security/LEN-218281", "host": "support.lenovo.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.lenovo.com/us/en/software/smart-connect", "host": "www.lenovo.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 246, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6516", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-17T13:48:22.236Z", "date_published": "2026-07-23T17:22:26.627Z", "date_updated": "2026-07-24T03:56:26.762Z", "publisher": "Zohocorp", "title": "Remote Code Execution", "affected": { "vendors": [ "Zohocorp" ], "products": [ { "vendor": "Zohocorp", "product": "ManageEngine ADAudit Plus" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 10, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L" }, { "source": "NVD:0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary", "version": "3.1", "score": 10, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L" } ], "max_cvss_observed_across_sources": 10, "cvss_source_score_spread": 0, "epss": { "score": 0.04729, "percentile": 0.90958 }, "nvd": { "published": "2026-07-23T18:17:02.570", "lastModified": "2026-07-24T05:16:50.033", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6516", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "ManageEngine attributes the unauthenticated RCE to a combined Agent API authentication bypass and path traversal while the CVE record maps command injection, so the primary defect is not publicly separable.", "basis": [ "CNA", "CWE-78", "ManageEngine advisory" ], "deepDive": true, "notes": "Read https://www.manageengine.com/products/active-directory-audit/cve-2026-6516.html; the vendor says Agent API authentication bypass and path traversal must be combined, while the embedded record assigns CWE-78, so no single primary defect or patch path is public." }, "references": [ { "url": "https://www.manageengine.com/products/active-directory-audit/cve-2026-6516.html", "host": "www.manageengine.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 142, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6540", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-17T17:41:32.750Z", "date_published": "2026-07-30T14:45:04.068Z", "date_updated": "2026-07-30T16:12:07.691Z", "publisher": "Tigera", "title": "L7 policy bypass via unnormalized HTTP path matching", "affected": { "vendors": [ "Tigera" ], "products": [ { "vendor": "Tigera", "product": "Calico" }, { "vendor": "Tigera", "product": "Calico Enterprise" }, { "vendor": "Tigera", "product": "Calico Cloud" } ], "affectedBlockCount": 3, "versionEntryCount": 4, "versionRangeCount": 4, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-23", "name": "Relative Path Traversal", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.9, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L" }, { "source": "NVD:psirt@tigera.io", "type": "Secondary", "version": "4.0", "score": 7.9, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 7.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00368, "percentile": 0.29518 }, "nvd": { "published": "2026-07-30T15:16:37.533", "lastModified": "2026-07-30T17:16:34.467", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6540", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Calico authorizes an unnormalized HTTP path while the downstream service normalizes traversal, encoded slashes, or repeated slashes to a restricted endpoint.", "basis": [ "CNA", "CWE-22", "CWE-23" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/projectcalico/calico/pull/12531", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://github.com/projectcalico/calico/pull/12532", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://github.com/projectcalico/calico/pull/12533", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.tigera.io/security-bulletins/tta-2026-005/", "host": "www.tigera.io", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 577, "referenceCount": 4, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-6541", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-17T17:54:44.831Z", "date_published": "2026-07-13T10:53:15.958Z", "date_updated": "2026-07-13T13:09:10.482Z", "publisher": "Mattermost", "title": "Unscoped updates to other playbooks' metric configuration", "affected": { "vendors": [ "Mattermost" ], "products": [ { "vendor": "Mattermost", "product": "Mattermost" } ], "affectedBlockCount": 1, "versionEntryCount": 7, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:responsibledisclosure@mattermost.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00152, "percentile": 0.04906 }, "nvd": { "published": "2026-07-13T11:16:28.080", "lastModified": "2026-07-13T20:39:12.303", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-6541", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The request accepts an object or tenant identifier without binding that identifier to the authenticated caller's authorized scope.", "basis": [ "CNA record", "NVD", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://mattermost.com/security-updates", "host": "mattermost.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 356, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-6656", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-20T08:08:16.230Z", "date_published": "2026-07-20T07:01:45.818Z", "date_updated": "2026-07-20T18:38:21.362Z", "publisher": "CPANSec", "title": "Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks", "affected": { "vendors": [ "DRSTEVE" ], "products": [ { "vendor": "DRSTEVE", "product": "Crypt::Password" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-208", "name": "Observable Timing Discrepancy", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00317, "percentile": 0.24073 }, "nvd": { "published": "2026-07-20T07:16:42.440", "lastModified": "2026-07-20T19:17:30.503", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6656", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Crypt::Password compares password hashes with the ordinary eq operator, whose data-dependent timing can reveal matching prefixes.", "basis": [ "CNA", "CWE-208" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/DRSTEVE/Crypt-Password-0.28/source/lib/Crypt/Password.pm#L190-193", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://rt.cpan.org/Ticket/Display.html?id=180162", "host": "rt.cpan.org", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/20/4", "host": "www.openwall.com", "sources": [ "adp:1", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 216, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6682", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-20T15:06:18.243Z", "date_published": "2026-07-01T13:36:59.935Z", "date_updated": "2026-07-01T15:24:05.860Z", "publisher": "runZero", "title": "FatFs Integer Overflow in FAT32 Volume Mount", "affected": { "vendors": [ "ChaN" ], "products": [ { "vendor": "ChaN", "product": "FatFs" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-190", "name": "Integer Overflow or Wraparound", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:44488dab-36db-4358-99f9-bc116477f914", "type": "Secondary", "version": "3.1", "score": 7.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00428, "percentile": 0.35201 }, "nvd": { "published": "2026-07-01T15:17:12.313", "lastModified": "2026-07-02T14:37:48.377", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-6682", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "mount_volume multiplies the FAT size by the FAT count without overflow checking and downstream code trusts the wrapped size metadata.", "basis": [ "CNA", "CWE-190" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.runzero.com/blog/fatfs-bugs/", "host": "www.runzero.com", "sources": [ "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "third-party-advisory" ] }, { "url": "https://github.com/runZeroInc/vulns-2026-fatfs-chance", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "exploit", "technical-description" ] }, { "url": "https://elm-chan.org/fsw/ff/", "host": "elm-chan.org", "sources": [ "cna", "nvd" ], "tags": [ "Product", "product" ] }, { "url": "https://www.runzero.com/advisories/fatfs-fat32-int-of-mnt-cve-2026-6682/", "host": "www.runzero.com", "sources": [ "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 495, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6683", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-20T15:06:19.048Z", "date_published": "2026-07-01T13:41:11.337Z", "date_updated": "2026-07-01T15:24:56.449Z", "publisher": "runZero", "title": "FatFs Divide-by-Zero in exFAT Sync", "affected": { "vendors": [ "ChaN" ], "products": [ { "vendor": "ChaN", "product": "FatFs" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-369", "name": "Divide By Zero", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:44488dab-36db-4358-99f9-bc116477f914", "type": "Secondary", "version": "3.1", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 4.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00429, "percentile": 0.35328 }, "nvd": { "published": "2026-07-01T15:17:12.443", "lastModified": "2026-07-02T14:38:07.643", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-6683", "family": "OTHER_SPECIFIC", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Crafted exFAT metadata makes n_fatent minus two equal zero and the sync path divides by that value.", "basis": [ "CNA", "CWE-369" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.runzero.com/blog/fatfs-bugs/", "host": "www.runzero.com", "sources": [ "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "third-party-advisory" ] }, { "url": "https://github.com/runZeroInc/vulns-2026-fatfs-chance", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "exploit", "technical-description" ] }, { "url": "https://elm-chan.org/fsw/ff/", "host": "elm-chan.org", "sources": [ "cna", "nvd" ], "tags": [ "Product", "product" ] }, { "url": "https://www.runzero.com/advisories/fatfs-exfat-divide-by-zero-cve-2026-6683", "host": "www.runzero.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 436, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6684", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-20T15:06:20.061Z", "date_published": "2026-07-01T13:45:03.639Z", "date_updated": "2026-07-01T15:25:53.071Z", "publisher": "runZero", "title": "FatFs Infinite Loop in GPT Partition Scan", "affected": { "vendors": [ "ChaN" ], "products": [ { "vendor": "ChaN", "product": "FatFs" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:44488dab-36db-4358-99f9-bc116477f914", "type": "Secondary", "version": "3.1", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 4.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00429, "percentile": 0.35328 }, "nvd": { "published": "2026-07-01T15:17:12.553", "lastModified": "2026-07-02T14:38:25.923", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-6684", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "FatFs trusts the GPT partition count as an unbounded loop limit during mount-time scanning.", "basis": [ "CNA", "CWE-835" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.runzero.com/blog/fatfs-bugs/", "host": "www.runzero.com", "sources": [ "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "third-party-advisory" ] }, { "url": "https://github.com/runZeroInc/vulns-2026-fatfs-chance", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "exploit", "technical-description" ] }, { "url": "https://elm-chan.org/fsw/ff/", "host": "elm-chan.org", "sources": [ "cna", "nvd" ], "tags": [ "Product", "product" ] }, { "url": "https://www.runzero.com/advisories/fatfs-gpt-scan-loop-dos-cve-2026-6684/", "host": "www.runzero.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 449, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6685", "id_year": 2026, "state": "REJECTED", "date_reserved": "2026-04-20T15:06:21.250Z", "date_published": "2026-07-01T13:47:25.764Z", "date_rejected": "2026-07-16T20:11:12.305Z", "date_updated": "2026-07-16T20:11:12.305Z", "publisher": "runZero", "title": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority following a notification that the vulnerability determination was made in error.", "rejected_reason": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority following a notification that the vulnerability determination was made in error. After review, the CNA confirmed the erroneous finding. Thanks to David Brown for reaching out about this issue." }, { "cve_id": "CVE-2026-6686", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-20T15:06:22.242Z", "date_published": "2026-07-01T13:55:09.072Z", "date_updated": "2026-07-01T15:05:27.926Z", "publisher": "runZero", "title": "FatFs Use of Uninitialized Clusters After Seek Past EOF", "affected": { "vendors": [ "ChaN" ], "products": [ { "vendor": "ChaN", "product": "FatFs" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-908", "name": "Use of Uninitialized Resource", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:44488dab-36db-4358-99f9-bc116477f914", "type": "Secondary", "version": "3.1", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00378, "percentile": 0.30507 }, "nvd": { "published": "2026-07-01T15:17:12.763", "lastModified": "2026-07-02T14:38:35.823", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-6686", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "f_lseek allocates clusters beyond end of file without initializing them before their previous contents can be read.", "basis": [ "CNA", "CWE-908" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.runzero.com/blog/fatfs-bugs/", "host": "www.runzero.com", "sources": [ "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "third-party-advisory" ] }, { "url": "https://github.com/runZeroInc/vulns-2026-fatfs-chance", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "exploit", "technical-description" ] }, { "url": "https://elm-chan.org/fsw/ff/", "host": "elm-chan.org", "sources": [ "cna", "nvd" ], "tags": [ "Product", "product" ] }, { "url": "https://www.runzero.com/advisories/fatfs-uninit-cluster-exposure-cve-2026-6686/", "host": "www.runzero.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 377, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6687", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-20T15:06:23.356Z", "date_published": "2026-07-01T13:57:54.242Z", "date_updated": "2026-07-01T15:06:24.705Z", "publisher": "runZero", "title": "FatFs Stack Buffer Overflow via Uncapped exFAT Label Length", "affected": { "vendors": [ "ChaN" ], "products": [ { "vendor": "ChaN", "product": "FatFs" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-121", "name": "Stack-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:44488dab-36db-4358-99f9-bc116477f914", "type": "Secondary", "version": "3.1", "score": 7.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00458, "percentile": 0.37478 }, "nvd": { "published": "2026-07-01T15:17:12.870", "lastModified": "2026-07-02T14:38:40.173", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-6687", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "FatFs trusts the exFAT XDIR_NumLabel value without enforcing the specification maximum before copying the label into a stack buffer.", "basis": [ "CNA", "NVD", "CWE-121" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.runzero.com/blog/fatfs-bugs/", "host": "www.runzero.com", "sources": [ "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "third-party-advisory" ] }, { "url": "https://github.com/runZeroInc/vulns-2026-fatfs-chance", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "exploit", "technical-description" ] }, { "url": "https://elm-chan.org/fsw/ff/", "host": "elm-chan.org", "sources": [ "cna", "nvd" ], "tags": [ "Product", "product" ] }, { "url": "https://www.runzero.com/advisories/fatfs-exfat-label-len-of-cve-2026-6687/", "host": "www.runzero.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 374, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6688", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-20T15:06:24.308Z", "date_published": "2026-07-01T14:01:04.915Z", "date_updated": "2026-07-01T15:06:59.026Z", "publisher": "runZero", "title": "FatFs Buffer Overflow via Unbounded LFN Filename Copy", "affected": { "vendors": [ "ChaN" ], "products": [ { "vendor": "ChaN", "product": "FatFs" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:44488dab-36db-4358-99f9-bc116477f914", "type": "Secondary", "version": "3.1", "score": 7.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00428, "percentile": 0.35205 }, "nvd": { "published": "2026-07-01T15:17:13.013", "lastModified": "2026-07-02T14:38:46.120", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-6688", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "medium", "mechanism": "Downstream callers copy FatFs long filenames of up to 255 characters into shorter fixed buffers without length checks.", "basis": [ "CNA", "NVD", "CWE-120" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.runzero.com/blog/fatfs-bugs/", "host": "www.runzero.com", "sources": [ "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "third-party-advisory" ] }, { "url": "https://github.com/runZeroInc/vulns-2026-fatfs-chance", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "Exploit", "Third Party Advisory", "exploit", "technical-description" ] }, { "url": "https://elm-chan.org/fsw/ff/", "host": "elm-chan.org", "sources": [ "cna", "nvd" ], "tags": [ "Product", "product" ] }, { "url": "https://www.runzero.com/advisories/fatfs-long-fn-of-downstream-cve-2026-6688/", "host": "www.runzero.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 497, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6740", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-21T10:38:52.931Z", "date_published": "2026-07-08T12:33:17.582Z", "date_updated": "2026-07-08T17:09:09.937Z", "publisher": "Wordfence", "title": "Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute", "affected": { "vendors": [ "posimyththemes" ], "products": [ { "vendor": "posimyththemes", "product": "Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00152, "percentile": 0.04826 }, "nvd": { "published": "2026-07-08T13:16:57.653", "lastModified": "2026-07-08T18:16:35.223", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6740", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Nexter Blocks stores the commentIcon value and later renders it as active browser markup without sufficient sanitization and escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f5184598-b0bd-4026-971c-da36d79497df?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3512686/the-plus-addons-for-block-editor/trunk/classes/blocks/tp-post-meta/index.php", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 468, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6742", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-21T11:31:23.394Z", "date_published": "2026-07-08T11:35:40.140Z", "date_updated": "2026-07-08T13:23:29.515Z", "publisher": "Wordfence", "title": "Advanced iFrame <= 2026.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute", "affected": { "vendors": [ "mdempfle" ], "products": [ { "vendor": "mdempfle", "product": "Advanced iFrame" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00152, "percentile": 0.04825 }, "nvd": { "published": "2026-07-08T12:17:20.893", "lastModified": "2026-07-08T14:55:07.843", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6742", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in all versions up to, and including, 2026.1 due to insufficient input sanitization and output escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9c4ca8-e5cd-4c4f-8d81-b06367c89fd7?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3558422/advanced-iframe", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 416, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6790", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-21T13:47:52.520Z", "date_published": "2026-07-14T08:51:30.527Z", "date_updated": "2026-07-14T12:20:35.130Z", "publisher": "eclipse", "title": "In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).", "affected": { "vendors": [ "Eclipse Foundation" ], "products": [ { "vendor": "Eclipse Foundation", "product": "Eclipse Jetty" } ], "affectedBlockCount": 1, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-20", "name": "Improper Input Validation", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:emo@eclipse.org", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00196, "percentile": 0.09598 }, "nvd": { "published": "2026-07-14T09:16:41.930", "lastModified": "2026-07-14T18:35:54.793", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-6790", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Jetty accepts a request whose authority host and port disagree with the Host header, allowing downstream routing and URL construction to trust different destinations.", "basis": [ "CNA", "CWE-20" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99", "host": "gitlab.eclipse.org", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 783, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-6792", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-21T13:50:29.886Z", "date_published": "2026-07-21T12:36:49.487Z", "date_updated": "2026-07-28T11:35:07.021Z", "publisher": "TR-CERT", "title": "Improper Authorization in Universal Sotware's FlexCity", "affected": { "vendors": [ "Universal Software Inc." ], "products": [ { "vendor": "Universal Software Inc.", "product": "FlexCity" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00201, "percentile": 0.10142 }, "nvd": { "published": "2026-07-21T13:17:19.043", "lastModified": "2026-07-28T12:16:37.037", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6792", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The FlexCity operation does not enforce the authentication, role, ownership, or scope check required before the protected action.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0593", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 203, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6793", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-21T13:55:23.785Z", "date_published": "2026-07-20T15:25:47.546Z", "date_updated": "2026-07-20T18:22:48.613Z", "publisher": "TR-CERT", "title": "Stored XSS in Bifra Engineering's Q-smart NexT Poll", "affected": { "vendors": [ "Bifra Engineering Consulting Ltd." ], "products": [ { "vendor": "Bifra Engineering Consulting Ltd.", "product": "Q-smart NexT Poll" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:iletisim@usom.gov.tr", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00162, "percentile": 0.05827 }, "nvd": { "published": "2026-07-20T16:17:07.270", "lastModified": "2026-07-20T19:17:30.660", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6793", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Q-smart NexT Poll stores attacker input and later renders it without sufficient browser-context escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0583", "host": "siberguvenlik.gov.tr", "sources": [ "cna", "nvd" ], "tags": [ "government-resource" ] } ], "record_shape": { "descriptionChars": 225, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6801", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-21T14:48:11.329Z", "date_published": "2026-07-11T05:35:46.896Z", "date_updated": "2026-07-13T14:39:42.665Z", "publisher": "Wordfence", "title": "Context Blog <= 1.3.5 - Unauthenticated Sensitive Information Exposure via 'postID' Parameter", "affected": { "vendors": [ "postmagthemes" ], "products": [ { "vendor": "postmagthemes", "product": "Context Blog" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00239, "percentile": 0.15102 }, "nvd": { "published": "2026-07-11T07:16:46.650", "lastModified": "2026-07-13T16:59:13.647", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6801", "family": "EXPOSURE_OUTPUT", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The modal endpoint returns the body of a password-protected post to an unauthenticated caller without enforcing the post password.", "basis": [ "CNA", "CWE-200" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30f5eecd-3135-45a1-97d2-05fcbbca9e5f?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://themes.trac.wordpress.org/changeset?reponame=&old=329636%40context-blog&new=329636%40context-blog", "host": "themes.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 267, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6802", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-21T14:52:47.934Z", "date_published": "2026-07-10T07:48:42.690Z", "date_updated": "2026-07-10T11:05:09.160Z", "publisher": "Wordfence", "title": "Easy Upload Files During Checkout <= 3.0.1 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'eufdc-delete' Parameter", "affected": { "vendors": [ "fahadmahmood" ], "products": [ { "vendor": "fahadmahmood", "product": "Easy Upload Files During Checkout" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00243, "percentile": 0.15609 }, "nvd": { "published": "2026-07-10T09:16:53.973", "lastModified": "2026-07-10T15:43:30.330", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6802", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Easy Upload Files During Checkout fails to enforce the required capability, object ownership, tenant, role, or scope check at the affected operation, allowing a caller outside that authority boundary to invoke it.", "basis": [ "CNA", "NVD", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5727bc4e-ee92-4913-bc8f-3d002488b383?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-upload-files-during-checkout/trunk/inc/functions.php#L587", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-upload-files-during-checkout/tags/3.0.1/inc/functions.php#L587", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-upload-files-during-checkout/trunk/inc/functions.php#L561", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-upload-files-during-checkout/tags/3.0.1/inc/functions.php#L561", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-upload-files-during-checkout/trunk/inc/functions.php#L195", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/easy-upload-files-during-checkout/tags/3.0.1/inc/functions.php#L195", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3522887%40easy-upload-files-during-checkout&new=3522887%40easy-upload-files-during-checkout", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 487, "referenceCount": 8, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6803", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-21T14:58:51.803Z", "date_published": "2026-07-11T03:44:21.402Z", "date_updated": "2026-07-15T13:51:56.395Z", "publisher": "Wordfence", "title": "AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via AJAX Actions 'removeGroup' and 'clear'", "affected": { "vendors": [ "wupsales" ], "products": [ { "vendor": "wupsales", "product": "AI Copilot – Content Generator" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00325, "percentile": 0.25 }, "nvd": { "published": "2026-07-11T05:16:34.430", "lastModified": "2026-07-15T14:18:35.247", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6803", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The removeGroup and clear AJAX actions have no capability or nonce requirement and are also registered for unauthenticated callers.", "basis": [ "CNA", "NVD", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/080740e3-ca04-48b4-8b34-64f5e42b1185?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/controller.php#L133", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/controller.php#L133", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/controller.php#L142", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/controller.php#L142", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/frame.php#L283", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/frame.php#L283", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/controller.php#L112", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/controller.php#L112", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/model.php#L173", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/model.php#L173", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3582369%40ai-copilot-content-generator&new=3582369%40ai-copilot-content-generator", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 672, "referenceCount": 12, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6804", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-21T14:59:43.137Z", "date_published": "2026-07-11T03:44:25.168Z", "date_updated": "2026-07-14T14:25:22.248Z", "publisher": "Wordfence", "title": "AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX Actions", "affected": { "vendors": [ "wupsales" ], "products": [ { "vendor": "wupsales", "product": "AI Copilot – Content Generator" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00354, "percentile": 0.28097 }, "nvd": { "published": "2026-07-11T05:16:34.553", "lastModified": "2026-07-14T15:17:10.410", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6804", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The publishTasks and unpublishTasks AJAX actions accept arbitrary scenario IDs without authorization, allowing an anonymous caller to publish drafts or unpublish live posts.", "basis": [ "CNA", "NVD", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d8ea0b-3c54-4d9d-8f14-2055510f3119?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php#L141", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php#L141", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php#L130", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php#L130", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/classes/frame.php#L283", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/classes/frame.php#L283", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/trunk/modules/workspace/controller.php#L9", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/ai-copilot-content-generator/tags/1.4.6/modules/workspace/controller.php#L9", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3582369%40ai-copilot-content-generator&new=3582369%40ai-copilot-content-generator", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 455, "referenceCount": 10, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6818", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-21T19:21:28.769Z", "date_published": "2026-07-08T11:30:31.756Z", "date_updated": "2026-07-08T17:09:59.950Z", "publisher": "Wordfence", "title": "VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter", "affected": { "vendors": [ "e4jvikwp" ], "products": [ { "vendor": "e4jvikwp", "product": "VikBooking Hotel Booking Engine & PMS" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 7.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00236, "percentile": 0.14721 }, "nvd": { "published": "2026-07-08T12:17:21.017", "lastModified": "2026-07-08T18:16:35.323", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6818", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The application stores the special_requests field and renders it into HTML without the required output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/13a96e78-c83c-4ff1-a751-3dbaeb683d9d?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.9/admin/helpers/widgets/booking_details.php#L684", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.9/admin/views/editorder/tmpl/default.php#L2717", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.9/admin/views/orders/tmpl/default.php#L769", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 403, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6820", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-21T19:25:58.842Z", "date_published": "2026-07-08T12:33:17.186Z", "date_updated": "2026-07-08T13:10:51.411Z", "publisher": "Wordfence", "title": "VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field", "affected": { "vendors": [ "e4jvikwp" ], "products": [ { "vendor": "e4jvikwp", "product": "VikBooking Hotel Booking Engine & PMS" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 7.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00229, "percentile": 0.13743 }, "nvd": { "published": "2026-07-08T13:16:57.780", "lastModified": "2026-07-08T14:55:07.843", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6820", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "VikBooking stores the booking email field and later emits it as active page markup without sufficient sanitization or escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b4586a-f87d-4a51-8f4e-932d7254518e?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.9/site/controller.php#L307", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/browser/vikbooking/tags/1.8.9/admin/controller.php#L11208", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 392, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6847", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-22T08:08:03.689Z", "date_published": "2026-07-13T13:26:20.946Z", "date_updated": "2026-07-14T14:32:08.791Z", "publisher": "CERT-PL", "title": "Unauthenticated Remote Code Execution in ThemisNETPanel", "affected": { "vendors": [ "4real" ], "products": [ { "vendor": "4real", "product": "ThemisNETPanel" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L" }, { "source": "NVD:cvd@cert.pl", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00584, "percentile": 0.44605 }, "nvd": { "published": "2026-07-13T14:16:32.963", "lastModified": "2026-07-14T15:17:10.527", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6847", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "ThemisNETPanel exposes a critical file-upload function without requiring authentication.", "basis": [ "CNA", "CWE-306" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://cert.pl/posts/2026/07/CVE-2026-6847/", "host": "cert.pl", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 386, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6850", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-22T10:05:15.625Z", "date_published": "2026-07-13T08:13:02.883Z", "date_updated": "2026-07-13T13:56:16.767Z", "publisher": "Mattermost", "title": "Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost", "affected": { "vendors": [ "Mattermost" ], "products": [ { "vendor": "Mattermost", "product": "Mattermost" } ], "affectedBlockCount": 1, "versionEntryCount": 7, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:responsibledisclosure@mattermost.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0024, "percentile": 0.15212 }, "nvd": { "published": "2026-07-13T09:16:24.890", "lastModified": "2026-07-13T21:42:01.650", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-6850", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticated attacker to cause a denial of service for all users in a channel via a post containing a specially crafted payload that triggers catastrophic backtracking in the client-side markdown parser.", "basis": [ "CNA", "CWE-1333" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://mattermost.com/security-updates", "host": "mattermost.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 413, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-6851", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-22T10:06:58.221Z", "date_published": "2026-07-14T07:11:50.520Z", "date_updated": "2026-07-15T04:00:51.554Z", "publisher": "Bitdefender", "title": "Improper link resolution before file access in Bitdefender Total Security via Link Following (VA-13681)", "affected": { "vendors": [ "Bitdefender" ], "products": [ { "vendor": "Bitdefender", "product": "Total Security" }, { "vendor": "Bitdefender", "product": "Internet Security" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:cve-requests@bitdefender.com", "type": "Secondary", "version": "4.0", "score": 7, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 7, "cvss_source_score_spread": 0, "epss": { "score": 0.00121, "percentile": 0.02256 }, "nvd": { "published": "2026-07-14T08:16:24.000", "lastModified": "2026-07-15T05:17:25.330", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6851", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "File Shredder follows an attacker-controlled symbolic link during a race and selects a privileged file outside the caller's namespace.", "basis": [ "CNA", "CWE-59" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.bitdefender.com/support/security-advisories/improper-link-resolution-before-file-access-via-link-following-va-13681", "host": "www.bitdefender.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 379, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-6854", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-22T12:19:28.322Z", "date_published": "2026-07-08T11:30:33.597Z", "date_updated": "2026-07-08T13:14:04.081Z", "publisher": "Wordfence", "title": "My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters", "affected": { "vendors": [ "joedolson" ], "products": [ { "vendor": "joedolson", "product": "My Calendar – Accessible Event Manager" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00273, "percentile": 0.19422 }, "nvd": { "published": "2026-07-08T12:17:21.137", "lastModified": "2026-07-08T14:55:07.843", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6854", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled input reaches an SQL statement without separation from SQL grammar.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa1ed81c-04cb-4ccd-8c30-b1d943730909?source=cve", "host": "www.wordfence.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://plugins.trac.wordpress.org/changeset/3515996/my-calendar", "host": "plugins.trac.wordpress.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 490, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6875", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-22T18:21:24.368Z", "date_published": "2026-07-13T18:17:27.508Z", "date_updated": "2026-07-14T03:55:45.828Z", "publisher": "SN", "title": "Sandbox Escape in ServiceNow AI Platform", "affected": { "vendors": [ "ServiceNow" ], "products": [ { "vendor": "ServiceNow", "product": "ServiceNow AI Platform" } ], "affectedBlockCount": 1, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.5, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "NVD:psirt@servicenow.com", "type": "Secondary", "version": "4.0", "score": 9.5, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.5, "cvss_source_score_spread": 0, "epss": { "score": 0.24489, "percentile": 0.97656 }, "nvd": { "published": "2026-07-13T19:17:36.440", "lastModified": "2026-07-14T05:16:19.730", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6875", "family": "INTERPRETER_BOUNDARY", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The AI platform lets unauthenticated script input escape its server-side execution sandbox, but ServiceNow does not publish the failing containment check.", "basis": [ "CNA", "CWE-94", "ServiceNow KB3137947", "ServiceNow script-sandbox documentation" ], "deepDive": true, "notes": "Primary-source deep dive: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947 and https://www.servicenow.com/docs/r/xanadu/platform-security/r_ScriptSandboxing.html ; ServiceNow labels this a sandbox escape and documents server-side script sandboxing, but the advisory does not publish the failing check or fixed source." }, "references": [ { "url": "https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947", "host": "support.servicenow.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 815, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-6879", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-22T18:26:56.743Z", "date_published": "2026-07-28T13:46:30.650Z", "date_updated": "2026-07-30T17:31:30.941Z", "publisher": "PSF", "title": "Quadratic Behavior in xml.etree.ElementPath Index Predicates", "affected": { "vendors": [ "Python Software Foundation" ], "products": [ { "vendor": "Python Software Foundation", "product": "CPython" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-407", "name": "Inefficient Algorithmic Complexity", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 2, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:cna@python.org", "type": "Secondary", "version": "4.0", "score": 2, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 2, "cvss_source_score_spread": 0, "epss": { "score": 0.00293, "percentile": 0.21532 }, "nvd": { "published": "2026-07-28T15:17:51.377", "lastModified": "2026-07-30T19:18:37.220", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6879", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ElementPath index predicates repeatedly scan same-tag siblings, making findall and fully consumed iterfind perform quadratic work.", "basis": [ "CNA", "NVD", "CWE-407" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/python/cpython/pull/152676", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://github.com/python/cpython/issues/152674", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/7YMZ6DDZVR26TJJBVO3RDNBAVGHNYAKR/", "host": "mail.python.org", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://github.com/python/cpython/commit/2ffab083782968a4d732738f4f1dff6bbd69d2b0", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://github.com/python/cpython/commit/02c08e6b747ac43d0d866a4ffa916bedf3423f81", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://github.com/python/cpython/commit/390337b8ba1658833fdef379e1739c9f9533a8db", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://github.com/python/cpython/commit/cb409342a19f25656f62e679f8bac265fe1442c3", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] } ], "record_shape": { "descriptionChars": 397, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6881", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-22T18:56:43.654Z", "date_published": "2026-07-28T20:03:11.667Z", "date_updated": "2026-07-29T13:43:54.334Z", "publisher": "SRA", "title": "Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance", "affected": { "vendors": [ "Ellucian" ], "products": [ { "vendor": "Ellucian", "product": "Advance Web" }, { "vendor": "Ellucian", "product": "Legacy Advance" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L" }, { "source": "NVD:57dba5dd-1a03-47f6-8b36-e84e47d335d8", "type": "Secondary", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00203, "percentile": 0.10483 }, "nvd": { "published": "2026-07-28T21:17:29.427", "lastModified": "2026-07-29T14:16:35.623", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6881", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Advance Web data path incorporates attacker-controlled text into a database query without parameter binding.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://labs.sra.io/posts/ellucian", "host": "labs.sra.io", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 346, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-6889", "id_year": 2026, "state": "REJECTED", "date_reserved": "2026-04-23T02:58:22.972Z", "date_published": "2026-07-31T02:27:18.801Z", "date_rejected": "2026-07-31T05:07:37.432Z", "date_updated": "2026-07-31T05:07:37.432Z", "publisher": "CSA", "title": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "rejected_reason": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority." }, { "cve_id": "CVE-2026-6890", "id_year": 2026, "state": "REJECTED", "date_reserved": "2026-04-23T02:58:23.248Z", "date_published": "2026-07-31T02:27:25.893Z", "date_rejected": "2026-07-31T05:09:14.254Z", "date_updated": "2026-07-31T05:09:14.254Z", "publisher": "CSA", "title": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "rejected_reason": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority." }, { "cve_id": "CVE-2026-6896", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-23T05:33:12.333Z", "date_published": "2026-07-08T20:46:38.858Z", "date_updated": "2026-07-09T14:13:51.367Z", "publisher": "GitLab", "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab", "affected": { "vendors": [ "GitLab" ], "products": [ { "vendor": "GitLab", "product": "GitLab" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.7, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "source": "NVD:cve@gitlab.com", "type": "Secondary", "version": "3.1", "score": 8.7, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 3.299999999999999, "epss": { "score": 0.00389, "percentile": 0.31632 }, "nvd": { "published": "2026-07-08T21:16:55.097", "lastModified": "2026-07-09T20:38:26.077", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-6896", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Developer-controlled content is insufficiently sanitized before another user's browser interprets it as script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/597887", "host": "gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Broken Link" ] }, { "url": "https://hackerone.com/reports/3682085", "host": "hackerone.com", "sources": [ "cna", "nvd" ], "tags": [ "Permissions Required", "exploit", "permissions-required", "technical-description" ] }, { "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-2-released/", "host": "docs.gitlab.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 355, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-6900", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-23T08:25:59.674Z", "date_published": "2026-07-06T09:53:41.770Z", "date_updated": "2026-07-06T18:49:35.645Z", "publisher": "ABB", "title": "Improper Certificate Validation", "affected": { "vendors": [ "B&R Industrial Automation GmbH" ], "products": [ { "vendor": "B&R Industrial Automation GmbH", "product": "APROL" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-295", "name": "Improper Certificate Validation", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "source": "cna", "version": "4.0", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:cybersecurity@ch.abb.com", "type": "Secondary", "version": "4.0", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:cybersecurity@ch.abb.com", "type": "Secondary", "version": "3.1", "score": 7.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 1.6999999999999993, "epss": { "score": 0.00142, "percentile": 0.04019 }, "nvd": { "published": "2026-07-06T11:16:31.297", "lastModified": "2026-07-06T19:35:23.593", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6900", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The APROL secure-channel path does not correctly validate the peer certificate before trusting the connection.", "basis": [ "CNA", "CWE-295" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://br-cws-assets.de-fra-1.linodeobjects.com/SA26P011-661853b7.pdf", "host": "br-cws-assets.de-fra-1.linodeobjects.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 132, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6901", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-23T08:26:08.011Z", "date_published": "2026-07-06T10:01:51.893Z", "date_updated": "2026-07-06T11:06:28.326Z", "publisher": "ABB", "title": "Untrusted Search Path", "affected": { "vendors": [ "B&R Industrial Automation GmbH" ], "products": [ { "vendor": "B&R Industrial Automation GmbH", "product": "APROL" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-426", "name": "Untrusted Search Path", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "source": "cna", "version": "4.0", "score": 8.4, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:cybersecurity@ch.abb.com", "type": "Secondary", "version": "4.0", "score": 8.4, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:cybersecurity@ch.abb.com", "type": "Secondary", "version": "3.1", "score": 7.7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0.7000000000000002, "epss": { "score": 0.0012, "percentile": 0.02148 }, "nvd": { "published": "2026-07-06T11:16:31.433", "lastModified": "2026-07-06T19:35:23.593", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6901", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "APROL searches an untrusted path when resolving executable or library dependencies.", "basis": [ "CNA", "CWE-426" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://br-cws-assets.de-fra-1.linodeobjects.com/SA26P011-661853b7.pdf", "host": "br-cws-assets.de-fra-1.linodeobjects.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 122, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-6910", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-04-23T13:37:42.300Z", "date_published": "2026-07-09T06:52:52.056Z", "date_updated": "2026-07-09T14:39:45.983Z", "publisher": "Wordfence", "title": "Bookero.pl <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "affected": { "vendors": [ "safistudio" ], "products": [ { "vendor": "safistudio", "product": "Bookero.pl – system rezerwacji online" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:security@wordfence.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00206, "percentile": 0.10849 }, "nvd": { "published": "2026-07-09T08:16:49.210", "lastModified": "2026-07-09T16:19:45.567", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-6910", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "This is due to insufficient input sanitization and output escaping in the `bookero_products()` function — the raw attribute value is concatenated directly into an inline `e_id before verifying that a full entry fits.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/733cd8474e6d763d75ed96f3f2b98a25480cf2b9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4e2a96ec7236e248e706850568e0a925fd21b588", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/442ca20c54038e2400cf28aaa944cf1de2c8e65d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1ddf3fd21c4c652f9cab5552515c04a166662306", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aba4f94ac1832c7299c33e1b4fe5f87eef6dc8f1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ff83de56882cb8466184d322abece2589258ca56", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5d8a39649947a4e86c8fbc682d7fc0041b8d109a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c4810ada31e80cbe4011467c4f3b1e93f94134f3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1846, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63815", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:15.345Z", "date_updated": "2026-07-24T14:34:08.336Z", "publisher": "Linux", "title": "f2fs: bound i_inline_xattr_size for non-inline-xattr inodes", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00132, "percentile": 0.03179 }, "nvd": { "published": "2026-07-19T12:16:54.527", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63815", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An unchecked on-disk inline-xattr size makes F2FS directory geometry underflow and drives reads beyond the inline dentry area.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3c8d6b4093aea40a20596f452289e7c22d84e6d5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a08ee30dcbeff6b97df75c38c2589603ddde53a6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c3e05522daae4e7348a1ea81eeb321d25aa0fd3b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/76e1a05cf6d4051931d7fa4ead51a05786a62918", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/16bc237ce3c483b75575abea53cfb639745311ed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/378acf3cf19b6af6cba55e8dd1154c4e1504bae8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1946, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63816", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:15.907Z", "date_updated": "2026-07-24T14:34:09.322Z", "publisher": "Linux", "title": "f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 12, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02135 }, "nvd": { "published": "2026-07-19T12:16:54.643", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63816", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Garbage collection uses atomic_inode->i_mapping without holding an object reference while eviction can free that inode.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/7d3ae21783e5914c1761ac7d63f882d3d70800e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/56038756aae68312df00d4aa1d97e51ef3aca725", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a499f77c06050a28c897bdbd86cd2f0721ae0743", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a805fec35c201c59643ddcde713bce4051c8ee27", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e0288584baa5dc41df4a829a023c4c1b33fe53d7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 855, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-63817", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:16.441Z", "date_updated": "2026-07-24T14:34:10.308Z", "publisher": "Linux", "title": "f2fs: validate compress cache inode only when enabled", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 16, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00134, "percentile": 0.03308 }, "nvd": { "published": "2026-07-19T12:16:54.757", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63817", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "F2FS treats the synthetic compressed-cache inode as metadata even when that feature is disabled, bypassing the normal inode-range validation path.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/fcc051d377a9701a452e7663a1a8223c26225df9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/29115b8c9172d34e67ab26cc4f6c209b7a236d7a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/13e4b59d3a9413f66f116fa6c4828519b960a5ea", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/16161444c30d8dff9428abbae42b72ce4e32a932", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/77f216ff9ce5cde8eed9f6d12707e906dffdc9f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0969926d987bbde9a1aa49da317582ba37095805", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5073c66a96a9c23c0c2533ed4ed06e42f9021208", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 915, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63818", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:17.022Z", "date_updated": "2026-07-24T14:34:11.320Z", "publisher": "Linux", "title": "f2fs: validate orphan inode entry count", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00132, "percentile": 0.0321 }, "nvd": { "published": "2026-07-19T12:16:54.873", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63818", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "f2fs orphan recovery trusts entry_count beyond the ino array and reads footer or following data as inode numbers.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/210c210c92d78fdf5051bc55c5c69044b1a2150a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ad101d15716f5a24d1fa82a849f80430c805a3dd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d2f236196d542ccd8505736e41c3a1d3f0305f6f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/550511a2470f6d204fa07b331f048bd2d3c51280", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8aad54746c251f2c2370118df766c0c82e2d2091", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2e12381d4495dc8b0ff042c6856022b2e359835c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/846c499a65816d13f1186e3090e825e8bb8bcb8b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 914, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63819", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:17.613Z", "date_updated": "2026-07-20T13:40:26.536Z", "publisher": "Linux", "title": "f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00119, "percentile": 0.02034 }, "nvd": { "published": "2026-07-19T12:16:54.980", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63819", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "F2FS accepts a corrupted direct-node footer whose inode and node identifiers conflict, leading truncation arithmetic to hit a kernel assertion.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/406c28af75123432d38cf9bbaa6f1476f7b14770", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0cc21c1ffe15b4156b0bf744f32fd1faef0b7c73", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8712353ed80f87271d732297567dcdbe4b84e8c7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2872, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63820", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:18.211Z", "date_updated": "2026-07-19T12:02:18.211Z", "publisher": "Linux", "title": "f2fs: fix missing read bio submission on large folio error", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00145, "percentile": 0.04281 }, "nvd": { "published": "2026-07-19T12:16:55.103", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63820", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An error before adding a later folio returns without submitting the already accumulated bio, leaving earlier folios locked without completion.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/48c92559e7b66fdc3cbc74f6e152e66ec0150a0a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/74c8d2ec95c59a5651ecd975c466998af1961fd4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 795, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63821", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:18.751Z", "date_updated": "2026-07-19T12:02:18.751Z", "publisher": "Linux", "title": "wifi: rtw88: usb: fix memory leaks on USB write failures", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00157, "percentile": 0.05333 }, "nvd": { "published": "2026-07-19T12:16:55.203", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63821", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "USB submission failures skip the completion callback, and the unchecked error paths therefore never release the skb, txcb, or aggregated buffers.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2b2060c2075a72bc2de43ce5e1b9347d6c5e27bb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/53fed4061a09755de99c89fdc7fae5b794da455f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/200d58c851b8f63f77a05570072dd20f79bc3681", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8206d173d18ef5a077423119f4e9a93cb3a6f4eb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6b964941bbfe6e0f18b1a5e008486dbb62df440a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1127, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63822", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:19.286Z", "date_updated": "2026-07-19T12:02:19.286Z", "publisher": "Linux", "title": "wifi: ath11k: fix warning when unbinding", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00174, "percentile": 0.07033 }, "nvd": { "published": "2026-07-19T12:16:55.330", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63822", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ath11k failure path frees transmit-status buffers without clearing their pointers, so device unbind frees the same allocations again.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e569a5cb401a267168621aa9a1e7f07fcc9612c3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0aa097a370277deab5337030b9e2d395742f469c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0a946abb82f29abe9a15173b707a449cb039b43e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/318703b6f71d1a29ee0ac46c32a38f7734d4cfb2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7b2e62b9080bf4a5f4e70cfe47156df8d93a4f13", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/40aa3c2b0cb8e34e0576fc94cc70e4e33db03c0a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/051f954b94479d72222c9fbc82a3eef4777bca01", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8b7a26b6681922a38cd5a7829ace61f8e54df9b7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 681, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63823", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:19.847Z", "date_updated": "2026-07-20T13:40:27.567Z", "publisher": "Linux", "title": "keys: Pin request_key_auth payload in instantiate paths", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00124, "percentile": 0.0252 }, "nvd": { "published": "2026-07-19T12:16:55.457", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63823", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The request-key instantiate path loads request_key_auth without retaining its payload reference across a sleep, allowing the helper to free it before target_key is used.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d8274181b0f28d450b42489723a5ba81042158d7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4982bfabce6b33b3c9eddb4fb900fe5568b7cf91", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/708709c65a1832a99b0eef8ae46e343ddaca3d06", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/35ab4db86774d82389e4b9559e26ab7f68d8e395", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f9b68632ac93cc742f2e411021c4dbfe452ea0c2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7216ce8cb12fee44e309503955bb83806b106129", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/83c0a1cb296d955d5f4d1f0bd8a769ba8ed8c29f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fd15b457a86939c38aa12116adabd8ff686c5e51", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 956, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63824", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:20.406Z", "date_updated": "2026-07-20T13:40:28.600Z", "publisher": "Linux", "title": "KEYS: fix overflow in keyctl_pkey_params_get_2()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.02788 }, "nvd": { "published": "2026-07-19T12:16:55.583", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63824", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The kernel sizes an internal public-key output buffer from the caller's too-small length instead of the primitive's maximum output length.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/622ec2dcd59f21623f2a7ab773c80ceb7d555e3a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b1e247338bc71826a2d2def3e0874c34749df69a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0f3058d7d26f81df9b68a18ddbe164bdc3c5eff3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5966e4e2ba213ab7ad559166152eb4f1f170dd2c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5165f1cc727f1322456735df212d8e26ec237a8d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b11c1fa32667692a2c0566e10163758e786e430c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/670fc6a311ed321522b7fff92cf0fc376b4f6e78", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cb481e59ea6cae3b7796ac1d7a22b6b24c3f3c0b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 393, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63825", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:20.968Z", "date_updated": "2026-07-20T13:40:29.626Z", "publisher": "Linux", "title": "gcov: use atomic counter updates to fix concurrent access crashes", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00414, "percentile": 0.34128 }, "nvd": { "published": "2026-07-19T12:16:55.720", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63825", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Concurrent CPUs update a shared non-atomic GCOV counter between the compiler's loop-bound loads, producing inconsistent indices and an out-of-bounds write in inflate_fast.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/49d893b9cbcfc5802a32e53a64c6c6956670d65b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5b959c1dbb4522b9e3ac4e26ad638b8784869841", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/56cb9b7d96b28a1173a510ab25354b6599ad3a33", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2635, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63826", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:21.518Z", "date_updated": "2026-07-20T06:41:29.792Z", "publisher": "Linux", "title": "fbdev: fix use-after-free in store_modes()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00157, "percentile": 0.05333 }, "nvd": { "published": "2026-07-19T12:16:55.833", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63826", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "store_modes frees the old framebuffer modelist and leaves concurrent readers able to dereference those released mode entries.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5267eab88fa4c684459504b8be577ad64953b9a6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c6765f39ed27014ff877b00a2efa494233404e17", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0d35f9f194a858567a21017d69318a51e3a822b9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/70f1e000b88cfa8ca3fd7f4d082647fc089a7769", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2c1c805c65fb7dc7524e20376d6987721e73a0b1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1509, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63827", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:22.083Z", "date_updated": "2026-07-24T14:34:12.274Z", "publisher": "Linux", "title": "apparmor: fix use-after-free in rawdata dedup loop", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 26, "versionRangeCount": 24, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00124, "percentile": 0.0252 }, "nvd": { "published": "2026-07-19T12:16:55.960", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63827", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Deduplication unconditionally increments a reference whose count is zero or whose object is already dying.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/643221da57dbb1a8fd800610331cf1ec27969f71", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b17f0c59cc1525765625cf07d0391b7f9c1ed7e5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a7a2890028f16e5b0af0bb005d80fcb32559cca3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/15fd83a1e42ede15070968806bb6c8b1a5170688", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ce261a20b41db522e320a41bbf1292bf85af66df", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c3ca2631073b2cef06824fd2bfc452ff7a1023de", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5e34fa9f6f7cd688ae153fff13139a5cf2d42339", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6f060496d03e4dc560a40f73770bd08335cb7a27", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1851, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 26 } }, { "cve_id": "CVE-2026-63828", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:22.644Z", "date_updated": "2026-07-24T14:34:13.317Z", "publisher": "Linux", "title": "apparmor: mediate the implicit connect of TCP fast open sendmsg", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00131, "percentile": 0.03095 }, "nvd": { "published": "2026-07-19T12:16:56.110", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63828", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The Linux operation does not enforce the caller's role or permission against the requested object and action.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a16714e7cf2baa98ba2efddd5d6cbac641f4e76b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/20383429b56974507c465d016e5238b189f7a246", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7f57428ce00891d26b0f087ef754a4d820ec83aa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/faea60deaa05c76f0772650f42eafde12bd39d93", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/07b71c342382b854ab8030b244aeab6a7228ad7d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4a69b83045d3195d5b9a9b053ad840ddb2998b4e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/45ebb934ea50b436ce49b2f159f090dab0d7fa28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4d587cd8a72155089a627130bbd4716ec0856e21", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 831, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63829", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:23.191Z", "date_updated": "2026-07-24T14:34:14.296Z", "publisher": "Linux", "title": "net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00123, "percentile": 0.02484 }, "nvd": { "published": "2026-07-19T12:16:56.230", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63829", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The GRE changelink path checks CAP_NET_ADMIN in the wrong network namespace and therefore authorizes the caller against the wrong authority domain.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/19275943d8fe903eb7b9aa53e380e41efd042ada", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/866b0f5ae599490bd496fd84581c68ac8b94e6af", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/92b766fc55156e0da2ecd0c2302c971118f8a229", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e54c05ed3d9c28733fb9e5837219aca3691defa3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9831bc9ecb402957810c2045c663fbfe9b09e296", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1697957eb0971d420dde42862b88eb43506a1105", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/47b5d3d506609b08b2e1f7c14f0b681a1953d572", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8165f7ff57d9667d2bb477ef6af83ede7fed4ad7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1173, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63830", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.014Z", "date_published": "2026-07-19T12:02:23.741Z", "date_updated": "2026-07-24T14:34:15.323Z", "publisher": "Linux", "title": "net: skmsg: preserve sg.copy across SG transforms", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L" } ], "max_cvss_observed_across_sources": 9.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00352, "percentile": 0.27936 }, "nvd": { "published": "2026-07-19T12:16:56.337", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63830", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "sk_msg transforms move scatterlist entries without moving the corresponding sg.copy ownership bit, so a later BPF verdict can expose an external page-cache page as writable.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f126eed589eec6f201405abbc398844042ef6d57", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/31a110642b5fb5e61940cbcfb503445ac4f28017", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9bb86d8184b37503816150c4a6ad3c17dfdbe827", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0eb4c16c4adb262763bda870a8ed38a1a9dec7ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d22cc92bc41290e5783a72375e0843d9435f6001", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1acdd14c0990dd1cd4b6534f00366d2e6dfce05f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/21ed9540a8e1906dfcbc1bb82ba9b4de4fa4bd6d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/406e8a651a7b854c41fecd5117bb282b3a6c2c6b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1147, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63831", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T12:02:24.320Z", "date_updated": "2026-07-20T13:40:34.698Z", "publisher": "Linux", "title": "mac802154: llsec: add skb_cow_data() before in-place crypto", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00243, "percentile": 0.15602 }, "nvd": { "published": "2026-07-19T12:16:56.460", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63831", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "IEEE 802.15.4 security code performs in-place cryptography on a cloned skb without first obtaining a private writable buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3a2b378b3a9ca75d3518d879148d2ad25b5714a9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7a831bcd0486788283ef35e396d4282ee01bb0d5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ff976ef7c39199ebff33c18034636595016db9f0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e28e7fd34c449028325322a3f5127b92594b7396", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/993fd674fe85d114e6a8d3963033d4fbbc2170a8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bd968bdd568beacfdf98ec537a87527e85f1d0cf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/86d531337ea1ba02d9f2bc830d07c683d9bfaade", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/84a04eb5b210643bd67aab81ff805d32f62aa865", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1963, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63832", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T12:02:24.908Z", "date_updated": "2026-07-20T13:40:35.633Z", "publisher": "Linux", "title": "wifi: mt76: add wcid publish check in mt76_sta_add", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00223, "percentile": 0.13025 }, "nvd": { "published": "2026-07-19T12:16:56.600", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63832", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "mt76_sta_add() reinitializes a poll-list node after another path has already published it, corrupting the shared station list.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3c499851753a24d2e148d4e9ca51764c0c51554e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/55e014aaec650ede08b693ba59c8d0443f13f11c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/20b126920a259df4d7dcae19fcfe2c57a74d6b2e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 985, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63833", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T12:02:25.469Z", "date_updated": "2026-07-20T13:40:36.626Z", "publisher": "Linux", "title": "ntfs3: reject direct userspace writes to reserved $LX* xattrs", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00125, "percentile": 0.02586 }, "nvd": { "published": "2026-07-19T12:16:56.713", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63833", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ntfs3 permits a user-controlled reserved $LX extended attribute to preserve or manufacture SUID state outside the intended privilege rules.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e574af95234afc3c725988bbc1fdeb46b9f386a4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2c3cd6da4a14380ef79e34bd9dff7caf46687477", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e8852ae29868e449fdb47eebc28f35fb80741a5f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f8d420949b335a4b51d06ab276beee6b8dfdc909", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5e658b9245a52d838ef93729a7bc07de8e19deb7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/293a84fa40b3a1b3471c0545722724bc10973f76", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5b08dccecf825cbf905f348bc6ccb497507e28e2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 798, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-63834", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T12:02:26.045Z", "date_updated": "2026-07-19T12:02:26.045Z", "publisher": "Linux", "title": "batman-adv: tp_meter: restrict number of unacked list entries", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00174, "percentile": 0.07093 }, "nvd": { "published": "2026-07-19T12:16:56.840", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63834", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "batman-adv accepts sequence gaps that create an unbounded unacked_list, allowing attacker-driven memory and lookup work to grow without limit.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/31a88792bfba142be3c9521538c1db805677381f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1111a3381bca2d1f084a07686bc783af5ab23df7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1c616b0be4bd8399d485e25e91859373b95d6013", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f8c499fd275e59203b77fca76ae6ef2d096c2133", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c6231d628d06d841bc1617b2f7034f5f39876b16", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2233787658db859f0a9b83cb397cf783bb8be865", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1fb8762600a393d1caccd63be5d07e1756982d68", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e7c775110e1858e5a7471a23a9c9658c0af9df89", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 928, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63835", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T12:02:26.574Z", "date_updated": "2026-07-19T12:02:26.574Z", "publisher": "Linux", "title": "batman-adv: v: prevent OGM aggregation on disabled hardif", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00174, "percentile": 0.07092 }, "nvd": { "published": "2026-07-19T12:16:56.970", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63835", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The disabled batman-adv interface can still receive newly queued SKBs after its aggregation worker and prior list have been torn down, leaving those buffers permanently unconsumed.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d462ced79dd430200cf888984e8005da77fc810b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f79deaaf822ab0ee2424cf28781f9ab91576bea3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d3569327fc7395b2b0461a0a0cb77a0bb74786c0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/97644fdaaf6446ffbe182c5eb804fceb5b1a51b7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f04dde74399431fb07abbdd9cd5d0ed624771d04", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3d4548c96d6f21ac1a9b06c5f82f3ef439c87023", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/86ab6b6fb5b82163bf6c45780bb72150021d7349", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d11c00b95b2a3b3934007fc003dccc6fdcc061ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 707, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63836", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T12:02:27.166Z", "date_updated": "2026-07-19T12:02:27.166Z", "publisher": "Linux", "title": "batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00174, "percentile": 0.07093 }, "nvd": { "published": "2026-07-19T12:16:57.103", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63836", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A left shift wraps the congestion-window divisor to zero and the following calculation divides by zero.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/35264c4d46067d6312871488c810cef387f8c1f6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1381b021bf886b793fa5ffb895a8efae7ba0318f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d08b69da40a101df1e28bfe1e8fa7a09ffa41107", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cd74176cf1685f35a2e5f212d15748bbfecb53b6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ac229c86e49fdb96d91f51bc2fa37a9c4f58c44f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7d2a44bc6bbe39aed03c68864aa0e54e04a50278", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/585616dab0aa9c45bc11b2c8082ca78533bc00e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/33ccd52f3cc9ed46ce395199f89aa3234dc83314", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1158, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63837", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T14:04:33.781Z", "date_updated": "2026-07-19T14:04:33.781Z", "publisher": "Linux", "title": "net: ena: PHC: Check return code before setting timestamp output", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00167, "percentile": 0.063 }, "nvd": { "published": "2026-07-19T15:16:50.480", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63837", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ENA PHC path copies a timestamp to userspace even after the hardware read fails, exposing uninitialized stack or stale device values.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/bddf59818ae5102e6d82a4dae5add6df8da38fb0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/edcb049d836e175e7b3d5e0d05657104545b5e65", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/24a08d7d6218d60c033015cf4870b6096446e734", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 670, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63838", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T14:04:34.454Z", "date_updated": "2026-07-19T14:04:34.454Z", "publisher": "Linux", "title": "ASoC: rsnd: Fix potential out-of-bounds access of component_dais[]", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.065 }, "nvd": { "published": "2026-07-19T15:16:50.583", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63838", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The driver allocates at most six component_dais entries but a boundary condition can make later iteration read one element past that allocation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9f1daac27ca28e98c8c0e4450de42bb68d547250", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/15e7b2ac2455995a6af02b9d3da7a432837aaf72", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/134c61925e9e9ee0f4fdbab5c3984d5bb024f5f5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a62b3e6e42359a79158c134e3cf5c74fe160c3f5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f9e437cddf6cf9e603bdaefe148c1f4792aaf39c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 566, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63839", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T14:04:35.146Z", "date_updated": "2026-07-19T14:04:35.146Z", "publisher": "Linux", "title": "platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00156, "percentile": 0.05254 }, "nvd": { "published": "2026-07-19T15:16:50.693", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63839", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "lwmi_dev_evaluate_int leaves output.pointer outside cleanup when retval is NULL, leaking one allocation on that path.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/40a984dd0602e238ad893b167751620e751d1199", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0c3887a134f191723b53e2a47e501b534c8723ee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 410, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63840", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T14:04:35.890Z", "date_updated": "2026-07-20T13:40:37.642Z", "publisher": "Linux", "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00121, "percentile": 0.02246 }, "nvd": { "published": "2026-07-19T15:16:50.787", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63840", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The AMD JPEG ring accepts a 64-bit user-fence mode that the hardware path does not support.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/46ad73aec27d020f103b4262e4da2d2c22f54799", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3b0ea2021351b6b813b34fac940957f1f4fad85b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 287, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63841", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T14:04:36.591Z", "date_updated": "2026-07-20T13:40:38.619Z", "publisher": "Linux", "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00128, "percentile": 0.02816 }, "nvd": { "published": "2026-07-19T15:16:50.883", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63841", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The JPEG ring accepts user-fence submissions even though that ring cannot perform the required 64-bit fence write.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d0f6ae14c0452be4fc3aa5cf81c74e68b3243050", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/869ce148c0d953570f8307c3e206b47bd5d3be99", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2f8e3da71a1b469b6e157aa3972f1448b3157840", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 287, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63842", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T14:04:37.212Z", "date_updated": "2026-07-20T13:40:39.593Z", "publisher": "Linux", "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02955 }, "nvd": { "published": "2026-07-19T15:16:50.987", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63842", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The AMD JPEG v5.0.0 ring accepts user-fence submissions even though the ring cannot perform the required 64-bit user-fence write, allowing an unsupported operation to reach hardware execution.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3a55ff19a6ff5e046d6a4a18e36deec5d95d9a2e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a7e63bb93a7fde3c8920984c3deee9acfe461562", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/69ab75c7c5f378eb46f4c918aa848bb5c5603924", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ea7c61c5f895e8f9ea0ffffa180498ef9c740152", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 287, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63843", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T14:04:37.815Z", "date_updated": "2026-07-20T13:40:40.562Z", "publisher": "Linux", "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02955 }, "nvd": { "published": "2026-07-19T15:16:51.093", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63843", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The JPEG v4.0.5 ring accepts user-fence submissions even though that ring cannot perform the required 64-bit fence writes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/424510b60d4698a75a6ff71acdd88b528f0f39af", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f26e3f7186cd6ecc93e6af102744d64c798dea7e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f9bc5633b761cff200c428f61ed0df6212b1c721", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b65b7f3f3c18f797f81a2af7c97e2079900ad6db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 287, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63844", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.015Z", "date_published": "2026-07-19T14:04:38.452Z", "date_updated": "2026-07-20T13:40:41.608Z", "publisher": "Linux", "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02952 }, "nvd": { "published": "2026-07-19T15:16:51.187", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63844", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The JPEG ring accepts user-fence submissions even though that hardware path cannot perform the required 64-bit fence writes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b884ff67d62ef514eee9d5f605c03101c8b6bc98", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d6bd2a5fd611ec9c8a2411f084cff2435c709608", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8549b3933038e68dc61cb934b9a54223dd244a78", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/249fa7549736de1c8e327d7ca6b32fa148a40bd6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/83e37c0987ca92f9e87789b46dd311dcf5a4a6c8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 287, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63845", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:39.084Z", "date_updated": "2026-07-20T13:40:42.584Z", "publisher": "Linux", "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02954 }, "nvd": { "published": "2026-07-19T15:16:51.290", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63845", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The JPEG v4 command ring accepts unsupported 64-bit user fence values, although the public record does not state the resulting invalid operation precisely.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d4e0172a1b614373385e9b7111b580f8d2e0b98f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a676f16ea9a7df96d69f405afb6eb349571b3382", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6876d05b899102f4dfdb9ad560132126144c1c72", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/af4b458daa597dae707bf3f1f74745f5fc133ca2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e7e90b5839aeb8805ec83bb4da610b8dab8e184d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 285, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63846", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:39.674Z", "date_updated": "2026-07-20T13:40:43.573Z", "publisher": "Linux", "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02954 }, "nvd": { "published": "2026-07-19T15:16:51.393", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63846", "family": "HARDWARE_PHYSICAL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The JPEG v3 ring accepts user-fence submissions even though that hardware ring cannot perform the required 64-bit fence writes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ee035a9d3eed3a9f5a3e83c31a10b321c9598861", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/303da8279f195cc741adc52c1b44d6b64de63bb0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5ada37d7f736f9feeaa06a25e470a4c74e67a61a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/48ce00787e3fddd2b45692fc991b8ab128343da5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a2baf12eec41f246689e6a3f8619af1200031576", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 285, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63847", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:40.248Z", "date_updated": "2026-07-20T13:40:44.592Z", "publisher": "Linux", "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02905 }, "nvd": { "published": "2026-07-19T15:16:51.497", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63847", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The AMDGPU JPEG ring accepts a 64-bit user-fence submission even though that ring cannot perform the requested fence write.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/63691e396105611173072ad548fc2b68831ecf23", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4d96e3cbfc66e4d66ea0096bde858e28ab62da00", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3a96fee676fc0caf08f03ad915bec6fcd144d551", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/694fe016969c5e5a24b9e0ef7c1307eedec8ddf8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/79405e774ede411c6b47ed41c651e40b92de64a2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 285, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63848", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:40.798Z", "date_updated": "2026-07-20T13:40:45.585Z", "publisher": "Linux", "title": "drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02954 }, "nvd": { "published": "2026-07-19T15:16:51.600", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63848", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The AMD JPEG v2.0 ring accepts command submissions with 64-bit user fences even though that ring cannot perform those fence writes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f675801889b265634aefd30aa4503fc2b9e6ce1c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2e216c2ff159b2eb1da6e9c716d727efc73c64b5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b41248d1c18384835f6532e68592ee07605da283", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/41c4f3f68a343d62bd352a95ace93a11c4ad92ed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e5f612dc91650561fe2b5b76dd6d2898ec9ad480", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 285, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63849", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:41.395Z", "date_updated": "2026-07-20T13:40:46.622Z", "publisher": "Linux", "title": "drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00128, "percentile": 0.02816 }, "nvd": { "published": "2026-07-19T15:16:51.703", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63849", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The AMDGPU driver accepts user-fence submissions on a ring that cannot perform the required 64-bit fence writes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/081ef0e46c9cdd26c0db0ef721470393d36b6655", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5a4bffd67e94944ed3db26a959346cfb7fabaecd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8f4954722eab88e10c4ea0c0d3b1269c31421d3a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 308, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63850", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:41.975Z", "date_updated": "2026-07-20T13:40:47.581Z", "publisher": "Linux", "title": "drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02954 }, "nvd": { "published": "2026-07-19T15:16:51.803", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63850", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The VCN ring accepts unsupported 64-bit user-fence writes instead of rejecting those command submissions.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9f5a1459ecc3195282be617639d710b54779c9dc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/139a8a52ef4349c62129703b3a3e3a6ae4d634eb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2c350f3cd94be847ac216e1358ec7001eaaf0934", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8cae0ce77de492d7c31c1532a2e80c0c6e7e58cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 308, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63851", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:42.581Z", "date_updated": "2026-07-20T13:40:48.563Z", "publisher": "Linux", "title": "drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02161 }, "nvd": { "published": "2026-07-19T15:16:51.907", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63851", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The AMDGPU VCN rings accept user-fence submissions even though that ring version cannot safely perform the required 64-bit user-fence writes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/75091030f07b7957cc0646cd52e2d9d15f611483", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6d9a98c5ed65ba92a09e4ca5a5f6941448145529", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7f23b5c420b9f68a210c29c5123bace670aa8cc9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/589a254bf3e88204c8402b9cbccd5e23a0af990f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 308, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63852", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:43.258Z", "date_updated": "2026-07-20T13:40:49.533Z", "publisher": "Linux", "title": "drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.0216 }, "nvd": { "published": "2026-07-19T15:16:52.003", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63852", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The VCN encoder ring accepts a 64-bit user-fence submission even though that ring cannot perform the requested fence write.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c12a5d35033c0640c57c10d7111c010c7b9c2c8e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/387b7c7667bd5c53549350ddad866d2fcf75a529", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9076a83e5adefd10dc5c967c7b8bde601c4c512a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0177ac6141c8857130cf365369c74dee7b6b1f7f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4532b52b34e4e4310386e6fdf6a643368599f522", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 308, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63853", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:43.885Z", "date_updated": "2026-07-20T13:40:50.539Z", "publisher": "Linux", "title": "drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00119, "percentile": 0.02071 }, "nvd": { "published": "2026-07-19T15:16:52.113", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63853", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The VCN v4 encoder ring accepts unsupported 64-bit user-fence submissions because it is not marked no_user_fence.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1286b6872de0aee1feeeaa6dbac86369806de9a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6bdd2ed6458d35c368fbe9550a4d7f342abd3a92", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/51f694221047c84fa185be98210eb2c354ffb8c6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 306, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63854", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:44.487Z", "date_updated": "2026-07-20T13:40:51.515Z", "publisher": "Linux", "title": "drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02162 }, "nvd": { "published": "2026-07-19T15:16:52.217", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63854", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "VCN v3 encoder and decoder rings are not marked no_user_fence even though they cannot support 64-bit user-fence writes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e74fc9c72c1ba78d0de0b849f5929c3b39a8e20c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/26c4f38529ac78930c9c4713e16ebc5b689bb0a3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2d6525e7b2504f5bbfe9417cddc1e8da858791dd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b076e45e6f757a2829e80d0144c1b5f201bee5af", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f1e5a6660d7cbf006079126d9babbf0ccf538c6b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 311, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63855", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:45.096Z", "date_updated": "2026-07-20T13:40:52.507Z", "publisher": "Linux", "title": "drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02161 }, "nvd": { "published": "2026-07-19T15:16:52.337", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63855", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The VCN ring accepts an unsupported 64-bit user fence because the required no_user_fence restriction is absent.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2c6fb056567efb49f8674108b86088a1cfaa86d0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8f0ea4524dc71c6c9ec97f2711f46e12f624140f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/602d4c5872b25ddd4d82fb2025efb9a05b187bb3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5a3c6f76cab164a5d803084908d7050f649ab7f9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4f317863a3ab212a027d8c8c3cc3af4e3fb95704", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 311, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63856", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:45.716Z", "date_updated": "2026-07-20T13:40:53.515Z", "publisher": "Linux", "title": "drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02162 }, "nvd": { "published": "2026-07-19T15:16:52.440", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63856", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The VCN v2 ring accepts a 64-bit user-fence request even though that ring cannot perform the requested fence write.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f264019be80de79f84f464846451445923bffea0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5e777bc4cbe928ac0fd95e368fee1540f2ce4db2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ac06ce5cac9e711281585d09d00c6efcd9b86396", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c71aecae98e42dcf2baf462df50b3a2cf1a93fe4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8d80b293b41fcb5e9396db93e788b0f4ebcbafb7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 311, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63857", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:46.339Z", "date_updated": "2026-07-20T13:40:54.471Z", "publisher": "Linux", "title": "net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00347, "percentile": 0.27389 }, "nvd": { "published": "2026-07-19T15:16:52.543", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63857", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The final airoha transmit-loop iteration reads fragment address and length after the index has reached nr_frags, where the fragment entry is uninitialized.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f670fa4b19ceddc6d215dda4997888ccba9bbc61", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bde34e84edc8b5571fbde7e941e175a4293ee1eb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 694, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63858", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:46.967Z", "date_updated": "2026-07-20T13:40:55.475Z", "publisher": "Linux", "title": "netfilter: nf_tables: add hook transactions for device deletions", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00112, "percentile": 0.01602 }, "nvd": { "published": "2026-07-19T15:16:52.643", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63858", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "nf_tables moves hooks between lists during transaction preparation while RCU readers can still traverse the original list.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/4e69bfb32b2db323d9205fdb30e284481b37817c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/10f79dbd7719d1da9f5884d13060322d8729f091", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1123, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-63859", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.016Z", "date_published": "2026-07-19T14:04:47.572Z", "date_updated": "2026-07-19T14:04:47.572Z", "publisher": "Linux", "title": "net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.05141 }, "nvd": { "published": "2026-07-19T15:16:52.750", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63859", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Airoha TX cleanup path leaves DMA descriptors and producer indices stale instead of resetting the ring to an empty state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c0cfce4d76702dba9601a4020df1a0bc35806efc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9b5d56fe389d68ede080c716e6f10895facaf7db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3309965fe44c00fd65af7cef5016e9e782c021a7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 328, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63860", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:04:48.153Z", "date_updated": "2026-07-20T13:40:56.441Z", "publisher": "Linux", "title": "RDMA/core: Prefer NLA_NUL_STRING", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00132, "percentile": 0.0321 }, "nvd": { "published": "2026-07-19T15:16:52.850", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63860", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "RDMA attributes are treated as C strings even though NLA_STRING does not require a terminating null byte, allowing reads past the attribute.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/fcd07d3b8ee7a39b344d73aed69c1a68cd9eacdf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/87111356d58d86edb221ba144d261ed83a5b8bbe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/abda65bdd13084c771842adaac1f652d0660dd82", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/137b5918931d4d05aa8ea8d3adf67f7224eef63c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5877c043398d5fa0e93919a3d837e5cd7a98a961", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f2c7b39dde2e61df8157066969cc2a408cd3dcd9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c26a0052cceed4c4d380ee5808b699f937fb58d8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6ed3d14fc45d3da6025e7fe4a6a09066856698e2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 574, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63861", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:04:48.793Z", "date_updated": "2026-07-19T14:04:48.793Z", "publisher": "Linux", "title": "spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00161, "percentile": 0.05785 }, "nvd": { "published": "2026-07-19T15:16:52.973", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63861", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "mtk_snand_probe registers a NAND ECC engine but omits unregister cleanup on probe unwind and device removal.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6aea4a99410615912d80a4ba0827c4e8d4a8312d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3e79a563377a319d016ed0d3cd8c43171670c0f3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/86357e1d0157d8408b78f8768a69ab263d010316", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e0b049bd7b279d7b6ad22a637cddced93198a51b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/98cf4b58299e0c6a537c68cd32155d9e7569e7cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ab00febad191d7a4400aa1c3468279fb508258d4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 438, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-63862", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:04:49.380Z", "date_updated": "2026-07-19T14:04:49.380Z", "publisher": "Linux", "title": "PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00161, "percentile": 0.05728 }, "nvd": { "published": "2026-07-19T15:16:53.097", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63862", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "mtk_pcie_setup_irq allocates IRQ domains before discovering that the controller IRQ is absent and returns without releasing those domains.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/abd3c1927d33766aef39c4640880e3d2637429c2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/07a5ecb94768cbf76fe659e9924000e9ced0c8a6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/946b31b5a699a2760ee52af0055e5ebf29c5f4cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0a2d60edc3e57c9512e239ebdfd12204d3368560", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/215d4273347b9010a9deae378b0df79c163f707d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5573c44cb3fd01a9f62d569ae9ac870ef5f0e0ba", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 548, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-63863", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:04:49.967Z", "date_updated": "2026-07-20T13:40:57.433Z", "publisher": "Linux", "title": "drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00113, "percentile": 0.01631 }, "nvd": { "published": "2026-07-19T15:16:53.200", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63863", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An error path jumps to an unlock operation before the corresponding lock has been acquired.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8efaa47a871662a8c21b819cec60786f7ef17ab4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d287dee565c3c32e1ed76ec1847af46809c29b90", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 826, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63864", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:04:50.605Z", "date_updated": "2026-07-20T13:40:58.369Z", "publisher": "Linux", "title": "bpf: Propagate error from visit_tailcall_insn", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00123, "percentile": 0.02442 }, "nvd": { "published": "2026-07-19T15:16:53.303", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63864", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The BPF verifier ignores an error returned by visit_tailcall_insn and continues with an invalid tail-call analysis result.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/945816e63c8677cf4bfde963a0774432ce8afc85", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6bd96e40f31dde8f8cd79772b4df0f171cf8a915", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 246, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63865", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:04:51.215Z", "date_updated": "2026-07-20T13:40:59.327Z", "publisher": "Linux", "title": "bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00121, "percentile": 0.02238 }, "nvd": { "published": "2026-07-19T15:16:53.400", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63865", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Linux permits sleepable BPF hooks to run inside RCU or softirq contexts where sleeping violates the execution-state invariant.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/452a927cddcd67478d030e646f41cb904a93156f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f0fc2a9828171205244a28013f02889f50b71c9f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0d918263c9bfc86078edb2e2f7302a0c6ce42b7c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/281f2a214565a5cbf8b7355a65738d80bd19b8c5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/989f1b93907de1753a814996222da375f07e579b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/beaf0e96b1da74549a6cabd040f9667d83b2e97e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 323, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-63866", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:04:51.806Z", "date_updated": "2026-07-20T13:41:00.311Z", "publisher": "Linux", "title": "wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00223, "percentile": 0.13026 }, "nvd": { "published": "2026-07-19T15:16:53.517", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63866", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "mt7996 link teardown removes a station link without clearing its WCID pointer, leaving later code able to observe a stale station association.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/455a48685feebf2d9c1656caad77f9ba1da7b06e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c575459b485c47615491b1fd29f04b43fdc3da56", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/88973240dc7c976dd320b36a9e6d925c9be083ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 220, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63867", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:18:37.234Z", "date_updated": "2026-07-20T13:41:01.328Z", "publisher": "Linux", "title": "mptcp: close TOCTOU race while computing rcv_wnd", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00321, "percentile": 0.24581 }, "nvd": { "published": "2026-07-19T15:16:53.617", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63867", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "MPTCP reads ack_seq more than once without synchronization, allowing one packet to encode inconsistent acknowledgement state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/301a33fd590c408a05c5df800e0cc1e6a8a2f8f8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/68364963e5baf03f16b4420292291f75c8f66497", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/907ac6b1658e0277f979fcdfae2a753b495c1510", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c4f4cf60797974873dbc8e100144682a6f2f861f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3b8cbba7c0ed31189c89f90be247b8973ffa79ef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8f4f0a157e8436a05bf8c3670b24dbc258911c43", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8ab24fdebc369c0dfb90f82c1650b1e66662bb45", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 507, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-63868", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:18:37.823Z", "date_updated": "2026-07-19T14:18:37.823Z", "publisher": "Linux", "title": "net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06139 }, "nvd": { "published": "2026-07-19T15:16:53.740", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63868", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "garp_pdu_parse_attr() subtracts the on-wire length in reverse and then truncates the unsigned underflow to u8, corrupting attribute-length comparisons.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/29f28172afb2ae7b31e9bf3e978396f20b381688", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/973cf7c433d27f4d9556d0b7c332543be7ed7a6e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d8dcd14aa886b8effd83022c550669f4f262854b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/74e02121be1dcc0efcd56ebdf0171d6129105659", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d4c86ea09ae3e63ee5aa86e941fcc38e0e39874a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/04e22fefac1af3e32f245e9045382348773b5d59", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a11f1a671b1361f0f1278dc0041374f2730df73f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/16e408e607a94b646fb14a2a98422c6877ae4b3c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 880, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63869", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:18:38.426Z", "date_updated": "2026-07-20T13:41:02.356Z", "publisher": "Linux", "title": "wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" } ], "max_cvss_observed_across_sources": 7.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00211, "percentile": 0.11449 }, "nvd": { "published": "2026-07-19T15:16:53.873", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63869", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ieee80211_parse_tx_radiotap() uses an 8-bit attacker-supplied antenna index directly as a BIT() shift count, permitting shifts beyond the integer width.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f6d3dc8e8492bf8435e0b23c99472af7bafd6b44", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9b40c59bab08f2a99abf969cc0bb92fa49de004b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/033ce021a220913ac02416fcb5ac883a9ff8b6c7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c0cf89f36ac0c0fd8687a4ccdce2efb23a9c663", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1079, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63870", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:18:39.113Z", "date_updated": "2026-07-20T13:41:03.365Z", "publisher": "Linux", "title": "ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00123, "percentile": 0.02484 }, "nvd": { "published": "2026-07-19T15:16:53.990", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63870", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A non-IPv6 frame skips initialization of lowpan_addr_info, while lowpan_xmit later copies and consumes that uninitialized headroom state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/af07fffbd53ddc3ec3c2a4ca914f27899fa89bca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3150e6d3223dfc356308125cabf9c34169842d2a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8da95cb6ad7d656c871e776a9c7b77e894d6d89c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1a827b95e62b4cbe851ae7cc9c961cdfa769cca4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c1819c8defa235c7beda859bc185b1c429a55ecd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/285b0842f2e01c3edf805f1fd64da11d9b7f6b4c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/87172cc8dc49aaf54407a31edffb0232f8cb93ab", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3a5f3f7aff18bcc36a57839cf50cf0cc8de707f3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 824, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63871", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:18:39.787Z", "date_updated": "2026-07-19T14:18:39.787Z", "publisher": "Linux", "title": "Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 10, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00157, "percentile": 0.05334 }, "nvd": { "published": "2026-07-19T15:16:54.133", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63871", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Bluetooth ISO route selection reads source and destination fields without the socket lock while concurrent calls can modify those fields.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9798f7d41d85ff763afd1f1cc0533b5c416c8348", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ab84fd7779a2a7ff5d2c8eac212c43733f56216e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/859bb1f4cb615d98c9c1ab2bd76ebb0b8fe46020", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9ca7053d6215d89c33f28893bfd1625a32919d3f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 982, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63872", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:18:40.499Z", "date_updated": "2026-07-20T13:41:04.348Z", "publisher": "Linux", "title": "esp: fix page frag reference leak on skb_to_sgvec failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00279, "percentile": 0.2012 }, "nvd": { "published": "2026-07-19T15:16:54.247", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63872", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An esp_output_tail error path frees scatterlist storage without releasing the old page-fragment references captured in it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e705b8ff4dd38fb8fe4e6fdc5378a86acea4feb5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2982e599fff6faa21c8df147d96fc7af6c1a2f24", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1436, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63873", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:18:41.197Z", "date_updated": "2026-07-19T14:18:41.197Z", "publisher": "Linux", "title": "accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.05179 }, "nvd": { "published": "2026-07-19T15:16:54.347", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63873", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "aie2_populate_range retries without dropping its mm_struct reference, leaking a reference on every trip through the loop.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e83fc4c28226be75fbc0c41f2846935ba2b5f949", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/21dfec59939120b20d2c7794caaa421f9450be0a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2f41af638c92bac6f1f9275ea2d1901baef578f3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 305, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63874", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:18:41.907Z", "date_updated": "2026-07-20T13:41:05.329Z", "publisher": "Linux", "title": "net: mctp: usb: fix race between urb completion and rx_retry cancellation", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00119, "percentile": 0.02072 }, "nvd": { "published": "2026-07-19T15:16:54.450", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63874", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ndo_stop can set the stopped state and cancel retry work while a concurrent retry queues a new URB, allowing completion to reschedule work after shutdown.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9c46f3ee1837f6881cb99a52ffecb2760f11dc73", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d90feaa3f74bea8dafb6494631a194c70e547d94", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/54665dce982689e2fd99b32e9a0dcc204fda8a51", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 961, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63875", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.017Z", "date_published": "2026-07-19T14:54:48.842Z", "date_updated": "2026-07-20T13:41:06.339Z", "publisher": "Linux", "title": "arm64: tlb: Flush walk cache when unsharing PMD tables", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 24, "versionRangeCount": 23, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.06038 }, "nvd": { "published": "2026-07-19T16:17:04.357", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63875", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Unsharing a PMD table leaves a stale page-table entry in the walk cache because the flush path ignores the unshared_tables state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/dced308d7d6a0de1c09d2058f38f1aaaf5cbb914", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/47490bbb05c8c0e09cc3cfd237d8934ffc340583", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0199c9d57861f17b556b6cba1f765c7cce79745b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d766a49d9b55705c4737cd8bb5d3faa2d31330fd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8ca7284da0e67b3e71d90ec17f08286774245ad9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fe93e907b1af03cc229a80aa64a570a103d2b279", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/48125cd9c55cbe297b59fd1f9bda48b0960bd181", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c2ff4764e03e7a8d758352f4aceb8fe1be6ac971", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1251, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 24 } }, { "cve_id": "CVE-2026-63876", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:54:49.549Z", "date_updated": "2026-07-19T14:54:49.549Z", "publisher": "Linux", "title": "serial: zs: Convert to use a platform device", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00209, "percentile": 0.11182 }, "nvd": { "published": "2026-07-19T16:17:04.500", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63876", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The legacy serial driver dereferences a parent-device pointer even though legacy probing never supplied that device.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/bb2040484f90f91b717060e1a66026cc4287bcf0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6a83d5e24a84e746425cd93539130e5f7381ef47", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/237dc8c08de3cb293b6607aaee8b13b3a671e267", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4dc9f1517503c883d5ce25b7ab29d177d05edc6a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7cac59d08a73cb866ec51a483a6f3fe0f531947c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3657, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63877", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:54:50.257Z", "date_updated": "2026-07-19T14:54:50.257Z", "publisher": "Linux", "title": "serial: dz: Convert to use a platform device", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00209, "percentile": 0.11182 }, "nvd": { "published": "2026-07-19T16:17:04.653", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63877", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Legacy probing leaves the serial port without a parent device and initialization dereferences a pointer derived from that null parent.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c9e78361fe92fb64662fc3c8f34e2cdbb8c25bc6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6f59646229490a93cda950017ad4bdfbfe770a1d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2ff0401ffddaccc85f758c8259912d686d052b31", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5c9fb95c8d6430d11dbb7b44fbe23222585cda86", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5d7a49d60b8fda66da60e240fd7315232fa1754f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3734, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63878", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:54:50.977Z", "date_updated": "2026-07-19T14:54:50.977Z", "publisher": "Linux", "title": "drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09803 }, "nvd": { "published": "2026-07-19T16:17:04.800", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63878", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "amdgpu GEM_OP GET_MAPPING_INFO passes the user-supplied num_entries directly to allocation without an upper bound, allowing a request to demand an allocation larger than the supported size.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f059b4c493df3e54fe3ffe4658009c31864275da", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/967a00b8e06a7734aded23861faba9ee2462be87", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a1ba4594232c87c3b8defd6f89a2e40f8b08395d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 734, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63879", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:54:51.698Z", "date_updated": "2026-07-20T13:41:07.319Z", "publisher": "Linux", "title": "drm/amdgpu: fix amdgpu_hmm_range_get_pages", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00165, "percentile": 0.06154 }, "nvd": { "published": "2026-07-19T16:17:04.903", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63879", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "amdgpu_hmm_range_get_pages reads the notifier sequence more than once and can continue with pages invalidated between those observations.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2fd24407457a6b181ba827705678da70e528dcd0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/962d684b5dc0741dcd93485d41b450de402d5592", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 397, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63880", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:54:52.397Z", "date_updated": "2026-07-19T14:54:52.397Z", "publisher": "Linux", "title": "drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09802 }, "nvd": { "published": "2026-07-19T16:17:05.007", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63880", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An ENOMEM return bypasses the shared cleanup path and leaves GEM references and VM locks held indefinitely.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1eb86334e391695d4a40743b114afc15df4dc506", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8f643d534ffc6f1b6182e4f3acff8f04890504b9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2e7f55eb408c3f72ee1957a0d0ad11d8648a6379", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1976, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63881", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:54:53.676Z", "date_updated": "2026-07-20T13:41:08.305Z", "publisher": "Linux", "title": "drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00177, "percentile": 0.07417 }, "nvd": { "published": "2026-07-19T16:17:05.120", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63881", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An integer multiplication of the queue count overflows and produces an allocation smaller than the queue data later written into it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/4e5f808b454167cc58d7084a407a554d8ddc694d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/de70a80992396ee306ee3a2810ad28aa1608ba9b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5cf4a41aa0d74e4c83f82d2ce233b5189ed4b43c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4f9eeedc3d3151f8a226fd676c314a813edda5a1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/93f5534b35a05ef8a0109c1eefa800062fee810a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 387, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63882", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:54:55.027Z", "date_updated": "2026-07-20T06:41:35.719Z", "publisher": "Linux", "title": "drm/amdkfd: fix NULL pointer bug in svm_range_set_attr", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00206, "percentile": 0.10772 }, "nvd": { "published": "2026-07-19T16:17:05.230", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63882", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SVM ioctl path dereferences process_info even when the required acquire_vm lifecycle step has not occurred.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e4dcb5d6360319609bc5b05fb40e98b0af6bc674", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6495cc09f7e6c2af571b3e2e4640283b3792ebf2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d4e73a047d4ea866b75ee4b879d0d787dfa2704c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2f9c3c161692f5bf1436e869a651bed10936e071", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c24eee21f9a943374fd64260a6e17dc3984e3d0e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e984d61d92e702096058f0f828f4b2b8563b88ce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 297, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-63883", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:54:56.356Z", "date_updated": "2026-07-20T13:41:09.305Z", "publisher": "Linux", "title": "serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00159, "percentile": 0.05547 }, "nvd": { "published": "2026-07-19T16:17:05.343", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63883", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Qualcomm serial driver flushes its FIFO before a pending DMA-completion interrupt and then lets the late interrupt decrement already-cleared state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c91ea13375f70f6271a0183445e34e83b8f4d8f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b1159dce10b38eb795e4c96cdc4d34b83cec81c5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/654f45a8569f3cd6ff20bd724a18e0cce65893ba", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0d2c41a8b00934ddf8a7c1b4cf72dffa1e629c46", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/452d6fa37ae9b021f4f6d397dbae077f7296f6f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1193, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63884", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:54:57.520Z", "date_updated": "2026-07-20T13:41:10.346Z", "publisher": "Linux", "title": "drm/i915: Fix potential UAF in TTM object purge", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.06039 }, "nvd": { "published": "2026-07-19T16:17:05.463", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63884", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "ttm_bo_validate can replace bo->ttm, after which the purge path casts and dereferences the stale pre-move object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/df73f3bc731af1c39ac5405bc59c4e7c6f8e9117", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/28b22dbaf407598cb3bb1d2c586a6f8018690ac2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/073bcbc95e9648c976da1654c7590a8d6ee12c2d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c9ae7e7e3bc98615364313b08d7acea5239ded0b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a29654d451bbffe63d584a4cf64ad0efce6bcf1c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5c4063c87a619e4df954c179d24628636f5db15f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3998, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-63885", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:54:58.590Z", "date_updated": "2026-07-20T13:41:11.345Z", "publisher": "Linux", "title": "drm/gem: fix race between change_handle and handle_delete", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [ "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.05794 }, "nvd": { "published": "2026-07-19T16:17:05.623", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63885", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "drm_gem_change_handle_ioctl leaves the old handle live while dropping table_lock, so a concurrent delete can free the GEM object before the new handle is safe.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0dfa42cfe4dbe114533480503934f43e33c1e83d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cde2c9257cbe8463b9dcf7b1075177b72b5fd938", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7164d78559b0ff29931a366a840a9e5dd53d4b7c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 668, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-63886", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:54:59.395Z", "date_updated": "2026-07-20T13:41:12.282Z", "publisher": "Linux", "title": "scsi: target: iscsi: Validate CHAP_R length before base64 decode", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00664, "percentile": 0.48194 }, "nvd": { "published": "2026-07-19T16:17:05.723", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63886", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The iSCSI CHAP path base64-decodes up to 127 input characters into a 16- or 32-byte digest buffer before checking decoded length.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/82454e6f21e56ea9a0a9de7d0ff7e1dfb83e34d6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/edd06675a02376ea8347dba7c29ad982ba5b36ee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bf154c657828ed05399bca5d98cf1611bb048b12", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4a3a19c98a8207ad08bec554703d90f2c34a8cc6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c04e85799356120209b351a148ac2db888d5ffd9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/85db7391310b1304d2dc8ae3b0b12105a9567147", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1808, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-63887", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:55:00.114Z", "date_updated": "2026-07-20T13:41:13.237Z", "publisher": "Linux", "title": "scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00745, "percentile": 0.51244 }, "nvd": { "published": "2026-07-19T16:17:05.853", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63887", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "iSCSI login response records can expand beyond the fixed 8 KiB response buffer because three append sites do not check remaining capacity.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/efe633e600a0ac68357206fede21b1ac8178f3b8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1792, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63888", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:55:00.803Z", "date_updated": "2026-07-20T13:41:14.224Z", "publisher": "Linux", "title": "scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00745, "percentile": 0.51243 }, "nvd": { "published": "2026-07-19T16:17:05.997", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63888", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The iSCSI Text handler hashes four bytes beyond its allocation and leaves text_in_ptr referencing freed memory on the ERL greater-than-zero digest-mismatch path.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f7948af0dd03de84079dcd4dc215a69fd6fbb95d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/badf178b76b0690851df00f4ca9cf2eb8eb0f963", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6e22a1cdcc8277af4acc43710577157b77a02c5d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d3e9b79aa794f7a23e82de4d710e7d2df610e349", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ec9f19d52074a191ed1756ed4a7d39fff1a2085c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5118ea225fe63b44207ba88047e4866e1ea43812", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/778c2ab142c625a8a8afa570e0f9b7873f445d99", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3569, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63889", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:55:01.515Z", "date_updated": "2026-07-20T13:41:15.239Z", "publisher": "Linux", "title": "scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00334, "percentile": 0.25989 }, "nvd": { "published": "2026-07-19T16:17:06.163", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63889", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An 8-bit FPIN walker counter is compared with an unbounded 32-bit pname_count, so a count of 256 wraps the counter and prevents loop termination.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/07776b7779c9426982c1ad74aad91bd531593790", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/29f126f09e34a425b376b3646c89aa7cc18b142c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/163bd704d7515c3df6c2e03bcba93d1db79edbff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ee57b89e5da9fffbe0d26647e4ff0750dacb9943", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/35461d23744175a78b6280293892cca357c22793", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bdff76dff6ec23d6fe35812fa33e5c4ce2cdb770", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a9a39233ec1fc9f97ea1340a4d09bb7ec2be5153", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1007, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-63890", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.018Z", "date_published": "2026-07-19T14:55:02.195Z", "date_updated": "2026-07-19T14:55:02.195Z", "publisher": "Linux", "title": "scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11392 }, "nvd": { "published": "2026-07-19T16:17:06.300", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63890", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The FIP CVL walker accepts a zero-length noncritical descriptor and advances its loop cursor by zero forever.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d179949d2175d2857d1c3a275a22bea58bcc5d36", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fda976f7390bb5d1e9b84ef11ebb17323038e0c6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/80a0cd307205236ca28aa49bc553f58edcb9bf3a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/549859a1131052b07dff11a448e9f3221a40f260", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/14dd80a20a72ce334adcc2d67402360527065948", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d537d29d51c8b808469e5adacf3e5a0092700738", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9eed1bd59937e6828b00d2f2dfef631d964f3636", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1294, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63891", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:02.840Z", "date_updated": "2026-07-19T14:55:02.840Z", "publisher": "Linux", "title": "thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00263, "percentile": 0.18075 }, "nvd": { "published": "2026-07-19T16:17:06.440", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63891", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A recursive DIRECTORY backreference has no effective recursion-depth limit.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2b5f47a710172c962ef42d1b732b04d2ad0dce21", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/95839a67ea56ca35732aad7f711404a3127cfe2d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0a84ab9271936c11e84e511bb52fc5682f8b6726", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b4621e5ef63405c317a84b711faf3bd75b3c6a94", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f31c6d220f455b5af63590302b30e1b932d14599", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/830c8a9b467e7d3a158483d37fa7dc13892b293a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ed9455ef4bd9babc90f92e526abe3fb68c1a8709", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/928abe19fbf0127003abcb1ea69cabc1c897d0ab", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 958, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63892", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:03.568Z", "date_updated": "2026-07-19T14:55:03.568Z", "publisher": "Linux", "title": "thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0022, "percentile": 0.12574 }, "nvd": { "published": "2026-07-19T16:17:06.577", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63892", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A directory length below four both underflows size_t arithmetic and permits UUID copying beyond the property block.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/37abc4504fa19d8f9f1e87792e8a2b8fdb308e40", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e2d4d51cf5785815fa4e91e0c019e3eb2506a84c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/de618299190b418291609e6921557253bd417e25", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5506c825f14d810f0690b1f4367cb7249ebb387a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/542a13890b742099c461d70920e97b14e568f6ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d548179adcc87e1bc66b17e00352a1f536e76065", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3bec49ca55e08fb085cc4318f24b1b37eaab28cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/de21b59c29e31c5108ddc04210631bbfab81b997", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1419, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63893", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:04.288Z", "date_updated": "2026-07-20T13:41:16.262Z", "publisher": "Linux", "title": "thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0036, "percentile": 0.28695 }, "nvd": { "published": "2026-07-19T16:17:06.710", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63893", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A 32-bit property offset-plus-length calculation wraps and passes the block-length check before an attacker-directed out-of-bounds read.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6a63623621639acbb39bc2d9fb09559681716695", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e8a0b0a93a6ef958e70b1dd4930beb6dc0026b36", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9fee50c4e1e42f6d3cbe30df584f9f648f626071", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8d4a758b407ab3de3be86d1ceadfa35d717d30c7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5c06a3043ad944f087bb2ae0aae28d820bb9f460", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/31b98e503ecca8077e5247253dd5425ab84bc96d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a47784aee77f33f786dc5d7375db821bdae68792", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/01deda0152066c6c955f0619114ea6afa070aaec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1011, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63894", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:04.882Z", "date_updated": "2026-07-20T13:41:17.296Z", "publisher": "Linux", "title": "usb: gadget: f_fs: serialize DMABUF cancel against request completion", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00159, "percentile": 0.05513 }, "nvd": { "published": "2026-07-19T16:17:06.850", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63894", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "FunctionFS completion frees a USB request but leaves priv->req pointing to it for a later detach or close dequeue.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c872d8a065b3b499ce4c3ad168b5d34b68524f66", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c7d421123b98d5e9c1c84bd9957aba36f1cbb4ca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/552dae28dbeb5f7c4fafcda43962dc46569f58a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2796646f6d892c1eb6818c7ca41fdfa12568e8d1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3948, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63895", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:05.479Z", "date_updated": "2026-07-19T14:55:05.479Z", "publisher": "Linux", "title": "usb: gadget: f_fs: copy only received bytes on short ep0 read", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00244, "percentile": 0.15653 }, "nvd": { "published": "2026-07-19T16:17:06.990", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63895", "family": "EXPOSURE_OUTPUT", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "FunctionFS allocates an uninitialized buffer for the requested control-transfer length and copies that full length to userspace even when fewer bytes were received.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/90ccf5fb63243fae1b4b3200f3310500500ecf2e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/af32dbb2ca0b3d09271ab718d13857a457fa16f2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e835bf9a055f71874065a40780ca5560b7df8b33", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/88874a19b2b093bfaaa1c0090fa536c44da8c08b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/607730a414773a7cbe3037a64a6c64e72689ff5e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/23c1f7deb9dd8447ecde749850676302aa1e2bd3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4e036c10e7f4df5d951c69cc3697bc8e209c6d02", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2165, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-63896", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:06.152Z", "date_updated": "2026-07-19T14:55:06.152Z", "publisher": "Linux", "title": "usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10055 }, "nvd": { "published": "2026-07-19T16:17:07.130", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63896", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "WebUSB subtracts the descriptor-header size from a smaller unsigned wLength, wrapping the later memcpy length to nearly UINT_MAX.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/046870ff6b6f7b743c953c061043a9b30700d491", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f5869dfaa89854dcf34121036294d42d6c7acb8f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f8f5a8f48c7cae3fac85e04b593bd47939f9725f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a20f0ccf45708af6e063c7234c215d364b00de25", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c5dbc104dadd79fc2923497c20bae759a18758c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1379, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63897", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:06.845Z", "date_updated": "2026-07-19T14:55:06.845Z", "publisher": "Linux", "title": "USB: serial: mct_u232: fix missing interrupt-in transfer sanity check", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11396 }, "nvd": { "published": "2026-07-19T16:17:07.243", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63897", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "mct_u232 parses interrupt-in data without first verifying the transfer size, allowing stale or uninitialized slab bytes to reach user space.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/82b48d70bced1ec8e5f676d1fd5eccc7a44dc418", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8b93ee5baeef6efabee2c3381907733ad2dbc883", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a093f3e0c03d25a86d747a655d4b9322ffb2ed87", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/70bb9a2661d34b93a9b83cf83e2b76289a712ef0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/631b8b7c456567f7a8d26f6fc354c8dd9cc9f832", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f06bcaba29707f060706483b2020d3cafbe98f9f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ed260b56bc9fc878e5dcbb866eab8af0688e0e67", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/245aba83e3c288e176ed037a1f6b618b09e92ed8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 288, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63898", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:07.452Z", "date_updated": "2026-07-19T14:55:07.452Z", "publisher": "Linux", "title": "USB: serial: mct_u232: fix memory corruption with small endpoint", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11395 }, "nvd": { "published": "2026-07-19T16:17:07.370", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63898", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "mct_u232 raises the transfer length beyond a small endpoint's allocated buffer and lets USB input overwrite the receive slab.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/94edbbc5fe00d03cfe1d4e690d7d2cd36317a935", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bd2ddb3fe9052ad8703593bbec26ecc7ca92869e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/39e295a91e80f3b91f61c7ada2bde434dcaba20d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/90dbad14b109e5fdfb4934ff61e561d11ba3742d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6cb48f8890f9b2051d7c34823057296a536a31c5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d8fdf33d6fcfb90cbec26299baf2352c84b2d768", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57f332af1745014cd7e40414814ffaa6bc7d3b5b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/915b36d701950503c4ea0f6e314b10868e59fce3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 438, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63899", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:08.116Z", "date_updated": "2026-07-19T14:55:08.116Z", "publisher": "Linux", "title": "USB: serial: mxuport: fix memory corruption with small endpoint", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11395 }, "nvd": { "published": "2026-07-19T16:17:07.497", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63899", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An endpoint packet shorter than eight bytes drives a copy or offset calculation that corrupts the user slab.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/086b858b5f5125bc9d967ea2bd825f83d9f8f29d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2f3661eb2446e1ef593da45e01a3b21a906768ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ccbec56f2f9af008f1574335cc6a668f16603e47", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be3a1ed4ae51fa8dde57383277d336ce834f2cd9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e906545641d34fb1a09a65b4b5cfdff40eb09681", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c0cf56f00f280d72180bb6ce79741bc787a6269", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b40166b4ef96067620a0f248e74ad9658c8f680c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4085f0dbb1ce2251c9a5938d693de6593f0ab2bd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 300, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63900", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:08.847Z", "date_updated": "2026-07-19T14:55:08.847Z", "publisher": "Linux", "title": "USB: serial: keyspan: fix missing indat transfer sanity check", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11395 }, "nvd": { "published": "2026-07-19T16:17:07.623", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63900", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The USB path accepts an unchecked transfer length and parses stale or uninitialized bytes beyond the valid payload.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/bd6c5fe59f374b63173afe5cf0ab38a9a370f2c1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e124120e89b61a967e40dee6b5e1ecafc45c09d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/41d9673941eebdde62ee73848fcfe4ae1105c979", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0bde5431037a076ff3750da2165fd77a6f5ff058", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3759a40738b83bb61699c85f063202b514b94f77", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ea2b792330b44b6d7ce671c3e1d59d0c121f7ed1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f7f566ad7519c7ca3bc9071350002940a2b0e22a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ab8336a7e414f018430aa1af3a46944032f7ff96", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 250, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63901", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:09.553Z", "date_updated": "2026-07-19T14:55:09.553Z", "publisher": "Linux", "title": "USB: serial: digi_acceleport: fix memory corruption with small endpoints", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11394 }, "nvd": { "published": "2026-07-19T16:17:07.743", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63901", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "digi_acceleport trusts device-reported bulk endpoint sizes and can access beyond a buffer when a malicious device supplies an endpoint smaller than the driver expects.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/fd34198c2e5d164b57a7dcd4692626fece319225", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/25b93d0f229a115ab120106f37b9454170d4cfd4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6ab1e9ae099577a1019312088309ecbad2da9a91", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8a65db5edd7b63365e9c5b7d9f4b8f314696dc49", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/41b645e791099f0038225da5e2ca3ca31f00d435", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/062dcc0b324afd03b1406f157190804f105718bb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9469419b12a100e7e2ccdda64ab45b8368456c8a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cb3560e8eab1dfa1cac1ed52631adf8ec6ff2cd5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 315, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63902", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:10.267Z", "date_updated": "2026-07-19T14:55:10.267Z", "publisher": "Linux", "title": "USB: serial: cypress_m8: validate interrupt packet headers", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11392 }, "nvd": { "published": "2026-07-19T16:17:07.867", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63902", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Cypress serial driver reads a format-specific header before checking that a short USB interrupt packet contains that header.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/fcef31a5a85ccf3c313449a866ec6ed7e4132425", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aaa66708bfb1dca2acd219d1c1582f9f6d5492cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/44f9bab8df7750a1e2a4d6cc22d7c9c2dc096aed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be50533fe7068e86eb7adb81988e6d6a3f6dfe53", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/90664556916de22467097d4c8ceb716d597a5c32", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ae03453f2c809ca3cf73753269fa6184dea7160f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4a4cb0021ebe1fcadb52e04d19ed8d71470a530b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9f9bfc80c67f35a275820da7e83a35dface08281", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1040, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63903", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:10.905Z", "date_updated": "2026-07-19T14:55:10.905Z", "publisher": "Linux", "title": "USB: serial: belkin_sa: validate interrupt status length", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11396 }, "nvd": { "published": "2026-07-19T16:17:08.000", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63903", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "belkin_sa_read_int_callback() reads fixed status offsets 2 and 3 without requiring the completed interrupt transfer to contain four bytes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f1617539ab90e67da788959bfd314076f093a11a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f361359a952da15e70e693c2d7dca5c5843eae3e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/37e54d1b986df35c936d81e5b59a7aa3ec6938f0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ffb739a49186ea784bbd9cb91b647f062395b419", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6a4602221cba7a738442328d66a2f0b1c9bf6e17", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/22823a319fb2afdf02cacafbed8b613b757efbc8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/db1e7eb6203d534dad64cac2c793b69e561e657b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4ce058df2ee02cc2a0f0fd5cd64ce6f1482a0b65", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 879, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63904", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.019Z", "date_published": "2026-07-19T14:55:11.547Z", "date_updated": "2026-07-19T14:55:11.547Z", "publisher": "Linux", "title": "usb: usbtmc: check URB actual_length for interrupt-IN notifications", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11394 }, "nvd": { "published": "2026-07-19T16:17:08.130", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63904", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "usbtmc accepts a short USB transfer while later code still consumes fields from the full expected structure, exposing stale or out-of-bounds data.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e794bd67b3faf98af46f958897f6b91412c7d2a9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e3eec3005de44e7f37d8d7724be636446516ab42", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ae87f505917e703ae3b487d9663d78826ff43608", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5de7df75ef3a2756b25fe3d582a4a2970444fe5a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/69020fa089f1bf0e1a10a15265f31b143a846409", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/75f6d3da2cc646983f41807ef98851569c12bca9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f141b01eaa58ac7e323931d670318aa247bff087", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 691, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63905", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:12.270Z", "date_updated": "2026-07-19T14:55:12.270Z", "publisher": "Linux", "title": "usbip: vudc: Fix use after free bug in vudc_remove due to race condition", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11394 }, "nvd": { "published": "2026-07-19T16:17:08.260", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63905", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "vudc_remove frees the enclosing vudc while its embedded timer can remain pending or executing against the freed object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/61704e5cf9cd7464b510eb606e7e2978b1160a64", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dcc1c90b28b28b7c493547506297e78653f81952", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1036ac6148995feaf486014d32bf26bf993c06a9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a0638db2340ee053ab0450656a763fd111475e54", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d07ed707467ce05ea9c03412d0c5ee9d0fe386a6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/88d459e5b5a46da1ef9fd6f52d9439343edeec88", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/207bf80362df3fce8ebc9723351dcb1bc6d9ed0f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d96209626a29ea64666be98c30b30ac82e5f1be6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1592, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63906", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:12.982Z", "date_updated": "2026-07-20T13:41:18.250Z", "publisher": "Linux", "title": "usb: musb: omap2430: Fix use-after-free in omap2430_probe()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 17, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00175, "percentile": 0.07229 }, "nvd": { "published": "2026-07-19T16:17:08.400", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63906", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "omap2430_probe drops the device-tree node reference before its final access, so the node can be freed while still in use.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/632fd888fe33083927e29ef651ac1aba345edd9e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b987f380620b38c84f054d5ff5c05861a7c2203b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/27e62532228dc42367bb43ebbcd7bf49d8db2b0d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/69f9f2b30af03d9b6e83f78fb0f734b6066d4678", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d53e4c41331f57b9fd78cbf3e480c6ce20aea07b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e194ce048f5a6c549b3a23a8c568c6470f40f772", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 382, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 17 } }, { "cve_id": "CVE-2026-63907", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:13.652Z", "date_updated": "2026-07-19T14:55:13.652Z", "publisher": "Linux", "title": "uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00189, "percentile": 0.08822 }, "nvd": { "published": "2026-07-19T16:17:08.517", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63907", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The driver explicitly frees devm-managed allocation memory and device teardown frees the same object again.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e344865bfca4eb37ed8d7ac5917226e49fcec7ce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f74c8696f14149d5e43cc28b015326a759c48f00", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 964, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63908", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:14.349Z", "date_updated": "2026-07-19T14:55:14.349Z", "publisher": "Linux", "title": "Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11394 }, "nvd": { "published": "2026-07-19T16:17:08.620", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63908", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An off-by-one greater-than check processes the first byte beyond an object's valid size and overwrites the adjacent configuration byte.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/862a1a32b5190241fce7a7d20229539a3926f31e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5c3681c3abc35cfac6b702251382312c60d96bc2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1017e1c6c6c49cccbcda9bbcfa49e50b0b6dad39", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e9b62996ba537774f68fecfd7eecb5aec1713952", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ae92e334544263a02d9f99e18385e718c44392c9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7f95f4792c0dc767fcb8e405391e779ab419d55a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c6b989b4ebf22b086fdfcac2163b5cb55e34d8f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/baa0210fb6a9dc3882509a9411b6d284d88fe30e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 926, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63909", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:15.060Z", "date_updated": "2026-07-20T13:41:19.196Z", "publisher": "Linux", "title": "ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 11, "versionRangeCount": 11, "defaultStatuses": [ "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00628, "percentile": 0.46661 }, "nvd": { "published": "2026-07-19T16:17:08.747", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63909", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A transposed ACE-size comparison is dead code and lets the DACL walker read ace size bytes even when fewer than four bytes remain.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5500ba1d410aed1eded3eb04a76b10cfb4409334", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f6324b4240cf0b26a84c33f68a1222d727ff4af2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0fe08c5776a798f46df1fd74b331be26bdd644d6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d333af32e4451285e427f2d9c29de3a39f6f6d48", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/94215d55b09445993929f4fc966061d61de74929", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4f7c131d2bdd7cd64b96f60d10be5ea72253f520", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0e60dafe97eca61721f3db456f97d97a80c6c8ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 944, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 11 } }, { "cve_id": "CVE-2026-63910", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:15.770Z", "date_updated": "2026-07-20T13:41:20.122Z", "publisher": "Linux", "title": "dma-buf: fix UAF in dma_buf_fd() tracepoint", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00154, "percentile": 0.05071 }, "nvd": { "published": "2026-07-19T16:17:08.857", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63910", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The file descriptor becomes visible before tracing finishes, allowing a concurrent close to free the dma_buf before the tracepoint dereferences it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b569f86e2f8dbf6f11d31d3de794d22e18098b23", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ead6680f354f83966c796fc7f9463a3171789616", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 928, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63911", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:16.496Z", "date_updated": "2026-07-20T13:41:21.102Z", "publisher": "Linux", "title": "xfrm: iptfs: reset runtime state when cloning SAs", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00157, "percentile": 0.0535 }, "nvd": { "published": "2026-07-19T16:17:08.987", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63911", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "IPTFS clones embedded queues and timers by value, causing the failed clone to free objects still owned by the original state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9327252e04626d4bb02ca8c0c108fbe8eabf0c5a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dfb9f6cbfa9826655a49698cf90eb800fce2178e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7f83d174073234839aea176f265e517e0d50a1d2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1070, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63912", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:17.188Z", "date_updated": "2026-07-20T13:41:22.064Z", "publisher": "Linux", "title": "xfrm: esp: restore combined single-frag length gate", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 28, "versionRangeCount": 23, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00704, "percentile": 0.49761 }, "nvd": { "published": "2026-07-19T16:17:09.097", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63912", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ESP fast path checks trailer and data lengths separately, then allocates one page for their larger combined aligned length.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cba", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 702, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 28 } }, { "cve_id": "CVE-2026-63913", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:17.917Z", "date_updated": "2026-07-20T13:41:23.046Z", "publisher": "Linux", "title": "netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00618, "percentile": 0.4621 }, "nvd": { "published": "2026-07-19T16:17:09.237", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63913", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "TCP conntrack accepts an invalid-sequence RST as a closing reply without checking packet direction or a matching opposite-direction SYN, allowing the packet to force the entry into CLOSE.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2006979a15af5404bf932a325357683c0bac1656", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6476c17d536dbd321c073242e762ddb2713a1238", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f5547bebc416d56f56fb5b86dc20aabfa42165a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f206def4e86d810f927ba1d8e322ea72b29bce58", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b98ab51c45c5608a1c19ce7fd17a3032469bb83f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d67c6adee8d1b65330d0174c4c367faba14e80a8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1100, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63914", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:18.618Z", "date_updated": "2026-07-20T13:41:24.004Z", "publisher": "Linux", "title": "xfrm: route MIGRATE notifications to caller's netns", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00156, "percentile": 0.05214 }, "nvd": { "published": "2026-07-19T16:17:09.373", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63914", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The XFRM migrate path hardcodes init_net and publishes one network namespace's notification to listeners in another namespace.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/bafc7d0774b9bf52909c70ed990bc5ccf7ec4bad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6df8157547347b5257bf640a0ae3dfc4411e06cd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fe463798343382c8fe9416a95959f005a3c30aa5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/00f2c451e57df50b1151d9b2254878f106b7c892", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a306cf2ac8849c487791369fad6f216399d000f6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/448bb92ca101dde8a6e88b4dc824044b4e341604", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/26ce8dbf2e23fe4fcc3351d19ef6d3fb703ed126", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7e2a4f7ca0952820731ef7bdadfc9a9e9d3571b4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1892, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63915", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:19.305Z", "date_updated": "2026-07-20T13:41:25.039Z", "publisher": "Linux", "title": "nfc: hci: fix out-of-bounds read in HCP header parsing", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00345, "percentile": 0.27117 }, "nvd": { "published": "2026-07-19T16:17:09.517", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63915", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The NFC HCI receive paths read an HCP header before confirming the frame contains one byte, and a zero-length fragment can also underflow the reassembly length.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ed6d5d97dad0334a7f43d218753429cbe2f70a4f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b99366d74b535d0cadb1ef73e04639415d9ff3b7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/37382293f174b82a0616c8295e32b1fc8e13d1ed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c4cc6b3b0013acb3ed0b2b60e57dfae98647fe98", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1905f5ec3641b2b234bb63549c8ca11ab85466eb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/22d41b176b9989efd21c3b2d3abf6728f05b9d9a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/83b1362edc9d6ae376c6f36da116e2c70f2e70a6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f040e590c035bfd9553fe79ee9585caf1b14d67b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 925, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63916", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:20.015Z", "date_updated": "2026-07-20T13:41:26.033Z", "publisher": "Linux", "title": "HID: wacom: Fix OOB write in wacom_hid_set_device_mode()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00345, "percentile": 0.27118 }, "nvd": { "published": "2026-07-19T16:17:09.657", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63916", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The HID path assumes every usage belongs to field zero, so a larger usage index writes beyond that field's array.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2add311d99646c9d235b2c44f9c169ba30f5db3a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/83bd8a5756a3c4a413ed8f6253f9eb2821e1ccaf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5716a293fb19d382ca2336e08fd28a619a5f3c25", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ed598de9f61582902406d352d99f2073d8e00298", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/43e7c02d6090a82fd60d63491f6871aec906345e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b8338111e14183972359009c12d0dbd81d2e1e16", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5db3fca0cec7b33bc5379411d0a60d792c9f9bc0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c0a8899e02ddebd51e2589835182c239c2e224ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 857, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63917", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:20.703Z", "date_updated": "2026-07-20T13:41:27.007Z", "publisher": "Linux", "title": "ip6: vti: Use ip6_tnl.net in vti6_changelink().", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.06039 }, "nvd": { "published": "2026-07-19T16:17:09.783", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63917", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Moving a VTI6 tunnel changes dev_net but leaves t->net at the creation namespace, so later relinking and cleanup use inconsistent state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0cdce7618464f7fb06f461e8f4ad575cb1d570f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f5c68875e25f331e497ddfbe81e2d8163a87f136", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d9c5eecdb3c740e65038651db7c686b10d76d1bc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f1e89a943ee574d0f2f16246eb3f2d7330fdeb03", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/225b467e3b631f38be22e4b38062a1fed02fdd21", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fc32be9ac2788524c6b24efd681cce7a6e731a92", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ee1778ba0f5cb53be771f97017d01eb356c797bf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1078, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63918", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:21.414Z", "date_updated": "2026-07-20T13:41:28.058Z", "publisher": "Linux", "title": "l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00159, "percentile": 0.05513 }, "nvd": { "published": "2026-07-19T16:17:09.917", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63918", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "l2tp_session_get_by_ifname increments a session reference after another thread can drop the last reference and free the session.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ee80455feffb9cb62b5b58715cabeff495e666b2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/947013fd7c8c35dd5856557b215840098a3f67f8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/782d60a6596aee9b29c2eecfa70033899278bf65", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/05f95729ca844704d15e49ce14868af4b403b32b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1914, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63919", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:22.121Z", "date_updated": "2026-07-20T13:41:29.060Z", "publisher": "Linux", "title": "xfrm: input: hold netns during deferred transport reinjection", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00633, "percentile": 0.46885 }, "nvd": { "published": "2026-07-19T16:17:10.030", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63919", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Deferred XFRM transport reinjection stores a network-namespace pointer without retaining a reference until the callback runs.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/7ee59eda8820b758ed29e1cd3222359c7b97302c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2df7059a18afb7d3aee6c36cad5d371c198111d4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8dfabcba6a943a7a02ebe1e1637c361ba96acbaa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/48ce101cd630d6745b6923b5bad8358bc4c119da", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/55ddfc41451f01c588089cd74957a05311b6f202", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9f7ebb45a83afc3216e855e57d51bb4bc9b5232e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9f67a36e91bb50d358760f381f233913fe5c09f8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c16f74dc1d75d0e2e7670076d5375deda110ebeb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 648, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63920", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:22.813Z", "date_updated": "2026-07-20T13:41:30.071Z", "publisher": "Linux", "title": "ipv6: validate extension header length before copying to cmsg", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00159, "percentile": 0.05579 }, "nvd": { "published": "2026-07-19T16:17:10.153", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63920", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting the on-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/81394827dfb72772c50d0ae3bdfa094428a5d76d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/931b4a1f13408c2507719890f78f7227c34a0282", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/08464413e628803bd10cb1df68d0138665f2f885", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a29768d56eb3798c052ad3281b05596e695a17af", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0d330eff318c0f44d4fb0ad2c2aef38f87f24c90", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a35daeabb433686234b010ebf7b53778dbd6c9b8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eb18a1b1644e4cad978df2131e2bb9a2e6886992", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dd433671fef381fdaf7b530c631e6b782d66e224", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1794, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63921", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.020Z", "date_published": "2026-07-19T14:55:23.539Z", "date_updated": "2026-07-20T13:41:31.106Z", "publisher": "Linux", "title": "ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00176, "percentile": 0.0733 }, "nvd": { "published": "2026-07-19T16:17:10.300", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63921", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Tunnel migration leaves authority and collision checks in the attacker's namespace while vti6_update mutates the creation namespace's hash.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/94ff740a7f9ef5c010784a325dca00cbf228f941", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/df42ac708acc3399bbb6dc5ca16e0540adda7bbf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/44d2ff7d2178503b93151140a45dfa2ad49c9906", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1acfb7d9c6fc7e209ed7789392697e97e03edd33", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d2236348414bdd6558385f35aa7fdc9bf5634011", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/853f6ea482dfcd3404bbef458ab4d68364eed838", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/596f6354c96a891e58c04a09cbfb7b0d1ec00dab", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8b484efd5cb4eeef9021a661e198edc5349dacf6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1834, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63922", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.021Z", "date_published": "2026-07-19T14:55:24.268Z", "date_updated": "2026-07-28T13:41:19.238Z", "publisher": "Linux", "title": "ipv6: exthdrs: refresh nh after handling HAO option", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00695, "percentile": 0.49429 }, "nvd": { "published": "2026-07-19T16:17:10.440", "lastModified": "2026-07-28T14:16:39.443", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63922", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The IPv6 TLV parser keeps a network-header pointer across a helper that can reallocate the skb head, then uses the stale pointer for later options.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 560, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63923", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.021Z", "date_published": "2026-07-19T14:55:24.985Z", "date_updated": "2026-08-03T09:32:36.909Z", "publisher": "Linux", "title": "octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00162, "percentile": 0.05815 }, "nvd": { "published": "2026-07-19T16:17:10.560", "lastModified": "2026-08-03T10:16:32.130", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63923", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The representor event handler uses an attacker-controlled nested pcifunc as an array and mailbox index without validating its PF/VF range.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/4467fa514482bbce82f73788943c815f3d126ab3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/68be0260e2a02ff9b18a8678d5f8d1715fa20138", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2156a29aecfffa2eb7c558255690084efbe9f3b0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1539, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63924", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.021Z", "date_published": "2026-07-19T14:55:25.702Z", "date_updated": "2026-07-20T13:41:34.095Z", "publisher": "Linux", "title": "ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00695, "percentile": 0.49429 }, "nvd": { "published": "2026-07-19T16:17:10.667", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63924", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ipv6_hop_jumbo retains a network-header pointer across pskb_trim_rcsum even though that call can relocate the packet buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/645b99b1a185c91a79bdac4c5de0f91b212d64f0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9e883eaa878f4337b5873c706efb5a192364ed18", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bddaa4dfc7f36e1ee343a0622f69288af2b9ace9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/72af7beae774e46ed543f3f2f267bf0a141bfcdd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c512e1c819dfbf6ae95ee7a44b65b9ad98979157", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2b56bbd928c030894c270cd33d60286326919458", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d47548a36639095939f4747d4c43f2271366f565", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 272, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63925", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.021Z", "date_published": "2026-07-19T14:55:26.442Z", "date_updated": "2026-07-20T13:41:35.092Z", "publisher": "Linux", "title": "macsec: fix replay protection at XPN lower-PN wrap", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00341, "percentile": 0.26688 }, "nvd": { "published": "2026-07-19T16:17:10.787", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63925", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The MACsec XPN replay window fails to advance when the lower packet number wraps, so the captured terminal packet remains acceptable indefinitely.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/dd7306779c6ce1238f4cdc34f3c1f2246b854457", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d15130461df388136b62a7b0ce9f66e7e2fa9ff1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/23c0e230eab397d7f68be2538790ac41d3bb91fd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/679e13a65e68a67c8b3c0467c02ee89157ec6f0f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/79495a1b0944fe31ffd54b54b00211b493590d62", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6d00f5c7e5ff7ec4795b7f5f8ed88bd346641652", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d55acbe577db892b60547b6ef1c020b359331a6d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e68842b3356471ba56c882209f324613dac47f64", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 742, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63926", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.021Z", "date_published": "2026-07-19T14:55:27.154Z", "date_updated": "2026-07-20T13:41:36.086Z", "publisher": "Linux", "title": "bpf: sockmap: fix tail fragment offset in bpf_msg_push_data", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.0018, "percentile": 0.07796 }, "nvd": { "published": "2026-07-19T16:17:10.913", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63926", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A global offset is confused with a fragment-local offset and corrupts the scatterlist.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f14609d8146707452e0822f3c8154674ce677251", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d81b323af2dcee47573907ccb89c0df9b45cb2e2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aeb95146848d12206e1b2cfacd4f40e21ce81d94", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/96b72672ce849a1402730238e64d9b20bf06a96d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3075c21d2d76c0067f4a382765b43d6cc10470f1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5e19028667963fb371ebb00cecc2a473ef92056b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/63f64a510c7917658ddf4d073ece73914ee25346", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f72eed9b84fb771019a955908132410a9ba9ea3f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 667, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63927", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.021Z", "date_published": "2026-07-19T14:55:27.864Z", "date_updated": "2026-07-20T13:41:37.085Z", "publisher": "Linux", "title": "usb: dwc2: Fix use after free in debug code", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0016, "percentile": 0.05596 }, "nvd": { "published": "2026-07-19T16:17:11.040", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63927", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Debug code dereferences urb after usb_hcd_giveback_urb has transferred ownership and may have freed it.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d5fc183ed614aeba6779cc992325be560f9a4451", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/63b0dafa676aad4d0c3f01a61ad8e2990907660c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9fe1d84f7e2cf33634e8afb7f4b7f8de182dd913", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0584af4fe40fa5e254a05d69ce658746de641708", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a15eeeceb94cbc04edef395e4d777ff554bdc27d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/84ea928ed584756e59c6ac09736f12d1db95ded0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6d0b79d1d1118145e48a68192b6d733e39387053", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9ea06a3fbf9f16e0d98c52cb3b99642be15ec281", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 228, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63928", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.021Z", "date_published": "2026-07-19T14:55:28.593Z", "date_updated": "2026-07-19T14:55:28.593Z", "publisher": "Linux", "title": "USB: serial: omninet: fix memory corruption with small endpoint", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11392 }, "nvd": { "published": "2026-07-19T16:17:11.163", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63928", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The omninet driver allocates bulk-out buffers from a device-reported packet size but later performs a larger hardcoded transfer into them.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/180996f0ca774001944e4afa452d569ba2f6455c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b496e25ead5976bce2891dacaed09beb53a54f9f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4e7d32189d6219beb7db37cd0ea36b6bac7dfedb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9a3860454bdfb765f936965e975c594352602ffc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0bda1893e4cc4ad2b7dcdbaca246f2af688c6c2a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0fee0ccac29e088d4bfab7e2d075725dcecd803d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f34cf2928387fba01a78381f3258c7e1428897d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/60df93d30f9bdd27db17c4d80ed80ef718d7226b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 346, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63929", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.021Z", "date_published": "2026-07-19T14:55:29.309Z", "date_updated": "2026-07-19T14:55:29.309Z", "publisher": "Linux", "title": "iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10054 }, "nvd": { "published": "2026-07-19T16:17:11.277", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63929", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The IIO enqueue path retains the initial DMA-fence reference after reservation ownership is established, leaking one allocation per enqueue.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9678aeed8b77d495a417dd057d479f3733094019", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3412a95afaa5d3262008dfc34f3c7be33d8151dc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/96cdeaba6a008503455b78a9641c05c2a886a7ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a093999355084bdbfe6e97f1dd232e58a1525f0b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1236, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63930", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.021Z", "date_published": "2026-07-19T14:55:30.016Z", "date_updated": "2026-07-20T13:41:38.070Z", "publisher": "Linux", "title": "iio: buffer: hw-consumer: fix use-after-free in error path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0016, "percentile": 0.05597 }, "nvd": { "published": "2026-07-19T16:17:11.380", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63930", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The IIO cleanup loop frees its current buffer and then reads that freed entry's next pointer to continue iteration.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b71893c57730809c222766e5718bb33610f11963", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2ff615fc455acda5425c4900160cbe11cfea4449", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d2759d49860b9a39b5cde2fb88e4b822ddf5f58f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/29783e6b6ec0b7152a15e53a063f17537e81177d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e965627f0d442bfcae3f496c90cb653fb0917a61", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a3763ae33476328cf8d661742deb9daec78eac96", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9319c94f63ed10723afd738d79f5617daba87cc8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 514, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63931", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.021Z", "date_published": "2026-07-19T14:55:30.718Z", "date_updated": "2026-07-19T14:55:30.718Z", "publisher": "Linux", "title": "iio: chemical: scd30: fix division by zero in write_raw", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11392 }, "nvd": { "published": "2026-07-19T16:17:11.507", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63931", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The sampling-frequency sysfs path divides by a user-controlled fractional value without rejecting zero.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/4748bce423a363bb8a85a624faeb8f54fe331611", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6308b812acdcac38cbfe1af0b1524c3375f408a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c7a740bf75554b051fabb17596ca6e483d6e6d90", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e85bc501947f5ae16dd9adc01162b76d55ab7962", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d98c2e69aab905d1b19a69ffe584efa46a9efd42", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5e4d34092a5ebfbc3a45a180c76ecb1cdbbedd53", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2c50c017df97bfb425038efdfb8514c7bcd08564", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5aba4f94b225617a55fed442a70329b2ee19c0a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 340, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63932", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.021Z", "date_published": "2026-07-19T14:55:31.460Z", "date_updated": "2026-07-19T14:55:31.460Z", "publisher": "Linux", "title": "iio: chemical: mhz19b: reject oversized serial replies", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09802 }, "nvd": { "published": "2026-07-19T16:17:11.633", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63932", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "mhz19b_receive_buf appends a serial chunk to a fixed buffer without checking remaining capacity, allowing an oversized reply to overwrite adjacent memory.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a5a05410cb34bfa486d63684cdc1f87a3b13f20a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ea69e7a6efa88ef32090a91064c362738cc19ddd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/673478bc29cf72010faaf293c1c8c667393335a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 627, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63933", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.022Z", "date_published": "2026-07-19T14:55:32.071Z", "date_updated": "2026-07-19T14:55:32.071Z", "publisher": "Linux", "title": "iio: gyro: adis16260: fix division by zero in write_raw", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.1139 }, "nvd": { "published": "2026-07-19T16:17:11.737", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63933", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "adis16260 write_raw accepts a zero sampling frequency and uses it as a divisor.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d2b83995759cfe5d06567bbcb600fe16d4048da3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/19eb8565c4500f9af17ec65eaf952365e2893351", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/59f80b945f2ca645064074d8507785c26ea16d2d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/86298fb6829cab983910810959f85d4b4fd0f5c1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aa8a5e118e97d2cfd0da5ea4f8f0f488efdea4b0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aaf9d640e9ae1172d0a9c659ecb245a50a10850a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5a42e39606b9bd6b40ed02bdfd04fe179d6173f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/761e8b489e6cf166c574034b70637f8a7eadd0ee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 316, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63934", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.022Z", "date_published": "2026-07-19T14:55:32.681Z", "date_updated": "2026-07-19T14:55:32.681Z", "publisher": "Linux", "title": "iio: gyro: itg3200: fix i2c read into the wrong stack location", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0021, "percentile": 0.11358 }, "nvd": { "published": "2026-07-19T16:17:11.857", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63934", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Passing &buf overwrites the stack pointer slot and can expose uninitialized bytes from the scan buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/90e809376b0f0d1ddec2eec954aecdd2a5b40b0e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8654b5e2617819ff4f7c78071dfd0275e971a9b6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b64dd5f3b38911054cbcc570df617e3e8e75e562", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/31bbd4b87dd6701fa10e03ba7f6268e49e178d16", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/63203bd072b613c18c237b906b1c9d2dc4527337", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/15a0b3f33ffb6c78b3de6f69b026ceb09b973dd1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cfc3283859cfdeacadf80d5e6880bdf871ffeaa6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6bdc3023d62ed5c7d591f0eb27a5adb37fb892ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1182, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63935", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.022Z", "date_published": "2026-07-19T14:55:33.321Z", "date_updated": "2026-07-19T14:55:33.321Z", "publisher": "Linux", "title": "iio: adc: nxp-sar-adc: fix division by zero in write_raw", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00189, "percentile": 0.08821 }, "nvd": { "published": "2026-07-19T16:17:11.987", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63935", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The ADC sysfs handler accepts zero or negative sampling frequencies as a divisor and also permits unsigned cycle-count underflow.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/cb6ea15e7d3c7518f806975a06b7d4c0a26402ea", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a9aba21a539c668a66b58eeb08ad3909e5a54c2a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 497, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63936", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.022Z", "date_published": "2026-07-19T14:55:33.942Z", "date_updated": "2026-07-19T14:55:33.942Z", "publisher": "Linux", "title": "iio: adc: mt6359: fix unchecked return value in mt6358_read_imp", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10054 }, "nvd": { "published": "2026-07-19T16:17:12.080", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63936", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A regmap read error is ignored and an uninitialized value is subsequently consumed.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6258bfec51e894ea97b8e69f3cde7af269b37de9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/944082fdb0284a31c0b37a88c8a1d4404da3a6d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a72f8e51d6ee66c255a8a93a4421b8a538d112a8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f9bbd943c34a9ad60e593a4b99ce2394e4e2381b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 599, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63937", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.022Z", "date_published": "2026-07-19T14:55:34.554Z", "date_updated": "2026-07-20T13:41:39.071Z", "publisher": "Linux", "title": "KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00163, "percentile": 0.05978 }, "nvd": { "published": "2026-07-19T16:17:12.193", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63937", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "KVM reads guest-writable PSC entries more than once without stable snapshots, allowing the guest to change indices or values between validation and use.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/bd232801ef1d1fd985d2d4ca3cd1d888303ca86f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b1dfaa6f7a957726a6800135be3659fbe4bbf2a4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/edbbe88f83b524434974e84808d3093199d67c24", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c8cc238093ca6c99267032f6cfe78f59389f3157", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 527, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63938", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.022Z", "date_published": "2026-07-19T14:55:35.168Z", "date_updated": "2026-07-20T13:41:40.069Z", "publisher": "Linux", "title": "KVM: SEV: Check PSC request indices against the actual size of the buffer", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0, "epss": { "score": 0.0018, "percentile": 0.07795 }, "nvd": { "published": "2026-07-19T16:17:12.323", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63938", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "KVM validates guest PSC indices against the maximum scratch size instead of the smaller effective buffer size.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5198f70c09a5f6e9e5f5a0a2c6b388f24294b176", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/75c8d1d7291268b479794fba5808971dc2f5eaf3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/505a3b94535583e4265360e2621734e355ef263d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/121d88de56bc5c0ba0ce2f6381af67f948a7e7c1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 398, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63939", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.022Z", "date_published": "2026-07-19T14:55:35.743Z", "date_updated": "2026-07-20T13:41:41.058Z", "publisher": "Linux", "title": "KVM: SEV: Compute the correct max length of the in-GHCB scratch area", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00197, "percentile": 0.09702 }, "nvd": { "published": "2026-07-19T16:17:12.433", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63939", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "KVM treats the PSC scratch length as a maximum even though it is only a minimum header length, permitting processing beyond the remaining GHCB shared buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6ca9400d36005ffdca25f80186bea781c7e1dc4c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9f0a9e780f02c02d025a190f1885e1d1d73b87bd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6644565527c4c5f507088b1c9ddf72de47790b68", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5867d7e202e09f037cefe77f7af4413c7c0fa088", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 827, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63940", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.022Z", "date_published": "2026-07-19T14:55:36.408Z", "date_updated": "2026-07-20T13:41:42.039Z", "publisher": "Linux", "title": "KVM: SEV: Ignore Port I/O requests of length '0'", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0, "epss": { "score": 0.0018, "percentile": 0.07796 }, "nvd": { "published": "2026-07-19T16:17:12.540", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63940", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "KVM's SEV port-I/O path subtracts from a zero-length request, underflowing the transfer size before the memory access.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3b6035bc6bff20e89752ce4358bc4c9a9d5883f2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2254972d4d69e279ba4e87bf0968eb08ad0d3c92", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c30cde934c7813b4e3069765dac64ce3d31e34f2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3988bd2723de407ae90fa7a6f6029b4e60238c58", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 377, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63941", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.022Z", "date_published": "2026-07-19T14:55:37.047Z", "date_updated": "2026-07-20T13:41:43.069Z", "publisher": "Linux", "title": "KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00154, "percentile": 0.05072 }, "nvd": { "published": "2026-07-19T16:17:12.643", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63941", "family": "HARDWARE_PHYSICAL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "KVM restores a guest hypervisor's uncapped ZCR_EL2 vector-length value into the physical register when the value was written through the untrapped ZCR_EL1 path.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/742a9b5ccd8c46caf983ca90c94f855466968e34", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/83726330748981372bde86ed5411d7b306612991", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1491, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63942", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.022Z", "date_published": "2026-07-19T14:55:37.717Z", "date_updated": "2026-07-20T13:41:44.057Z", "publisher": "Linux", "title": "parport: Fix race between port and client registration", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.06038 }, "nvd": { "published": "2026-07-19T16:17:12.747", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63942", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "parport publishes port devices before initialization completes, allowing concurrently registering clients to attach to a partial or tearing-down port.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f3378b0d7bd4605de89b083b2900788157a181cc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/290f515c5e3b3900bc2fe24f179999fd08d23bfa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d16548be2ea5058227d79799e81dab61c9bca8ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/15b1723c1472e802f9f7e69ae4e64f7dbf588848", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/51026cff1f4f3b762a0b5a07c727bd59cef45320", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/74d6aae1df45d3414178986be743f946988fddf6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a1e81b58da0179531bedf0b9f2811f5f992d5c4b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ef15ccbb3e8640a723c42ad90eaf81d66ae02017", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1400, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63943", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.022Z", "date_published": "2026-07-19T14:55:38.411Z", "date_updated": "2026-07-19T14:55:38.411Z", "publisher": "Linux", "title": "Input: xpad - fix out-of-bounds access for Share button", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 14, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10058 }, "nvd": { "published": "2026-07-19T16:17:12.880", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63943", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "xpadone_process_packet derives a Share-button index from an attacker-controlled packet length without checking the minimum offset.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/bcfb4833cd4078a1a356ef451838b75cd233099e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/37ec54abfdd63a63fd50734a9c4e4cbc1e5795af", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9749db57233b396353ad5dee81eec9d9880c9246", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6346b0895b574ce45f3747b9c508c72f70e6abef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6cdc46b38cf146ce81d4831b6472dbf7731849a2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 577, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-63944", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.022Z", "date_published": "2026-07-19T14:55:39.105Z", "date_updated": "2026-07-20T13:41:45.061Z", "publisher": "Linux", "title": "Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00324, "percentile": 0.24879 }, "nvd": { "published": "2026-07-19T16:17:12.990", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63944", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Bluetooth path dereferences conn after releasing its RCU and device locks, allowing a concurrent disconnect to free the object first.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a55618c0f4cead9e59c63f5ee030d393fd70d861", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a921957d39290143629eb38c4f74b9bef8035d0a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d9019210c8c30d40eb20094274cc647e352f48f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/380e67b1794a9a281a0cb592b4e62077fbd0c8ca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bfea6091e0fffb270c20e74384b660910277eb6c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1411, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63945", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.022Z", "date_published": "2026-07-19T14:55:39.859Z", "date_updated": "2026-07-20T13:41:46.058Z", "publisher": "Linux", "title": "Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0016, "percentile": 0.05598 }, "nvd": { "published": "2026-07-19T16:17:13.107", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63945", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "iso_sock_clear_timer reads a connection pointer without the socket lock while iso_conn_del can clear and free that connection.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d9cbf7144ec589a3f0cc91f74a1a1af2d2b14afa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/35f68f36d9883d56dec21cf85f7556d4657fc393", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/996c2104d0726a8fe584f85b3d6327197374a348", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bc08c15746f25f41dd0508b25780d1e84acbb2ef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/51cb9dcfdf9a1bccf312ab2ae4b62db629f7dcd5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4b5f8e608749b7e8fa386c6e4301cf9272595859", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1190, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-63946", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:40.577Z", "date_updated": "2026-07-20T13:41:47.085Z", "publisher": "Linux", "title": "Bluetooth: ISO: fix UAF in iso_recv_frame", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00327, "percentile": 0.25258 }, "nvd": { "published": "2026-07-19T16:17:13.223", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63946", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "iso_recv_frame drops its lock while retaining an unreferenced socket pointer that a concurrent teardown can free.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c57ea90f203c8b8b41a474f19a09000d0f841436", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/119fb6f80c44dc1c65d604cf28e64c56bd9b6568", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b04ec131325baf4ea4577d6c6e6b86cf092e3731", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c318aa51830a3d2cc1229968fe521441c97356cd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1a6b803b00ccdd7666506adbe01ddae1c72d1ca9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/47f23a259517abbdb8032c057a1e8a6bf3734878", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 610, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-63947", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:41.306Z", "date_updated": "2026-07-20T13:41:48.101Z", "publisher": "Linux", "title": "Bluetooth: HIDP: fix missing length checks in hidp_input_report()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00337, "percentile": 0.26259 }, "nvd": { "published": "2026-07-19T16:17:13.337", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63947", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "hidp_input_report reads keyboard or mouse fields without first verifying that the packet contains those bytes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1f08a90013e1e632b34321334e861fcefc056505", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cc3832b19f863e3677c5651f001a2e3795f39eb8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d313683d6ccdd8c01e0562270a2ae25b86d8461d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d7d6a81b8dd1a8d084a1b755db9406041d53adb5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6348dfed5b0f9c6074f14322332e97493d32fef0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b83dcacd2ec7fcc5a48be215f82d573759f87ec2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 824, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-63948", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:41.985Z", "date_updated": "2026-07-19T14:55:41.985Z", "publisher": "Linux", "title": "Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 28, "versionRangeCount": 24, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11389 }, "nvd": { "published": "2026-07-19T16:17:13.460", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63948", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The L2CAP timeout's null-connection return skips the reference release paired with timer scheduling.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/50f1bcaaaa3a80bb1c3472044bc146e8d49d51ee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b5c59a5b469e2a809a2d57eda4ded94235971060", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8894c2010435a56ce7c6c2a8785860c13554df2f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/63cd225cc13d782a85e2a73c04d0d350153eada1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/107c826e4ef9ec5ad8f60e6fe64d8d5325ba508f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e8a5baff5be273ca07771fd2b9bb1f2a4152917b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/08d81fe96f80a8e20c7acb573b6a45d901fcf2cd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9dbd84990394c51f5cee1e8871bb5ff8af5ed939", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 482, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 28 } }, { "cve_id": "CVE-2026-63949", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:42.679Z", "date_updated": "2026-07-19T14:55:42.679Z", "publisher": "Linux", "title": "auxdisplay: line-display: fix OOB read on zero-length message_store()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00172, "percentile": 0.06878 }, "nvd": { "published": "2026-07-19T16:17:13.600", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63949", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "linedisp_display reads msg[count - 1] before checking whether count is zero, so a zero-byte sysfs write reads one byte before the allocated buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ca5b0781946d5083ceafa752141f47f085853620", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8776032fe989a9b5fc77f2de5e03e4adb44c630e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3859960daeb9b7b39b9847b5b0113bc6081eb735", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/197476b126010bac1b3199833c6966cd6f54c2a9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6ad4f75ef9f3372fce8cad494e789ac6a5507bef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a7511dcd9dd4bc55d123f9b800c8a4ed2662e5c6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1532, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-63950", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:43.404Z", "date_updated": "2026-07-20T13:41:49.078Z", "publisher": "Linux", "title": "mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00162, "percentile": 0.05815 }, "nvd": { "published": "2026-07-19T16:17:13.730", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63950", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "try_to_unmap_one reuses a prior loop iteration's nr_pages value and applies the stale count to reference and map-count updates for a different folio.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0fcc34d0d8fefca4fea349e45c10e3a3d90350eb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f611db9b771b2b6775357555d2517af044fca4f0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3f8968e9cbf95d5d87d32218906cab0b9b9eddbe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1518, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63951", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:44.105Z", "date_updated": "2026-07-20T13:41:50.089Z", "publisher": "Linux", "title": "zram: fix use-after-free in zram_writeback_endio", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00165, "percentile": 0.06115 }, "nvd": { "published": "2026-07-19T16:17:13.837", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63951", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The zram completion handler releases its lock before wake_up(), allowing the writeback task to free wb_ctl in that window.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ebe2cbefc86291fa7f386447a81995640df4e2fd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bf62f69574b19720ae5fbbbcdf24a0c4e3e05e43", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2062, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63952", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:44.809Z", "date_updated": "2026-07-20T13:41:51.115Z", "publisher": "Linux", "title": "memfd: deny writeable mappings when implying SEAL_WRITE", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.0016, "percentile": 0.05656 }, "nvd": { "published": "2026-07-19T16:17:13.950", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63952", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The code applies the implied write seal only after checking for writable mappings, violating the required sealing order.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b3f4f82d1315f1439059a83d1c22c51a5b43d99e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3be2a24f7f72ad7321ed6ad1715b956a4527bcf4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0995d1f79aed8ccbf62056189dd53fd19726ea08", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/555702282d4536a865dfffb1cd4f6028f196e7e8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3b041514cb6eae45869b020f743c14d983363222", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 639, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63953", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:45.509Z", "date_updated": "2026-07-19T14:55:45.509Z", "publisher": "Linux", "title": "mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00189, "percentile": 0.08822 }, "nvd": { "published": "2026-07-19T16:17:14.060", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63953", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The huge-PMD migration abort path returns without freeing a page table allocated earlier in the operation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/24861d04f197bb651e9dfb211978271c15f75a98", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2c6f81d58741349298f51ff697d988cb42881453", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 382, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63954", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:46.183Z", "date_updated": "2026-07-20T13:41:52.092Z", "publisher": "Linux", "title": "hpfs: fix a crash if hpfs_map_dnode_bitmap fails", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.06039 }, "nvd": { "published": "2026-07-19T16:17:14.183", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63954", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "HPFS calls hpfs_brelse4 on uninitialized buffer-head pointers after hpfs_map_dnode_bitmap fails.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/010b08084000ef018f1a8de5197087f3b91d8cfe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d98d8562b3284b5a5c8eb67e71b794508e46e288", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1648a3c7f4e18f46a4881920133fc4f2494185a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7c58c55a2a16f7274772507bd1637be609351b4f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1d73a533760bc5abb83b3cc759133596f7bb708f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0886c6f257fe3663f80218aa1919b0f3f21bf22c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4f37bb30b57d6d403d02673074555bd3c3602bef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/974820a59efde7c1a7e1260bcfe9bb81f833cc9f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 235, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63955", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:46.903Z", "date_updated": "2026-07-20T13:41:53.082Z", "publisher": "Linux", "title": "mm/vmalloc: do not trigger BUG() on BH disabled context", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00468, "percentile": 0.38063 }, "nvd": { "published": "2026-07-19T16:17:14.307", "lastModified": "2026-07-27T17:44:23.777", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63955", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "__get_vm_area_node treats a bottom-half-disabled caller as interrupt context and triggers BUG even though vmalloc is valid in that execution context.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ad7eff07b625f53c3fb513b30d7a8c5a79fbc7ce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/04aa71da5f35aacdc9ae9cb5150947daa624f641", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 810, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63956", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:47.597Z", "date_updated": "2026-07-19T14:55:47.597Z", "publisher": "Linux", "title": "USB: serial: cypress_m8: fix memory corruption with small endpoint", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11391 }, "nvd": { "published": "2026-07-19T16:17:14.410", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63956", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Cypress USB serial driver accepts an interrupt-out endpoint smaller than eight bytes and then writes beyond the allocated endpoint buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/4fcb22218f0a7229b7ce3b3952fb644def293fa5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ad3d1628a46134276546d7a12fedf04be9979158", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/52e18ae0c47c5c89e18fcd8022f287f7cc8802ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4bcaa59f403dbde6328604a500d65ee8d40975d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1ef25704bd3b625fd151c09feee459479f71ee64", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/284105c40fc31fff90cdab8a0377aaeb92f87f0e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c13f3bb652bc8665e709ba07122612586aea648", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e1a9d791fd66ab2431b9e6f6f835823809869047", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 336, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63957", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:48.196Z", "date_updated": "2026-07-19T14:55:48.196Z", "publisher": "Linux", "title": "USB: serial: safe_serial: fix memory corruption with small endpoint", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11391 }, "nvd": { "published": "2026-07-19T16:17:14.533", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63957", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The USB serial driver trusts a device-reported bulk endpoint smaller than its eight-byte safe-mode write and corrupts the slab buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e3a1d6eee25dc96b1d2db0ecd9d8741e92056476", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c7336c0fba5c959249f3d793d33076b992ec3ee4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/161ea0e5236f5f051d2d85d6c54dd08ee9dc7ba4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9b3145b3001fb24de1da72d1deb0bea70e5a078b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a550ed2117ca4709d38f713933ff924a83942e41", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f793b67d41e5fab719c5a90baa77cbd2fe259517", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/857b3cc73f91871ae4433f8b97c4670b78f8dc96", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/438061ed1ad85e6743e2dce826671772d81089ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 306, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63958", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:48.835Z", "date_updated": "2026-07-20T06:41:38.075Z", "publisher": "Linux", "title": "usb: typec: ucsi: validate connector number in ucsi_connector_change()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00206, "percentile": 0.10771 }, "nvd": { "published": "2026-07-19T16:17:14.667", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63958", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A PPM-supplied connector number indexes the UCSI connector array without checking for zero or the reported connector count.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/cea949203faef9cb783adc7b978cce056271e057", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/156b6f0aec6108909b0c4aedc78865b12766b347", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bd24d92af4ae021b6209f28e9a57e1bf2260d4fd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0edd1e21587b0483c7ceb993b9fb9668bbef7433", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5af2719b460ab904c504fc069d1dd2a3aa2b22b0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/288a81a8507052bcfbf884d39a463c44c42c5fd9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 662, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-63959", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:49.553Z", "date_updated": "2026-07-20T06:41:39.202Z", "publisher": "Linux", "title": "usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10057 }, "nvd": { "published": "2026-07-19T16:17:14.780", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63959", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The TCPM driver trusts the header's data-object count without confirming that RX_BYTE_CNT contains the advertised body, exposing uninitialized stack bytes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0af00f1459f5dd757f0d392f8caa38039561ac62", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dc17721d42e6d89f63572e63add8306a0e15eb3c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9b496e3371c04f0a03b7faa5d2442536d00e3998", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c4ab8e2d4432abb646c5c0687f8dab173da901f9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aa2f716327be1818e1cb156da8a2844804aaec2f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 387, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-63960", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:50.282Z", "date_updated": "2026-07-20T06:41:40.389Z", "publisher": "Linux", "title": "usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11389 }, "nvd": { "published": "2026-07-19T16:17:14.897", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63960", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "wcove_read_rx_buffer accepts up to 31 wire bytes for a 30-byte structure and also passes a byte pointer to a four-byte regmap_read output.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3e632098d0521257ea965bbd6fde807d9bee5c8a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f2a1edc0bd142edabc6c85d88713f2bc178dd317", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6899f5b6d7b83ce79a3d331dc61dd31bf73f9c22", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5cd0e7ac4eefbdb330f8c72694fe74e63df65552", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d0e4b8b3c6b7607a16932556eaaca5d5cf69f192", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e94933dc41b87503bf585c8c6d53d740620eceb9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3f9d50c8b02b4af0646aa892465080f9061fc89c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4af7ad0e6d7aa4403dbb1dac7b9659b0421efcaa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1485, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63961", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.023Z", "date_published": "2026-07-19T14:55:50.993Z", "date_updated": "2026-07-20T06:41:41.563Z", "publisher": "Linux", "title": "usb: typec: altmodes/displayport: validate count before reading Status Update VDO", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11391 }, "nvd": { "published": "2026-07-19T16:17:15.033", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63961", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The DisplayPort status handler trusts an incorrect object count, reads uninitialized stack bytes, and sends them elsewhere.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/74aabe9ea30fdfba924fce9594e6aa69a596a4bb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dd7118c010f324497c275e8fd7a35c9baaa2a00f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6ffdbcd7a02f3af8fff9b6519830369f574ed44c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/70e7045849e954e56dcbf441b6330e66bc996306", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/64bd6ccc5799f8473d1f37d4d8f53093dfec5c02", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b10eff5abe6aa2a5af10ed17bddff76e3b6e6b9b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/77a759ec30bc5fb0dd9c867b711d0acfed6c7faa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8a18f896e667df491331371b55d4ad644dc51d60", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 388, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63962", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:55:51.682Z", "date_updated": "2026-07-20T06:41:42.766Z", "publisher": "Linux", "title": "usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10057 }, "nvd": { "published": "2026-07-19T16:17:15.163", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63962", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An SVID array bound is checked only once before a loop, allowing an unsolicited ACK to write past the array.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/845598b154b9a92e9d279fafafa9405c121ae805", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4505f33dab56c274e82f47f94bf60a8cbf8f4b42", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cbad85b446c06adbc5e5bed565871bb918ce9d32", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3389c149c68c3fea61910ad5d34f7bf3bff44e32", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1336, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63963", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:55:52.388Z", "date_updated": "2026-07-20T06:41:43.925Z", "publisher": "Linux", "title": "usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10057 }, "nvd": { "published": "2026-07-19T16:17:15.270", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63963", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A device-controlled VDO count indexes beyond fixed Discover Identity arrays because handlers do not validate the count.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/569f7971542eb10025d8a0989b83f28a29d8ba20", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f9d787fbe83127105e42088cca40e5118db0d810", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ed8649f3822e211d025bcab5158af6f8a38c8705", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8fbc349e8383125dd2d8de1c1e926279d398ab17", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 355, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63964", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:55:53.115Z", "date_updated": "2026-07-20T06:41:45.132Z", "publisher": "Linux", "title": "usb: typec: ucsi: ccg: reject firmware images without a ':' record header", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11389 }, "nvd": { "published": "2026-07-19T16:17:15.370", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63964", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A firmware image without a colon makes strnchr return NULL, yet do_flash compares and increments that pointer before rejecting the image.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b41dfc033fe594e152648050e95b9489cd53e9e3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2f395ca1263bd181995eb829f5943a83a20db213", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6526f8684f72391138353642af908803ba70795e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3f432b8203066c26770fe6ea591361f10021dd6b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c4ee519b06389e59ba2d6aa722fcc4a02a8bbcbb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a38ed87818b2419090fb1a6338ddce6842b65dfa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c8460de584fe5415d212cfdd127d4db90835a450", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d7486952bf74e546ee3748fb14b2d07881fa6273", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 903, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63965", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:55:53.809Z", "date_updated": "2026-07-19T14:55:53.809Z", "publisher": "Linux", "title": "iio: pressure: bmp280: fix stack leak in bmp580 trigger handler", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.098 }, "nvd": { "published": "2026-07-19T16:17:15.500", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63965", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The bmp580 trigger handler copies three sensor bytes into each four-byte stack field without initializing the remaining bytes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a58400f58f82f3d8de9c067aa7cda690228c1ecc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/58dfb6fe9dc80270cf7cc014837af4cbf928e3aa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/387c86b582e0782ab332e7bfcd4e6e3f93922961", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 811, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63966", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:55:54.391Z", "date_updated": "2026-07-19T14:55:54.391Z", "publisher": "Linux", "title": "iio: imu: adis16550: fix stack leak in trigger handler", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.098 }, "nvd": { "published": "2026-07-19T16:17:15.600", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63966", "family": "EXPOSURE_OUTPUT", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "adis16550_trigger_handler leaves four bytes of its stack scan record uninitialized and pushes them to userspace with every trigger.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ce582b22dd2ff15ac99101c22ec1559d1febe2ff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c2c255444392872cbbf46d640cb3a938e8000309", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/474f8928d50b09f7dcf507049f08732640b88b49", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 571, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63967", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:55:54.999Z", "date_updated": "2026-07-19T14:55:54.999Z", "publisher": "Linux", "title": "iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.1139 }, "nvd": { "published": "2026-07-19T16:17:15.700", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63967", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The tagged FIFO copies a stack structure containing an uninitialized padding hole to userspace.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ff8d3c088b77b11782f2c3b97e37425be050e8de", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fe1a7f99e72ebd2880515332b79b8c256be22aca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/babf1943a40bb5669db57d30ca16c22504b18e07", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d42ac0bfb6a16617c62a59d53706579c7fadbfa6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3147b303b8c7d9f91da4b849ece33b45048f5eaf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e6bb3a49c5f9de870ea95e69775df785728e3366", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/890d0312d5f94be43eac21f5a34d3bccc60d051b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c9d8e9adaa63150ef7e833480b799d0bab83a276", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 704, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-63968", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:55:55.620Z", "date_updated": "2026-07-20T13:41:54.077Z", "publisher": "Linux", "title": "ipv6: fix possible infinite loop in fib6_select_path()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 19, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00647, "percentile": 0.47483 }, "nvd": { "published": "2026-07-19T16:17:15.830", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63968", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An RCU writer removes the first IPv6 sibling while a reader still follows the old ring, so the reader never reaches its original termination node.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3948a7d92f7678e89e1776bb2d169afcad63b1ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c87cd3cb309634bc8f50a54e2079424f219ac21f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0f7b73c3452635de83b8711b31abdda8e49aad7b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ab9a10969a907b472a0196d999c08ff7144172e3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9b9d5bd6e3d4c9cecab5407604b690684b2532d2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9c7da87c2dc860bb17ca1ece942495d28b1ce3b9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 775, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 19 } }, { "cve_id": "CVE-2026-63969", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:55:56.330Z", "date_updated": "2026-07-19T14:55:56.330Z", "publisher": "Linux", "title": "ipv6: fix possible infinite loop in rt6_fill_node()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 19, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00206, "percentile": 0.10771 }, "nvd": { "published": "2026-07-19T16:17:15.947", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63969", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "rt6_fill_node can retain a detached route while iterating under RCU and repeatedly revisit it, leaving the traversal in an infinite loop.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b014a63d2f2c2c767762b548381882dfb1655529", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/279853aec9f58d5cd723e6e5617c1c3337b30383", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c65b1f60237daac7c56c2652e064cc566a45dc81", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dc36a04621dcc2447dae428709207810b6c06e14", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5e40de719ee76b8d96e2556ce36dbd3bd07bf37d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9f72412bcf60144f252b0d6205106abf14344abc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 718, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 19 } }, { "cve_id": "CVE-2026-63970", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:55:57.067Z", "date_updated": "2026-07-24T14:34:16.307Z", "publisher": "Linux", "title": "vsock/virtio: bind uarg before filling zerocopy skb", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00163, "percentile": 0.05977 }, "nvd": { "published": "2026-07-19T16:17:16.063", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63970", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The path binds uarg after filling fragments, so rollback frees managed fragments that no longer have a valid lifetime owner.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/72194f65050958e4c8e069adb6c5d89ef81ca197", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5d317573f1d48e76cce5fb6250452b6e4102e0fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1e584c304cfb94a759417130b1fc6d30b30c4cce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 815, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63971", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:55:57.792Z", "date_updated": "2026-07-20T13:41:56.086Z", "publisher": "Linux", "title": "sctp: fix race between sctp_wait_for_connect and peeloff", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.06041 }, "nvd": { "published": "2026-07-19T16:17:16.163", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63971", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "sctp_wait_for_connect releases the socket lock while peeloff can move the association, then resumes under the old lock without rechecking asoc->base.sk.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0e0d5bc76fd4267a71334fcc8f1a5fbcf997845d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bcfeac79af740735ace44008b4a11b8e5add20f5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8e9b56051d24540cfbf39194618708c4a7633549", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/634a9af8a26a84d8b0d7b3b643204b344b42d9fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7d2038d4b80166f7bead8d07eba3b97405816c21", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/68667ee4c7dadf7f63167234e2a1af09b3f7874e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6140cfa721451fa6e18e134e709703c2bf34d0fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f14fe6395a8b3d961a61e138ad7b36ba3626dd4e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 743, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63972", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:55:58.503Z", "date_updated": "2026-07-20T13:41:57.080Z", "publisher": "Linux", "title": "net: mana: Skip redundant detach on already-detached port", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 9, "versionRangeCount": 8, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00576, "percentile": 0.44227 }, "nvd": { "published": "2026-07-19T16:17:16.283", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63972", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The MANA error path detaches an object again after a failed attachment has already transitioned it to the detached state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c4152b4e28b3e550ec99351bf900e2c24c2608cc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7ae590797f9b5c240aaea5773f5f00977a42a846", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5b05aa36ee24297d7296ca58dfd8c448d0e4cda3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 697, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 9 } }, { "cve_id": "CVE-2026-63973", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:55:59.263Z", "date_updated": "2026-07-19T14:55:59.263Z", "publisher": "Linux", "title": "net: mana: Add NULL guards in teardown path to prevent panic on attach failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00206, "percentile": 0.10771 }, "nvd": { "published": "2026-07-19T16:17:16.383", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63973", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Partial queue allocation frees and nulls MANA queue pointers, but later teardown paths dereference those pointers without checking the failed-allocation state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/da7e4a1aaf397af6a094f640c92d6bc7564c10db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/95e414f8324385771bdfd6d497a01d5593813ccb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/26a96fa81496afe7d162d172ccdc8cb9dbc685d2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/da87896f34e0a51489811d1a684e2953099ca98f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0a9c520fdcb1cb2e79c163c12d359b5e1ee40007", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/17bfe0a8c014ee1d542ad352cd6a0a505361664a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1049, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-63974", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:55:59.994Z", "date_updated": "2026-07-20T13:41:58.081Z", "publisher": "Linux", "title": "Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00317, "percentile": 0.2414 }, "nvd": { "published": "2026-07-19T16:17:16.500", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63974", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Bluetooth close can drain the workqueue without marking commands for draining, allowing new timeout work during teardown.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9cebe4680bb9a72f80c6541eb24af06db7a1fbc9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/47330cc875b36a1cf7b3543cb2cf90a7c603ce0e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/525daaea459fc215f432de1b8debbd9144bf97b0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 322, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-63975", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:56:00.662Z", "date_updated": "2026-07-20T13:41:59.074Z", "publisher": "Linux", "title": "Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00345, "percentile": 0.27118 }, "nvd": { "published": "2026-07-19T16:17:16.603", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63975", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The duplicate-CID error path deletes channels while iterating the same list, invalidating the saved cursor and permitting a crash.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3c8eaa91eb433c450426539290be4ffe282e9f00", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ecfed1e0d8efecad6737a0d83e21d2fd021d8c48", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e6833e737a51db1e5ea0401322acf5e22abd8be6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6319b38fe69f56ed95680ade485b957a53fff642", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/291eec1041c918c460dc9702e44edd17794b4a4b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/41e29548b5e8b5e5fcf708786b3bea67cab107fa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d153b8898c0051eb8b6a083b35cbe304a5886bd5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/41c2713b204e6cb6a94587bc6bf6935107df5479", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 613, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63976", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:56:01.284Z", "date_updated": "2026-07-20T13:42:00.067Z", "publisher": "Linux", "title": "Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00443, "percentile": 0.36455 }, "nvd": { "published": "2026-07-19T16:17:16.733", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63976", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Linux L2CAP accepts a stale signaling identifier and applies the replayed response to a newer channel, deleting the wrong channel state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/59f5ecf6ad5c4db6ae81965a96156954a3b0d89a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ae0152d77d101c920769934fb102b18de0c6f526", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c2afd2613fda90107c5e2fe8e855627451749c78", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cc2b4f749de09975bfa06e58bbbad2f6acd4c79c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3b5b5f423b4fd23404a393bda8adba3cd6f74ef1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f39049304ba655ffcbb92edbdf8c51a1f1210bed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8e7977afaef37c6bd2b2654f1bce6ab40d471147", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/00e1950716c6ed67d74777b2db286b0fa23b4be9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 893, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63977", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.024Z", "date_published": "2026-07-19T14:56:01.889Z", "date_updated": "2026-07-20T13:42:01.088Z", "publisher": "Linux", "title": "dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.0219 }, "nvd": { "published": "2026-07-19T16:17:16.860", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63977", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Device teardown can cancel change_work and then race with a callback that reschedules the same work against a freed or null dpll_dev.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e7a33807fb3f87a855993474ac21684ce105927b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d733f519f6443540f8359461a34e3b0042099bbe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 684, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63978", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:02.484Z", "date_updated": "2026-07-20T13:42:02.047Z", "publisher": "Linux", "title": "net/handshake: Drain pending requests at net namespace exit", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00598, "percentile": 0.45256 }, "nvd": { "published": "2026-07-19T16:17:16.957", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63978", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Network-namespace teardown transfers the pending handshake list in the wrong direction and lacks ownership coordination with concurrent cancellation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9ec20c9a5a04f2c3f1cf65d21f886d7aaa6189cd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8c35539db0ab0bfa1ea44efab00b053261a69469", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ea5fe6a73ca57e5150b8a38b341aef2636eb72f0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2316, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63979", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:03.177Z", "date_updated": "2026-07-20T13:42:03.030Z", "publisher": "Linux", "title": "net/handshake: hand off the pinned file reference to accept_doit", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00516, "percentile": 0.41086 }, "nvd": { "published": "2026-07-19T16:17:17.070", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63979", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The handshake accept path dereferences socket and file objects after dropping the pending-list lock without first taking an independent file reference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c06876d4fac38f35820946ee3b1be7d7da799cd4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f4251190e58b209999c1ba9e6d2976136a1be055", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1919, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-63980", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:03.887Z", "date_updated": "2026-07-20T13:42:03.955Z", "publisher": "Linux", "title": "net/handshake: Use spin_lock_bh for hn_lock", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00441, "percentile": 0.36232 }, "nvd": { "published": "2026-07-19T16:17:17.170", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63980", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A bottom-half callback can acquire hn_lock while process context holds it with softirqs enabled, deadlocking the same CPU.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/06ab5978866fc2221b910347fd3e510ca8e7b1a4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0866569fc36a56f568acd3900d354e3505932e09", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/91898de9501a047ba67c6b864dcd403e00bdfbf5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cc993e0927ec8bd98ea33377ada03295fcda0f24", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1249, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63981", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:04.580Z", "date_updated": "2026-07-19T14:56:04.580Z", "publisher": "Linux", "title": "net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 7, "versionRangeCount": 6, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00188, "percentile": 0.0862 }, "nvd": { "published": "2026-07-19T16:17:17.283", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63981", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The blockcast path returns before incrementing the mirred recursion counter, allowing two devices to mirror a packet recursively until the kernel stack is exhausted.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/25fc9352590f5ef21ebf290432bd768b336693bc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/34457de389fb64a01fdcc71177dfebe65fd2d362", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a005fa5d7502eefec7ee6e1c01adadc06de2f9ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2078, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-63982", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:05.329Z", "date_updated": "2026-07-19T14:56:05.329Z", "publisher": "Linux", "title": "net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 7, "versionRangeCount": 6, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09803 }, "nvd": { "published": "2026-07-19T16:17:17.390", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63982", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Ingress redirection defers the packet and clears loop-tracking state, so a two-interface mirred cycle is never terminated.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/66f4607fe788fc7d81bce0e2f7b3726ed2f71284", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/45ac526a0d5733c3695946bd84ec57f24d8f5e66", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/db875221ab08d213a83bf30196ae8b64d55a3403", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 797, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-63983", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:06.047Z", "date_updated": "2026-07-19T14:56:06.047Z", "publisher": "Linux", "title": "net/sched: fix packet loop on netem when duplicate is on", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06235 }, "nvd": { "published": "2026-07-19T16:17:17.490", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63983", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Nested netem duplication re-enqueues packet copies without a per-packet recursion guard and can exhaust stack or memory.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1a298a514ce766c6d0c232991a390fec67af81ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cfb2616042767ab31260d4f39190c381bec8b12e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 864, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63984", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:06.786Z", "date_updated": "2026-07-20T13:42:04.995Z", "publisher": "Linux", "title": "ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00514, "percentile": 0.40948 }, "nvd": { "published": "2026-07-19T16:17:17.590", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63984", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A decompressed RPL header length overflows an 8-bit field and places the compressed header over the output region that is still being written.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/75b3680047bf09af8e7e471a7a6ddf2ce5847f56", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fd238c51b0fa5390cceca9f1ac5a9ffda8063eed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3618b34942b76471d044369bfd30d58c39068bf1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/97e06791368c01f0ad2a4b3269c2abe19485ca32", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/de02fc049352af5a9595f015511222d0a85c326b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6fe1cb312038516cb4d9fa089d700af7059f1a64", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c0487a9c1e116cf349e2d1f302d9019670460858", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9d5e7a46a9f6d8f503b41bfefef70659845f1679", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1373, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63985", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:07.527Z", "date_updated": "2026-07-20T13:42:05.985Z", "publisher": "Linux", "title": "ethtool: eeprom: add more safeties to EEPROM Netlink fallback", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02968 }, "nvd": { "published": "2026-07-19T16:17:17.723", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63985", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ethtool EEPROM Netlink fallback checks offset alone but not offset plus length against the EEPROM size, allowing a request range to extend beyond the backing object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0e182689831277faf2ef683573a60474c208f690", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6ed7ebe22e9c3e3e946b6973c1ce43d3c38aeac1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/65674d2489a12b8efd2ca0effb3de1d12224b596", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d81376053a00865c70b8d8506a1cb93f2943d413", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fd0de51c54fa8474a0ddeedd71c65ad09fada390", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4fe1bc4b3603f621240d5b401742f302190db769", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/67cfdd9210b99f260b3e0afeb9525e0acc7be31e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 864, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-63986", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:08.203Z", "date_updated": "2026-07-19T14:56:08.203Z", "publisher": "Linux", "title": "ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06234 }, "nvd": { "published": "2026-07-19T16:17:17.847", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63986", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ethtool error path passes an ERR_PTR as a message header to genlmsg_cancel after preparation failed before any message began.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2008f9bb1ede9b688624a241228b8e54fc74f0f6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d0d2c5ccd1de28368cebeef74d9c530a60eff9a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c3fc9976f686f9a95baf87db9d387f218fd65394", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 380, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63987", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:08.940Z", "date_updated": "2026-07-20T13:42:06.953Z", "publisher": "Linux", "title": "ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02913 }, "nvd": { "published": "2026-07-19T16:17:17.953", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63987", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ethtool handler writes every user-supplied nested profile into a fixed five-entry array without bounding the entry count.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d4c9cc7c47781c6f4fa29d80a1193a8bcd1525bc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0c02c190bcd9822477038ff2cee10ea584ac1b1d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6205f7166d2dd14a017a5802c81e5bd1421a8635", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7281b096b072f6c6e30420e3467d738f2e4c4b57", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 530, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63988", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:09.677Z", "date_updated": "2026-07-19T14:56:09.677Z", "publisher": "Linux", "title": "bridge: Fix sleep in atomic context in sysfs path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06219 }, "nvd": { "published": "2026-07-19T16:17:18.060", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63988", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The bridge-port update path holds a spinlock while calling dev_set_promiscuity, which may sleep.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e976e3f2f2005c6267089a1a3b6344f234a59a55", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2f9cb30d97e45686f3119fff3b30f12259950910", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6d34594cc619d0d4b07d5afcad8b5984f3526dcf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3016, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63989", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:10.396Z", "date_updated": "2026-07-19T14:56:10.396Z", "publisher": "Linux", "title": "bridge: Fix sleep in atomic context in netlink path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06219 }, "nvd": { "published": "2026-07-19T16:17:18.260", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63989", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The bridge netlink path calls a sleepable promiscuity update while holding a spinlock in atomic context.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c9c2e609e8397bb57b4d73675f33a99183c4a0bd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/803d39accfbdf223ccbb49684d5b5069b4c44586", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5eec4427b89c2fb2beac54920101e55a2f1c0c21", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3226, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63990", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:11.111Z", "date_updated": "2026-07-19T14:56:11.111Z", "publisher": "Linux", "title": "bonding: refuse to enslave CAN devices", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00181, "percentile": 0.07896 }, "nvd": { "published": "2026-07-19T16:17:18.610", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63990", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Linux bonding accepts a CAN device as a slave even though the CAN networking path cannot satisfy the bonding lifecycle assumptions.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/69b78b5f3033272e53a2dc2dad675962654a5b38", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/41e8478c4cd896d3abbe33d41afc90c84ac66602", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f4d78a81f57df82e9d82a2c07471fed1a1235893", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/02f1c87ded33b43d48b4a1d665da15f2157b30d8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9ea8a648d9120f7652bcde1ce2c4ad66871af707", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/563090e5d450c665f70d955a39f9587afc7842eb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8ba68464e4787b6a7ec938826e16124df20fd23d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1668, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-63991", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:11.824Z", "date_updated": "2026-07-19T14:56:11.824Z", "publisher": "Linux", "title": "Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07403 }, "nvd": { "published": "2026-07-19T16:17:37.783", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63991", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "send_mcast_pkt passes an unchecked NULL result from skb_clone to send_pkt, which dereferences it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9afcb5ea080af13aab37930da627db43bd277665", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9903a04becf059e44cccf625e23689b7d4378384", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d630c4b25f36e0e68461561e4c70957ec37fdedd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b06203ac5f12929d79146bb9f063c2af1d679e63", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3d5d81d294ba09487c86bc4ba33dc4a4bec5d215", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e673889a35a5e4c586d0fae67d8755ca4367d3e2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2061d080a013c0ec0a56162cd501fb36d2befc26", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3c40d381ce04f9575a5d8b542898183c3b4b38dc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 443, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63992", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:12.528Z", "date_updated": "2026-07-20T13:42:07.956Z", "publisher": "Linux", "title": "tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00514, "percentile": 0.4095 }, "nvd": { "published": "2026-07-19T16:17:38.700", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63992", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "iptunnel_pmtud_check_icmp can run without a transport header, treating the unset-header sentinel as an offset and reading out of bounds.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5a92cb45e34749865d03daf8d3500f77b5f6644c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c7b7ec3e69e673c0d6b57f74d21da50c485c598e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7f4f7efe7f30edd29c4988de01728bf2398217e4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e917d0c69f01af2bb4fbea2b66d560a53b3ac7ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a096b6e34f602950af9a2b0856cd93a5f4c276d7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/43368636c663cff6e59dde93cf4b8e43ac28eb93", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cb549df9ce4ee15c9d5b19ddab12cf2128e4313c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/509323077ef79a26ba0c60bb556e45c12c398b2d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 493, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63993", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.025Z", "date_published": "2026-07-19T14:56:13.218Z", "date_updated": "2026-07-20T13:42:08.907Z", "publisher": "Linux", "title": "vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00514, "percentile": 0.40951 }, "nvd": { "published": "2026-07-19T16:17:38.823", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63993", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "skb_tunnel_check_pmtu() can move the packet head, but VXLAN reuses a cached IP-header pointer into the old allocation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6b8bfce9d2f774d2c2243e0248e03efb99bba6c0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9257f56ac47ef1976bcd056cf986a9988eeec67a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8d435d68d71fb875876b722f4136caf74f2f48bd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dc3bfa050f873371e745bdf478b1f5b738e5733d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/609e63312c29aad18026a1d3222e123d4b6b0feb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5303925e360527243b46a440a04667826bbc72b7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a493efd4336cf19122ae0e4cbb3d31b32d70deea", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7d9ef0cb271555d8cf39fefe6c981e1493b25ecf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 354, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63994", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:13.896Z", "date_updated": "2026-07-20T13:42:09.911Z", "publisher": "Linux", "title": "tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00521, "percentile": 0.41343 }, "nvd": { "published": "2026-07-19T16:17:38.943", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63994", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The tunnel PMTU code caches a packet-header pointer before skb_cow(), which can move the skb head and leave that pointer dangling.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/95b6d772bfe788331d9742d73eaa12e113b2adc4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7254aef4d1a7e18e887af9010e2f2dc34806789b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bf8b3f34c37c162357138e7c0942723b8b94fed1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/76cd9398a0470257ab765bdf5f358a2af2e17934", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/50750d86a2e5266aba0c295483b3397843198b11", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6dff77899b9e9fe5d854abda3a98ad04e7229ef7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f3f204541f280a6ecb04503a0d6794d93990ca43", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b4bc94353050b1fa7b702bd4c6600710dd926cff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 474, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-63995", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:14.580Z", "date_updated": "2026-07-20T13:42:10.891Z", "publisher": "Linux", "title": "ethtool: cmis: validate start_cmd_payload_size from module", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02909 }, "nvd": { "published": "2026-07-19T16:17:39.067", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63995", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The CMIS firmware updater uses a module-supplied payload size as a memcpy length into a 112-byte destination without an upper-bound check.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/63112b4515469d00008452d9cfe3fb3bf1aa2df3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0696709e951be54c699664adf546d16e28974d53", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a46340da00385be7fb16c62425ebc20006f2d5d8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/12c2496a71f82f63617971ca9b730dffa05cf58b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 654, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63996", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:15.256Z", "date_updated": "2026-07-20T13:42:11.911Z", "publisher": "Linux", "title": "ethtool: cmis: require exact CDB reply length", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02911 }, "nvd": { "published": "2026-07-19T16:17:39.170", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63996", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The CMIS reply path accepts a response longer than its fixed-size allocation and writes the excess payload beyond that allocation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2f818cc98fd2c63a08239cb48995f6c3bfe9d9b3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4d42fb88ec61f2e98c33a9e3a2de371d5edbc6b1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eb5dcd740cd7fa27bc2caeff2d28ef28e93ff4d3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c3f999a9d1338c6c89a9ff4549eafe72bc2e7b1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1341, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63997", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:15.965Z", "date_updated": "2026-07-19T14:56:15.965Z", "publisher": "Linux", "title": "ethtool: module: avoid leaking a netdev ref on module flash errors", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06417 }, "nvd": { "published": "2026-07-19T16:17:39.270", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63997", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A module-flash scheduling error leaves the in-progress flag set and a netdev reference unreleased.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f7b4513e77f9571dc1041a798b93b5c4a4bfc191", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/61848c83b9132ab839809fe415ba7802a0aca4f6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/956b134d917fd7e014dc7e39a9b7610c04fcc9ba", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fb7f511d62692661846c47f199e0afe25c2982db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 326, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-63998", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:16.664Z", "date_updated": "2026-07-19T14:56:16.664Z", "publisher": "Linux", "title": "ethtool: module: call ethnl_ops_complete() on module flash errors", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06238 }, "nvd": { "published": "2026-07-19T16:17:39.370", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63998", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A validation failure returns after begin without calling the matching completion operation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d9defbf8b62bde89e206d74c2a2b445b9ed66108", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e96ef1a40dda5b637b1911cd950b11e9848de939", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/84371fb58423f997939aacdcbc02d128d76a54e5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 245, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-63999", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:17.383Z", "date_updated": "2026-07-19T14:56:17.383Z", "publisher": "Linux", "title": "ethtool: rss: fix indir_table and hkey leak on get_rxfh failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06234 }, "nvd": { "published": "2026-07-19T16:17:39.477", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-63999", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "rss_prepare_get returns after get_rxfh failure without releasing its allocated indirection table and hash-key buffer.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/33d05c22d6f227c5ae171c46df2f6f8bf48047ea", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/80d95d92f828cfcace955d673637d944178b435f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/266297692f97008ca48bc311775c087c59bd7fe3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 357, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64000", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:18.116Z", "date_updated": "2026-07-20T13:42:12.905Z", "publisher": "Linux", "title": "net: hsr: fix potential OOB access in supervision frame handling", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00491, "percentile": 0.39549 }, "nvd": { "published": "2026-07-19T16:17:39.590", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64000", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The HSR parser can access a complete supervision TLV header after linearizing fewer bytes than that header requires.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/09a37dca090c55ffb1a33f52d8667f1c2367ef48", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a4b64f3e9c7b8259f7dd251a0313420ba7c01852", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/71c986c0ba45b7dc574fae27c83e7b6671556f37", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fbd0662f9c9a66e8cc3df3099cca8ed6d3837cc7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/78607a6854a22a2502f68092202e75a39af4865d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f229426072fc865654a60978bb7fda790a051ff3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 327, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64001", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:18.816Z", "date_updated": "2026-07-19T14:56:18.816Z", "publisher": "Linux", "title": "ALSA: pcm: oss: Fix setup list UAF on proc write error", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06422 }, "nvd": { "published": "2026-07-19T16:17:39.700", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64001", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The OSS setup path links an entry before allocating its task name and frees it on failure without removing the published list node.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8be4efd0dc0093eb7a02ad1aac936bca2a1f04ce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e13922bb97b4e6f94f8ac02d034f2d4bd65eeb3c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be387230dc22d870afd0e5d35912b07c2bc323bd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4cc54bdd54b337e77115be5b55577d1c58608eae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 731, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64002", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:19.495Z", "date_updated": "2026-07-20T13:42:13.909Z", "publisher": "Linux", "title": "ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02968 }, "nvd": { "published": "2026-07-19T16:17:39.807", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64002", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The IPv4 namespace teardown frees sysctl_local_reserved_ports before unregistering the sysctl table that can still access it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ecf45080a4d3f4526cacb8b14060fe3b49a6913b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5b23a2ff379e70b6b9ff744a972b63e1f8f4d996", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6512c57c4638ddec113bf42439361ba85a12048d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a7f4eefb6e1458431eef9fa20fb363320d185f76", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/155f90be5ee8be5b110ebc0b7da33c54c83b0208", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/87a1e0fe7776da7ab411be332b4be58ac8840d10", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 398, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64003", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:20.172Z", "date_updated": "2026-07-20T13:42:14.910Z", "publisher": "Linux", "title": "scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00441, "percentile": 0.36232 }, "nvd": { "published": "2026-07-19T16:17:39.933", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64003", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SCSI recovery skips partially removed devices when restarting queues, leaving their requeued requests permanently stuck.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/15fb19af49f2073ed77fad16aaabc648b0ca6800", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d4dddfecdbb5467bef158d4e1486459808357fef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/475f2b37a78f4c698967a7f14f325f04e24c9175", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c740e13e7fe32d8e4d9a1699f65b8daf6709895a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7205b58702273baf21d6ba7992e6ba15852325f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1064, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64004", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:20.895Z", "date_updated": "2026-07-20T13:42:15.900Z", "publisher": "Linux", "title": "net/iucv: fix locking in .getsockopt", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02965 }, "nvd": { "published": "2026-07-19T16:17:40.043", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64004", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "recvmsg can close and clear hs_dev while getsockopt reads it without the socket lock, causing a concurrent null dereference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/884eb247b74d86db97e3a37f0d6fc8e1e83590dd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/45bb8de8c95d8899f4b8f61bd9bceb8132af73cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1fc30bd4e55e2dd622d2d366cecd732c1841bbee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cd691beafea0dd779e69e81ccc26b0ab50efcb5e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6e792b8dd3002bbc4136745928a9605df1a72b8a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9817369243380e287ebe5525411557eaa3aa2a79", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/69554adc7a6fa04ede3ad7512321d83748e3c920", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3589d20a666caf30ad100c960a2de7de390fce88", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 548, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64005", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:21.608Z", "date_updated": "2026-07-20T13:42:16.855Z", "publisher": "Linux", "title": "net/smc: Do not re-initialize smc hashtables", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02948 }, "nvd": { "published": "2026-07-19T16:17:40.170", "lastModified": "2026-07-30T14:51:11.223", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64005", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SMC reinitializes hash-list heads after those tables have already been published to protocol and socket users, corrupting the live list state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/cdc79c05cc375f68ae87b0c74fdaac1a5c93155a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2006605006e5a4a11d93e1ebdbbe95764d24276f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/64c96e497d5ada0b90e99bf58f893aa2b73dcfbc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ed7a758313011885347b854e97cb95903ef3c3f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/55cba6b883b41e5922c00ba9d4e3262131f46f1b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9e4389b0038781f19f97895186ed941ff8ac1678", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 554, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64006", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:22.321Z", "date_updated": "2026-07-19T14:56:22.321Z", "publisher": "Linux", "title": "netfilter: nf_tables: fix dst corruption in same register operation", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00171, "percentile": 0.0678 }, "nvd": { "published": "2026-07-19T16:17:40.297", "lastModified": "2026-07-30T14:51:20.077", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64006", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "When source and destination share a word, the write occurs before the carry read and destroys state still needed by the calculation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b80ef316e978de2ef81d5bee9c19800b4cf96fb8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/96bea2a7baac4a1137c188dc7610184487ab30a7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a391afe74398b70107f111aa731eab608624949d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/18014147d3ee7831dce53fe65d7fc8d428b02552", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1361, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64007", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:23.049Z", "date_updated": "2026-07-20T13:42:17.862Z", "publisher": "Linux", "title": "netfilter: synproxy: refresh tcphdr after skb_ensure_writable", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00514, "percentile": 0.40949 }, "nvd": { "published": "2026-07-19T16:17:40.407", "lastModified": "2026-07-30T14:51:20.077", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64007", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "synproxy_tstamp_adjust caches a TCP-header pointer before skb_ensure_writable can reallocate the skb head and then writes a checksum through that stale pointer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1721, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64008", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:23.746Z", "date_updated": "2026-07-20T13:42:18.897Z", "publisher": "Linux", "title": "accel/rocket: fix UAF via dangling GEM handle in create_bo", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.02768 }, "nvd": { "published": "2026-07-19T16:17:40.557", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64008", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The GEM error path frees an object after publishing its handle, leaving the handle table able to dereference the freed object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/18abd88d19ea195e2e1547fca0970c2f91d77a42", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/451f1ccbbdb7b65021646704b15902655f8d228a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f706e6a4ce75585af979aec3dcbdce68bc76306b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1011, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64009", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:24.448Z", "date_updated": "2026-07-20T13:42:19.937Z", "publisher": "Linux", "title": "xfrm: Check for underflow in xfrm_state_mtu", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00143, "percentile": 0.04122 }, "nvd": { "published": "2026-07-19T16:17:40.663", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64009", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "xfrm_state_mtu subtracts attacker-influenced overhead using unsigned arithmetic, underflows to a huge value, and eventually supplies a negative length that becomes a near-SIZE_MAX memset.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1259, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64010", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.026Z", "date_published": "2026-07-19T14:56:25.162Z", "date_updated": "2026-07-20T13:42:20.923Z", "publisher": "Linux", "title": "nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00255, "percentile": 0.17024 }, "nvd": { "published": "2026-07-19T16:17:40.803", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64010", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "NFC connection acceptance can move a socket between lists concurrently with socket release and relink a freed socket.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/dce85215a6c7b0fd753f577a4c487f647119884c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bd08bb7443c501d2f2a71d529e4afcf11c9b07d2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0b45c31746e1523d5d482fda8fcf54a35ac417f1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ee2d1a8a1833c5e56e9a1745e64b0b4edda732c2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ad8a27d63cac96bac441edd002209ebd996e12fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/650bdd8fdfab64a09ee474150313dbc48c374795", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b2a60f7f846faaf5c2cdad4ea6d3a33e5f863183", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b493ea2765cc17cb8aa7e7544a4b6dcb05b6ed77", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1007, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64011", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T14:56:25.901Z", "date_updated": "2026-07-20T13:42:21.937Z", "publisher": "Linux", "title": "nfc: llcp: Fix use-after-free in llcp_sock_release()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02641 }, "nvd": { "published": "2026-07-19T16:17:40.933", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64011", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "llcp_sock_release() unlinks a connecting socket from the established-socket list instead of the connecting list, leaving stale lifetime state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/89ba026747019ee643d29407435ddc118e6ca908", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fb29f6bbe433f3decad227588809636c25f2a287", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2dfdaaf7d933b676124aadec6698825e95f94fe9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e00f50f8697724a6f1d2d35744c1332c9912dac5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cdc17e09a636c7f936f771902535a7515a7608fc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/912ebc49d4406a17fe73e5671d674fbc2f6b2634", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bc421d0826dedbba37580a25405eafb599e76d42", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f4268b466190dae95a7585f69b4f1f8ad097632c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 366, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64012", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T14:56:26.608Z", "date_updated": "2026-07-19T14:56:26.608Z", "publisher": "Linux", "title": "net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07403 }, "nvd": { "published": "2026-07-19T16:17:41.060", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64012", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A qdisc peek path and dequeue path update shared queue state inconsistently, allowing a later operation to consume an object under stale assumptions.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e5ea51e5f3fbba41d50cd84a530f33bc1c8f4d57", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1e70274d3b81de28973bcdbce40a512bcb181ff9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e125f5980b730c67c92a30cf150ec8c3d6777318", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c153d97c100f5b282c424101d8ff63122306997", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/84bfbfc0c48731bcce74cdf4f9c497547ec525e0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dbc560858da8b77dd9e4ef0cd93d421e0e4d7e0e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9ad3288632c859cf84183199832d822e7a70bdae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1b9bc71153b01dbde8045b9edede4240f4f5520e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3030, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64013", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T14:56:27.365Z", "date_updated": "2026-07-19T14:56:27.365Z", "publisher": "Linux", "title": "ACPI: button: Fix ACPI GPE handler leak during removal", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.05194 }, "nvd": { "published": "2026-07-19T16:17:41.220", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64013", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Driver removal unregisters the wrong ACPI notify-handler type, leaving a callback installed after its button device has been removed.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/614cb8c26c5aa53196ee9b211b76ee618b147d32", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fe80251152fed5b185f795ef2cd9f7fe9c3162e0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 710, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64014", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T14:56:27.995Z", "date_updated": "2026-07-19T14:56:27.995Z", "publisher": "Linux", "title": "Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07406 }, "nvd": { "published": "2026-07-19T16:17:41.320", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64014", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The NEXIO parser trusts 16-bit device-reported lengths that can exceed the 1017-byte payload area and then reads beyond the DMA buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/45c829e5eb3b974282bae50b7cca2cc891f74f0b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e7cdcb266ba06d8480809b78ab8bb2bf8ff51ccb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/95f47331dfde243f93e679ce70bd0c24b37c683d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d883312061ccde8c536595998aaf687ec070077c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/103d2de9f505f56da173e43f12dba62f92620278", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0ca809ea8e0355299266c46e5f1755040aa8dcf3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7585b6aa55d8ac85ad22f522e1059f93507727b6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2905281cbda52ec9df540113b35b835feb5fafd3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1255, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64015", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T15:39:10.557Z", "date_updated": "2026-07-20T13:42:22.981Z", "publisher": "Linux", "title": "security/keys: fix missed RCU read section on lookup", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02974 }, "nvd": { "published": "2026-07-19T16:17:41.467", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64015", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A persistent-key lookup walks an RCU-managed associative array without an RCU read section while garbage collection can remove and free nodes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/4c5d407ba3ff7f30561ff73ba1b07ed70c864edc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cefa4265b11176c897a7d9e8e54d89e3701c5584", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5659e6923cb72f8e18e8b539109ab512455fe195", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/50bb3435a5e627bfbdc52eb4536f49f88b3486b8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/66288dcadf80974436250e9f70ed848836b835b5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/43a1e3744548e6fd85873e6fb43e293eb4010694", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 667, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64016", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T15:39:11.266Z", "date_updated": "2026-07-20T13:42:24.006Z", "publisher": "Linux", "title": "ksmbd: fix durable reconnect error path file lifetime", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [ "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00442, "percentile": 0.36355 }, "nvd": { "published": "2026-07-19T16:17:41.577", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64016", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The durable reconnect error path drops the same file through two cleanup paths and can free it while its volatile ID remains published.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a1a39f227c80cbf369767badc32cba2b225147d1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6cb0b9385320110fe24a5d5ac0000ade4bb3a3f3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3515503322f4819277091839eed46b695096aca5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 991, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64017", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T15:39:11.989Z", "date_updated": "2026-07-20T13:42:25.031Z", "publisher": "Linux", "title": "blk-mq: pop cached request if it is usable", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 10, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02188 }, "nvd": { "published": "2026-07-19T16:17:41.680", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64017", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A task can sleep after peeking a cached request, allowing plug flush to free that request before the task later pops and uses it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/388468f7e7d1eab092cf2a39fdfb502e52019ec6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1111, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64018", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T15:39:12.704Z", "date_updated": "2026-07-20T13:42:26.010Z", "publisher": "Linux", "title": "net: mana: validate rx_req_idx to prevent out-of-bounds array access", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00142, "percentile": 0.03951 }, "nvd": { "published": "2026-07-19T16:17:41.790", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64018", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A hardware-controlled DMA value is used as reqs array index without a bounds check.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5ddc715324badd7f2641bc177db1d027b402adae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ff1d5af207bcea857d45fe81505f1bc4b29eaef0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/01f7f893d5e1baae995beeb86cd0f3e6bb2a3b01", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/763a372d344fb12fae566d36ddb46e92454ad58c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fa627a5eaa83fc0261f44ef3769693b886ca6e27", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/355e9f2b2a7887ca38100127989af3e422ba71d0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b809d0409991b75a6cff846a5ac27c3062953f84", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 546, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64019", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T15:39:13.400Z", "date_updated": "2026-07-19T15:39:13.400Z", "publisher": "Linux", "title": "nvme-pci: fix dma mapping leak on data setup error", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.05212 }, "nvd": { "published": "2026-07-19T16:17:41.907", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64019", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The NVMe error path leaves a DMA mapping active when descriptor allocation or PRP validation fails.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e50db059ec8e63bc50b1cc039e2502cb5ea75a70", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1bf86336e4b6cf40873fda47a7fe191446864937", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 548, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64020", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T15:39:14.115Z", "date_updated": "2026-07-20T13:42:26.964Z", "publisher": "Linux", "title": "nvme-pci: fix dma_vecs leak on p2p memory", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00344, "percentile": 0.27007 }, "nvd": { "published": "2026-07-19T16:17:42.007", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64020", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The NVMe completion path leaves its dma_vec allocation unreleased for peer-to-peer memory mappings.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/24ea0de233d9ebb5ebd6f6018eaf2084af25e3dd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/85686c72966c5ee637893f124ddb31a1cace7bee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 229, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64021", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T15:39:14.741Z", "date_updated": "2026-07-19T15:39:14.741Z", "publisher": "Linux", "title": "drm/xe/oa: Fix exec_queue leak on width check in stream open", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06237 }, "nvd": { "published": "2026-07-19T16:17:42.107", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64021", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "xe_oa_stream_open_ioctl returns directly on an unsupported queue width and skips the cleanup path for the looked-up exec_queue reference, pinning the queue and file state indefinitely.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/04ef7592eaadd9ca8f8f66e76452f73525cff819", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4b0c4f0c1b133d4bfa31c167200bcda646873328", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4d25342543c01310fc4e0cba7cb17c775e2421e2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 769, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64022", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T15:39:15.345Z", "date_updated": "2026-07-19T15:39:15.345Z", "publisher": "Linux", "title": "gpio: aggregator: remove the software node when deactivating the aggregator", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06237 }, "nvd": { "published": "2026-07-19T16:17:42.210", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64022", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "GPIO aggregator deactivation leaves its dynamically created software node allocated after the platform device is torn down.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3e657619cf7258cb53b1beaf0d02998297695cde", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9870ea9a4a25abef3e7af3445bfce2472528a546", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/61fef83f239ecace1cce716135762a2d9b7b1fc6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 329, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64023", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T15:39:15.980Z", "date_updated": "2026-07-20T13:42:27.952Z", "publisher": "Linux", "title": "gpio: aggregator: fix a potential use-after-free", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00124, "percentile": 0.02505 }, "nvd": { "published": "2026-07-19T16:17:42.317", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64023", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "GPIO aggregator cleanup frees dev_id before unlinking its lookup entry, allowing a concurrent lookup to dereference the freed string.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ea28b286649b70618e9dd3e895812417a7712a11", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7ac4183a41ba048af89eddd82fe8be64619d0871", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/30c073cab97afb31901f94de9605177b6b84367e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 438, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64024", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T15:39:16.598Z", "date_updated": "2026-07-20T13:42:28.932Z", "publisher": "Linux", "title": "tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00385, "percentile": 0.31314 }, "nvd": { "published": "2026-07-19T16:17:42.413", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64024", "family": "CRYPTO_SECRET", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A dropped packet leaves a per-CPU TCP time-wait initial sequence number that the next SYN consumes as predictable stale state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4affe063fa56c880cbea8d0bfded0bb80751579d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1bbf0ced1d9db73ac7893c2187f3459288603e0d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1654, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64025", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.027Z", "date_published": "2026-07-19T15:39:17.178Z", "date_updated": "2026-07-20T13:42:29.894Z", "publisher": "Linux", "title": "bpf, skmsg: fix verdict sk_data_ready racing with ktls rx", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00444, "percentile": 0.36519 }, "nvd": { "published": "2026-07-19T16:17:42.527", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64025", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The sockmap verdict callback races TLS receive ownership and drains a queue while TLS retains a pointer to an skb that can be freed.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c9ea01768903ae47f210cd457af1dead6de7a9c3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7c8cf21bc4efb4af18d6096db3f8bd06d622251c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1861d369efd62d67796563bf3e01fc22e5626f8b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8a52139560f833c3975032e1f5762611e3a36d71", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ddf8029623a1af20e984c040e89ff918158397ab", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1538, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64026", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:17.783Z", "date_updated": "2026-07-20T13:42:30.880Z", "publisher": "Linux", "title": "rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02912 }, "nvd": { "published": "2026-07-19T16:17:42.643", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64026", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "RXRPC decrypts DATA in place on shared page-cache storage, allowing decrypted writes to corrupt bytes concurrently exposed through splice.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a05bf6d9e621fa71e89ccebe3047ba45218d7b38", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b94a6ccbaf1104dd980150a65fdeb2f69d17d2f5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/46cb765e2e5ad52303ea157e10d370bb6b7acbbf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c580087743712112778a06d65a4074053072d7bf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d2bc90cf6c75cb96d2ce549be6c35efa3099d25b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1981, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64027", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:18.470Z", "date_updated": "2026-07-20T13:42:31.821Z", "publisher": "Linux", "title": "net: shaper: rework the VALID marking (again)", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.02772 }, "nvd": { "published": "2026-07-19T16:17:42.777", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64027", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The shaper VALID mark and XArray pointer are updated separately, allowing a reader to validate one entry and dereference its freed replacement.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2417df5e7bb4184b9d3a2988036bf2c46e594545", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/96ea960dd40fd55302e0fd755176f26a95e6a50c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b8d7519352ba8c6df83259295d4a3bad093cae90", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 863, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64028", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:19.102Z", "date_updated": "2026-07-19T15:39:19.102Z", "publisher": "Linux", "title": "tracing: Avoid NULL return from hist_field_name() on truncation", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 12, "defaultStatuses": [ "unaffected" ] }, "epss": { "score": 0.00185, "percentile": 0.08361 }, "nvd": { "published": "2026-07-19T16:17:42.877", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64028", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "hist_field_name() returns \"\" everywhere except the fully-qualified VAR_REF/EXPR case, where snprintf() truncation returns NULL early and bypasses the bottom NULL->\"\" guard.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e3f5d42cdc2f167719564693675f1eead81378ea", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/37377b39ff86dacbc533275c1155210d4fd5dc91", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0402a1d3ddec565132867337ed44514a09d84728", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e91687643c440ca3997d67646e6f80b92edc6703", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be4e99038c1603fa6b329d8ee3e364825e17c353", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d6c8b3ebdcdb12b59ad4212acb137cc56cae453d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/915c1254fe0788abddc31095b360e9dc98907a34", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/576ec047d20b368b43c4d5db98c4f2e0f3c101ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 810, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64029", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:20.368Z", "date_updated": "2026-07-20T13:42:32.790Z", "publisher": "Linux", "title": "ALSA: seq: Serialize UMP output teardown with event_input", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00125, "percentile": 0.02601 }, "nvd": { "published": "2026-07-19T16:17:42.997", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64029", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The UMP event path borrows the rawmidi output file without synchronizing against last-close teardown.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8ba1c4ddbb1c67d34bb440aecb9f5690ed3f64cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0cb1ad795570167558530d6194297ac2396a1991", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3aab4a58d23fb22dac5b558bbe5df1a8dad00b4b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ef46b616a4c219185bbf10ebcbacb571583fd0e4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/60a1969fae6209644698fca91c185d153674f631", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3547, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64030", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:20.982Z", "date_updated": "2026-07-20T13:42:33.826Z", "publisher": "Linux", "title": "wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00239, "percentile": 0.15031 }, "nvd": { "published": "2026-07-19T16:17:43.147", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64030", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A Wi-Fi 7 link identifier can take the value 15 while the link array ends at index 14, leading to an out-of-bounds pointer dereference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2d8379834800c30602f24c71ab7c40f5fe84d200", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/863f1f02a3bd70dbd857b8ac4070292fde8cb4e2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f718506edd2d9c6a308ded9d13c632bf7b7d5a2c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1154, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64031", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:21.609Z", "date_updated": "2026-07-20T13:42:34.848Z", "publisher": "Linux", "title": "erofs: fix managed cache race for unaligned extents", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.02773 }, "nvd": { "published": "2026-07-19T16:17:43.250", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64031", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A compressed folio becomes visible in the managed cache before its private state is cleared, allowing another pcluster to add the same folio concurrently.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/425d32d6288d7d845e486af9419bbedccd8c9103", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/038166f873c4caf6e85cfd4ea0c5a5ba297b4e8b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/649932fc3815eda2f24eb4de4b3a5e94886ee0b9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1451, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64032", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:22.228Z", "date_updated": "2026-07-20T13:42:35.854Z", "publisher": "Linux", "title": "bridge: mcast: Fix a possible use-after-free when removing a bridge port", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 22, "versionRangeCount": 20, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00125, "percentile": 0.02627 }, "nvd": { "published": "2026-07-19T16:17:43.350", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64032", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Conflicting multicast-snooping transitions can leave a per-port context active when the bridge port is freed, allowing its timer to use freed memory.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1900ca8acb92fbea8bf9abef9927c7fed03db7fc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ebe5561154c823b323bd06e350b55e0b8604d851", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a9224862d597d0eed0a34bbb27343f703fc4113f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7213256c91ed778a0997c2029c152b18dc50e4fd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4df78ff02629c7729168f0696a7a2123c389818d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2624, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 22 } }, { "cve_id": "CVE-2026-64033", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:22.872Z", "date_updated": "2026-07-20T13:42:36.830Z", "publisher": "Linux", "title": "RDMA/rtrs: Fix use-after-free in path file creation cleanup", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 17, "versionRangeCount": 16, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00488, "percentile": 0.39392 }, "nvd": { "published": "2026-07-19T16:17:43.493", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64033", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An error path drops the final kobject reference and frees srv_path before the next cleanup helper dereferences it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/01e42aabaf7632beb4bf235c7238b96c746d4144", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/548f3956e53a7f7bde912d8129010b8986d5e602", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/00904a73272b9f3ef3952fe69a833909dccad1ef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/92060ab1c5115674cf319175550f85f68405121f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eae62c5451e67e8b033c1681fd3b85d7e9a9a28f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b0e9706fb2859064bb6c677554c4d20c713aa8e0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5b74373390113fba798a76b483837029ab010fef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1084, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 17 } }, { "cve_id": "CVE-2026-64034", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:23.470Z", "date_updated": "2026-07-20T13:42:37.820Z", "publisher": "Linux", "title": "net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00151, "percentile": 0.04751 }, "nvd": { "published": "2026-07-19T16:17:43.620", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64034", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A DMA identifier is fetched twice across a validation window, allowing its value to change before use.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a201c66edf2ebc6cfdc3813a889ba20fecebfae3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/70ad2dff8d052a85dfef15715b531f38a29108cf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/566f42fb67a7ebfed6650e407e5b72e6b3e83bf7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6180a06bbc99fd9114b8db4be6c4d46e40f046ef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/09ec063d87c2dd3fa6f3561361a017bd882e9f37", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3c4db56ccd13dd020fbf43afabaee74a40ec75e4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/35f0f0a2536a4d604b4dbad92c85c4a8fdebb870", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 813, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64035", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:24.128Z", "date_updated": "2026-07-20T13:42:38.824Z", "publisher": "Linux", "title": "igc: set tx buffer type for SMD frames", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00442, "percentile": 0.36356 }, "nvd": { "published": "2026-07-19T16:17:43.740", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64035", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A reused transmit-buffer entry retains a stale XDP or XSK type, causing completion to apply the wrong ownership cleanup to an SKB.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1f83545f432d106d5fc71d3997b2d382104ebcc4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1c8587bd025244aa52061f5ceecbf5e68a1063d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5acc641e590e008caaed480ed9ffae47cf7ecbdf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 488, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64036", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:24.783Z", "date_updated": "2026-07-20T13:42:39.799Z", "publisher": "Linux", "title": "cgroup/rstat: validate cpu before css_rstat_cpu() access", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.02771 }, "nvd": { "published": "2026-07-19T16:17:43.847", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64036", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The BPF-facing css_rstat_updated function uses a caller-provided CPU index for per-CPU lookup without first validating that the CPU exists.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6a01413a4e8fcb0263d7bef5075c5f8f4eb3a8b6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fd2bd9fa7700ddf28296486b2598cff2f80cc819", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8817005efbdfdf5d4e4814cb5dc52b53d12917d7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 862, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64037", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:25.435Z", "date_updated": "2026-07-20T13:42:40.761Z", "publisher": "Linux", "title": "wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0043, "percentile": 0.35369 }, "nvd": { "published": "2026-07-19T16:17:43.947", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64037", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The iwlwifi MLD path treats the AMSDU-disabled sentinel as a length, computes zero subframes, and drives a segmentation burst that corrupts TCP object lifetime.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9e360e610a73f62432e986775023d5382773f045", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cbe1c8245e4469d1aa6e12e5d913611376d23788", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/92cee08dc4f00e77fd1317e4343c5d458b0abab7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1539, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64038", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:26.071Z", "date_updated": "2026-07-19T15:39:26.071Z", "publisher": "Linux", "title": "hwmon: (lm90) Stop work before releasing hwmon device", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06233 }, "nvd": { "published": "2026-07-19T16:17:44.053", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64038", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "lm90 releases its hwmon device before canceling delayed workers that can still dereference the freed device.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c98107817b0f6cdf51adc5e84e75c39ee25d8b28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/479e297526aeb19c745eac5c1897f455f83dc5f8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b09a45601094c7f4ec4db8090b825fa61e169d93", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1040, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64039", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.028Z", "date_published": "2026-07-19T15:39:26.695Z", "date_updated": "2026-07-20T13:42:41.722Z", "publisher": "Linux", "title": "drm/msm/snapshot: fix dumping of the unaligned regions", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.7, "cvss_source_score_spread": 0, "epss": { "score": 0.0018, "percentile": 0.07795 }, "nvd": { "published": "2026-07-19T16:17:44.153", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64039", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The display snapshot code aligns an already shifted DSI region and miscomputes the final register span, causing invalid memory access.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8fb070cf95847b29ef6cb15ec2c0de2bf4704676", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cecd34e046121d788a70b5c8b4f8a88916637953", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/070e40acc59ef7bedba0314f59971ba87fcc8ab0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1ef79be774706dddcfcace0331fa7ff32a73c73e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cdd1aaf0ee962f50810b9aef7928f2313989d55f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0c90ececfad3fc5c4c43a75ece0e2d736ab3def1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/76824d2467feb1828b745d6add2541918d7be3da", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 606, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64040", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:27.348Z", "date_updated": "2026-07-19T15:39:27.348Z", "publisher": "Linux", "title": "cachefiles: Fix error return when vfs_mkdir() fails", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00189, "percentile": 0.08788 }, "nvd": { "published": "2026-07-19T16:17:44.270", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64040", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The cachefiles mkdir failure path leaves ret as zero instead of extracting the error pointer, returning NULL as apparent success.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0940108d27c6995e02819ff832be11892f0b208b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8a220d1c312c66194f4a33dd52d1fba42bc2b341", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 424, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64041", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:27.967Z", "date_updated": "2026-07-20T13:42:42.714Z", "publisher": "Linux", "title": "ASoC: codecs: fs210x: fix possible buffer overflow", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00175, "percentile": 0.072 }, "nvd": { "published": "2026-07-19T16:17:44.367", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64041", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "fs210x_effect_scene_info supplies a source-derived copy size instead of the destination capacity, allowing the string copy to overrun its buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1ddf678bb75b6383c775ece61d40956c441d8a26", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6daefdf1cd3c56483f61970a76c0ad6028e4118f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0d435a7ebcd4e97e47673c1ab6fb27f973a053ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 416, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64042", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:28.604Z", "date_updated": "2026-07-20T13:42:43.720Z", "publisher": "Linux", "title": "vfio/pci: Check BAR resources before exporting a DMABUF", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00154, "percentile": 0.05061 }, "nvd": { "published": "2026-07-19T16:17:44.480", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64042", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The driver exports a BAR-backed DMA buffer without confirming that the caller owns a reserved resource.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 397, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64043", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:29.225Z", "date_updated": "2026-07-19T15:39:29.225Z", "publisher": "Linux", "title": "ovpn: fix race between deleting interface and adding new peer", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09802 }, "nvd": { "published": "2026-07-19T16:17:44.580", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64043", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "ovpn_dellink releases peers and queues device deregistration while a concurrent CMD_PEER_NEW can reacquire a netdev reference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/097d62df38314c14b88fab9096f3461baf158e2b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/de9fec2a6645f5b4d23398cd870a33e2703728d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/982422b11e6f95f766a8cd2c2b1cbdb77e234a61", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1174, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64044", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:29.869Z", "date_updated": "2026-07-20T13:42:44.713Z", "publisher": "Linux", "title": "ovpn: respect peer refcount in CMD_NEW_PEER error path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00172, "percentile": 0.068 }, "nvd": { "published": "2026-07-19T16:17:44.690", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64044", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ovpn release path bypasses the reference-counted lifetime and frees an object while references remain.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8298834912d76dbc82c12b6b4ab7590ed2bb8ae5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0c3ef71879c0264de6c42463031d9e057da87840", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1fef6614673ff0846d30acdeeaf3cf98bb5f6116", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2086, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64045", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:30.526Z", "date_updated": "2026-07-20T13:42:45.723Z", "publisher": "Linux", "title": "ovpn: tcp - use cached peer pointer in ovpn_tcp_close()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00154, "percentile": 0.05028 }, "nvd": { "published": "2026-07-19T16:17:44.803", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64045", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "ovpn_tcp_close rereads sock->peer after leaving its RCU read section, allowing concurrent socket release to free the containing object before the second dereference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e5460eb7238c19d651a9b22b2378b587033a4095", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d3ef441907fca7c340979e577a3db3bb634bf166", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/775d8d7ad02aa345e1588424a6a8b9ae49fb9012", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2191, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64046", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:31.129Z", "date_updated": "2026-07-20T13:42:46.777Z", "publisher": "Linux", "title": "net: tls: prevent chain-after-chain in plain text SG", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00514, "percentile": 0.40948 }, "nvd": { "published": "2026-07-19T16:17:44.920", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64046", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The TLS scatterlist builder can place one chain link directly after another, which the scatterlist iterator cannot resolve.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/49a5faaa471ddcd37b6893970c9916eb836e7c31", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/91359966e247c0244c66d50bbb8e74aefa4321c3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/410351158dfef2d67fea6603680b3a6013c6ed9d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/acdc12b71c9aa4be5dcd2c8062753c6d2033e235", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/929b1548e63ac72e104c07d8ee8cbbeeba2fa89a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/af855f4c966afafef74faf8390c7b86568c0d46d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b9c015ef1a7bf1e8dc67f21c6381f36deb2c3a36", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ff26a0e8377dec07e4a7230db7675bed1b9a6d03", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1047, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64047", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:31.960Z", "date_updated": "2026-07-20T13:42:47.774Z", "publisher": "Linux", "title": "net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00514, "percentile": 0.40951 }, "nvd": { "published": "2026-07-19T16:17:45.053", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64047", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "tls_push_record() places an sg_chain pointer one entry early when a scatterlist ring wraps, so crypto traversal follows the wrong array entry.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/73963a375885d5ccb7def39fd0b4f542e0f343dd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/47110c3a9ac247b688657337f5981efcfcb240dc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/84158c2997159df4a0d70cd9c46774512d32a522", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/131ef12057d92b77b636321b7849c69222405a97", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/66339b71f105e6f83e0da3b9583d95077534fe1d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eca989eab4b2599dcb02f72140a7c08f08838520", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2fb0dc7e0099686c4e9d2732745d8a31b18c3628", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/285943c6e7ca309bbea84b253745154241d9788a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1396, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64048", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:32.664Z", "date_updated": "2026-07-20T13:42:48.799Z", "publisher": "Linux", "title": "net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00479, "percentile": 0.38812 }, "nvd": { "published": "2026-07-19T16:17:45.190", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64048", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SMC path consumes an empty slot as though it contained a valid CHID, advancing the connection state with an invalid identifier.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6927cacf2b10d4fa80c1a2d407512ef9397c59c6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/53eb7bd09aace72fa17510d80e0caf5ca058c231", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/afa9036b8c9963947b487c36e332df6a42c96fcb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/65edb3b0822cfe5041be8fbabebd57e2e5ad9f4e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/277740023def559a4a2ddc3e8e784ee37a0f16a9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1205, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64049", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:33.308Z", "date_updated": "2026-07-19T15:39:33.308Z", "publisher": "Linux", "title": "drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06236 }, "nvd": { "published": "2026-07-19T16:17:45.310", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64049", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Userspace can query UBWC parameters on pre-a5xx hardware where no UBWC configuration object exists, causing a null dereference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/eea43d5ed45089705bc5d70971c39076962d5951", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/22fc33d9b67694b24e0deb3f08c622464338cecb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2b4abf879360ea00a9e2b46d2d15dcdbc0687eed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 514, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64050", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:33.942Z", "date_updated": "2026-07-20T13:42:49.733Z", "publisher": "Linux", "title": "drm/msm/dpu: don't mix devm and drmm functions", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00124, "percentile": 0.02503 }, "nvd": { "published": "2026-07-19T16:17:45.413", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64050", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The driver allocates writeback connector state with devm lifetime while userspace-visible DRM references can outlive device teardown.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ff58e5ef1b46ce614af048d2d04986df05ffab90", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/95048a12f48c627bc2ccc4d84f87640630ba2bdb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c0c70a11365cba7fba25a77463582bcec0f7846e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 532, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64051", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:34.608Z", "date_updated": "2026-07-20T13:42:50.752Z", "publisher": "Linux", "title": "accel/qaic: Add overflow check to remap_pfn_range during mmap", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02912 }, "nvd": { "published": "2026-07-19T16:17:45.517", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64051", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "qaic_gem_object_mmap can map a buffer beyond the VMA length, leaving extra mappings alive after the VMA is unmapped.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9baafc2fea096279e75480f93fd5942e8336b510", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8dd6edbe26770df147136c3f2ac976c873b82650", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/97a8e89cdef36207a8776edc03d6931763a06ad0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8c795012d0e06b7740e40319b86ff8d2a435098d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aa16b2bc0f02709919e2435f531406531e5bcc69", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 540, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64052", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:35.223Z", "date_updated": "2026-07-19T15:39:35.223Z", "publisher": "Linux", "title": "block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06421 }, "nvd": { "published": "2026-07-19T16:17:45.623", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64052", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "bio_integrity_map_user treats a partial page-pin result as complete and passes an unpinned null page into bvec construction.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/77c059f41e9395793917d067476f549a911d77d3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/76410790f1491c8e06a451045ae223a61c652455", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8fa244738641d95ea4d70e6f9a62778bba42a5b7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8582792cf23b3d94674d4d838f7cde9a28d0fcaf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1042, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64053", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:35.854Z", "date_updated": "2026-07-20T13:42:51.761Z", "publisher": "Linux", "title": "block: don't overwrite bip_vcnt in bio_integrity_copy_user()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02902 }, "nvd": { "published": "2026-07-19T16:17:45.730", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64053", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "bio_integrity_copy_user overwrites bip_vcnt with nr_vecs beyond the one-entry flexible array and makes later merge checks read past bip_vec.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d18160c9525c63c203656fefd847e94b538cd4a4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0d48654af4d1390c888389206cc13b51b82c30e6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/066be1439593a381b1a29663becfcfe0c92363e7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/637ad3a56a3b889527d1dacea6fea2a8bd648140", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 590, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64054", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.029Z", "date_published": "2026-07-19T15:39:36.475Z", "date_updated": "2026-07-19T15:39:36.475Z", "publisher": "Linux", "title": "net: shaper: reject duplicate leaves in GROUP request", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06233 }, "nvd": { "published": "2026-07-19T16:17:45.830", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64054", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Duplicate leaf handles place the same parent pointer into cleanup twice and cause that object to be freed twice.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5098b223f0f0c5c18a3884a8b0ea5bd4a0c7bd75", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/31767bf852b59f05125b58a17007e4cd1ea9eb2e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a9a2fa1da619f276580b0d4c5d12efac89e8642b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 556, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64055", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:37.077Z", "date_updated": "2026-07-20T13:42:52.779Z", "publisher": "Linux", "title": "net: ethernet: cortina: Carry over frag counter", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00514, "percentile": 0.4095 }, "nvd": { "published": "2026-07-19T16:17:45.930", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64055", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "gmac_rx resets its fragment counter between poll calls even when the current packet remains only partly assembled.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/df31e3b64455293df1ea89c7da7d5c9bfbcdd253", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7af1fabdee744b7995fe01b30b77dfc397657cb5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/75105fcf73f1ce7d9f769aaefec6e6d6645d5ac0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/78cf08b3be47c28f07008a76c932bad7cdffa9d8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7123cf481e21b54eb6adc4cb0d8dc2876aeaee41", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c373b34877afea61c89e0dd2e38948c624249b9b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/46806096f35b8d3dfa2f321ddd77f597edcdb85f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ebd8ec2b309e3a447851b456ccaf8fb39f3661e7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 810, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64056", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:37.673Z", "date_updated": "2026-07-20T13:42:53.741Z", "publisher": "Linux", "title": "net: ethernet: cortina: Make RX SKB per-port", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00552, "percentile": 0.43022 }, "nvd": { "published": "2026-07-19T16:17:46.057", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64056", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Two Ethernet ports share one static receive-packet pointer, allowing their concurrent fragment assembly to race over the same object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/27856d533eca3804008695f61c1e4d5ff984196b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b6b22824b30e48ce1df3a2e80990f4b8505deb50", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6bba24e9ebe6f1c0b356cd471e36bdc7fa434897", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3b249988d774dacf13b203817e971934a42243c4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/72158ea185b27afae163949b0e86164cb6b64e55", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cfd62907f3cdbc3b6da8f49ba907c0390018fe5e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/67a35e7da7ef9d2f000aa758552a128324c604a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/06937db21ee311ed07eba47954447245041a982d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 681, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64057", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:38.321Z", "date_updated": "2026-07-20T13:42:54.729Z", "publisher": "Linux", "title": "afs: Fix the locking used by afs_get_link()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02188 }, "nvd": { "published": "2026-07-19T16:17:46.187", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64057", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "AFS symbolic-link reads lack the locking and RCU lifetime barriers needed across concurrent get_link calls, allowing buffers and link state to be leaked or observed outside their valid lifetime.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/77ea917cbed62882a33114b1e23ededb977e4287", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c0410adf3da6db46f3513411fcf95e63c2f1d1ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1418, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64058", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:38.978Z", "date_updated": "2026-07-20T13:42:55.717Z", "publisher": "Linux", "title": "netfs: Fix netfs_read_folio() to wait on writeback", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.02773 }, "nvd": { "published": "2026-07-19T16:17:46.290", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64058", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "netfs_read_folio reads dirty and private folio state without first waiting for an ongoing writeback that can clean that state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f17b9121bb99f88188ec9be2db5da1d561f4c01b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b8271cccdd5e43cc8d738afb8b51f6ad05b1cb4b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ded0c6f1606061148c202825f7e53d711f9f84cf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 357, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64059", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:39.607Z", "date_updated": "2026-07-19T15:39:39.607Z", "publisher": "Linux", "title": "netfs: Fix folio->private handling in netfs_perform_write()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06415 }, "nvd": { "published": "2026-07-19T16:17:46.407", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64059", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "netfs transitions folio private data among incompatible owner forms without consistently releasing the previous attachment and references.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/7f040243c74d72b45b22246c7d9e621fbeab44ac", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/551b5c71ee312ca7646ddb605231c1016e8cbb18", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0969ea8370bad0e4fb6131b6a7bed9e7ec522ac7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ccde2ac757c713535b224233a296de40efe5212d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1293, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64060", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:40.243Z", "date_updated": "2026-07-19T15:39:40.243Z", "publisher": "Linux", "title": "netfs: Fix leak of request in netfs_write_begin() error handling", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06235 }, "nvd": { "published": "2026-07-19T16:17:46.513", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64060", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An error path fails to release a request reference and leaks it on each failure.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/22ae28aae43623be235ff455558cdd13fbe2daeb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/28686d6d8b60dc5bbae9ef6023ab2051d6c66cdf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5046a34f0643441f05b0253ea64e1a3af87efe14", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 255, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64061", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:40.913Z", "date_updated": "2026-07-20T13:42:56.725Z", "publisher": "Linux", "title": "netfs: Fix early put of sink folio in netfs_read_gaps()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00444, "percentile": 0.36518 }, "nvd": { "published": "2026-07-19T16:17:46.613", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64061", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "netfs_read_gaps releases its sink folio before the asynchronous read request finishes writing through the iterator.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2a39d49c8d97df8cb8fa80c10859bc1ba7358c6b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d4f4bc87c76511cf2532448b0fa40c25e894bd7d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/412e8bad48967fd34295866636c028befd27d8b9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3e5dd91b87a8b1450217b56a336bee315f40da7d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1352, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64062", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:41.523Z", "date_updated": "2026-07-19T15:39:41.523Z", "publisher": "Linux", "title": "netfs: Fix potential deadlock in write-through mode", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06415 }, "nvd": { "published": "2026-07-19T16:17:46.720", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64062", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "netfs_advance_writethrough can leave a supplied folio locked on an error path, allowing write-through processing to deadlock.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1468f39243ccb155b6d97f9a9932f610d1205d75", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/003aa0dd26c964025acd6d1213bcdbd674db2ca9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e40e9cbf3ee4d30ee9a97bd128c85500b6ad0da1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b6a4ae1634b3ad2aaa05222e53d36da532852faf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 782, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64063", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:42.123Z", "date_updated": "2026-07-19T15:39:42.123Z", "publisher": "Linux", "title": "netfs: Fix streaming write being overwritten", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.0642 }, "nvd": { "published": "2026-07-19T16:17:46.820", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64063", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "A full overwrite of a streaming-write folio leaves the old netfs_folio dirty-region state attached, so later processing can overwrite the new data.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/20195925c768626dc901a4781a51e508702c88ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ef9b521212e4863814ef7dfe19889abaf55ca840", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cdae00e8e215d95911d95f100599e187b6560de5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7b4dcf1b9455a6e52ac7478b4057dbe10359576d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2105, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64064", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:42.770Z", "date_updated": "2026-07-19T15:39:42.770Z", "publisher": "Linux", "title": "netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.0642 }, "nvd": { "published": "2026-07-19T16:17:46.937", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64064", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Truncation discards netfs_folio state without clearing the dirty bit, so a later mmap read follows a dirty-state path that dereferences the missing metadata.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/31ba145faceb378fa01afcb8349e15ea7d95e542", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fb6ec883b48b8789e5e690dcd440d2db941e840c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/65ae8717abf36202fef02260b64b781d2d44a9bf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/156ac2ec2ee77c44c4eb7439d6d165247ba12247", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2167, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64065", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:43.397Z", "date_updated": "2026-07-19T15:39:43.397Z", "publisher": "Linux", "title": "netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06417 }, "nvd": { "published": "2026-07-19T16:17:47.053", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64065", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "netfs_write_begin() can return an unlocked folio to a caller path that unconditionally invokes folio_unlock().", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/51ffb788f074c0a61953086f49008028c1e7b645", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b63971238beb79cf701dac33c6cefc56c07c89fa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5ad05b6f5df296ef046589f222bb2587495b991e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dc7832d05deb4d632e8035e3299e31a3528fa0d0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3998, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64066", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:44.032Z", "date_updated": "2026-07-20T13:42:57.695Z", "publisher": "Linux", "title": "netfs: Fix netfs_read_to_pagecache() to pause on subreq failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00442, "percentile": 0.36356 }, "nvd": { "published": "2026-07-19T16:17:47.190", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64066", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "netfs_read_to_pagecache() continues issuing new subrequests after an earlier subrequest has failed instead of pausing the operation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/884c4c4f35e577aba6a0593c80cbea9ca5e6e2b8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0256e79ce42101ad036edd4205bccca621ea0927", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8a8c0cfdf4658fc5b295b7fc87be56e0d76741f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 254, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64067", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:44.660Z", "date_updated": "2026-07-20T13:42:58.657Z", "publisher": "Linux", "title": "netfs: Fix missing barriers when accessing stream->subrequests locklessly", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0038, "percentile": 0.30706 }, "nvd": { "published": "2026-07-19T16:17:47.290", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64067", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Lockless readers can observe a newly linked netfs subrequest before its flags because list publication and consumption lack release and acquire barriers.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/293a4532c36f38458e38b8879b174ab797718b9d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b5782e2d462c028096f922abca46318cec890670", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1192, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64068", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:45.306Z", "date_updated": "2026-07-20T13:42:59.631Z", "publisher": "Linux", "title": "netfs: Fix missing locking around retry adding new subreqs", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0038, "percentile": 0.30706 }, "nvd": { "published": "2026-07-19T16:17:47.390", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64068", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Netfs retry paths add new subrequests to a shared stream list without taking the lock that protects concurrent list updates.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/393f3f0d7353a94b1e0bc4ca89c683fe983e5fd2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cce18c263e9623872327ba3c956012f73c1179cc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 279, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64069", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:45.932Z", "date_updated": "2026-07-20T13:43:00.616Z", "publisher": "Linux", "title": "netfs: Fix cancellation of a DIO and single read subrequests", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00442, "percentile": 0.36356 }, "nvd": { "published": "2026-07-19T16:17:47.483", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64069", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Failed DIO and single-read preparation abandons a subrequest with list visibility and reference ownership inconsistent with the collector.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5366199be46fb53de62861721d34ba816e7e440e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f73372a4c6900d117f8e903fe10b62692f95e6c4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6f0f7ac1915abc0d202f0eb4b003a6548a5ba60d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1174, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64070", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.030Z", "date_published": "2026-07-19T15:39:46.536Z", "date_updated": "2026-07-19T15:39:46.536Z", "publisher": "Linux", "title": "powerpc/hv-gpci: fix preempt count leak in sysfs show paths", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.05213 }, "nvd": { "published": "2026-07-19T16:17:47.583", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64070", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Successful sysfs paths omit put_cpu_var and leave preemption disabled after the operation returns.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/903409000a07ac8e31ffedeb8516f4f8d67150c8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dbc30a57bd8e026995e9fa8e8c31cffd18542c01", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1393, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64071", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:47.162Z", "date_updated": "2026-07-19T15:39:47.162Z", "publisher": "Linux", "title": "nvme-pci: fix use-after-free in nvme_free_host_mem()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.07001 }, "nvd": { "published": "2026-07-19T16:17:47.687", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64071", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "nvme_free_host_mem frees hmb_sgt without clearing the pointer, so a later cleanup dereferences and frees the stale object again.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9525e3a6fbb1d126a22ab2ee86ddea25af581a7c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7c89f474005d8377525d2991930b7432ee193a52", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b35a13036755c5803168a7cb93bc66035c3e65b8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2019, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64072", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:47.823Z", "date_updated": "2026-07-19T15:39:47.823Z", "publisher": "Linux", "title": "nvme: fix bio leak on mapping failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.07002 }, "nvd": { "published": "2026-07-19T16:17:47.793", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64072", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The NVMe integrity-mapping failure path loses the request's bio because it consults a local pointer that is always NULL.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/fea4b46f84c50caf93c6c0f2a54b1be2edfb4491", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/51ec7fc4e10c5e332bf4007bdb7e4c6bf03c14c9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2279cd9c61a330e5de4d6eb0bc422820dd6fdf36", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 230, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64073", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:48.463Z", "date_updated": "2026-07-20T13:43:01.595Z", "publisher": "Linux", "title": "irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00132, "percentile": 0.03184 }, "nvd": { "published": "2026-07-19T16:17:47.893", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64073", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "irq_work clears BUSY before its final object accesses, allowing another CPU to free the work before those accesses finish.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2dc79362302922cb18f35e262712b5e58de65442", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eef4f71b46a9929ac33e968538c9dd5d96a02460", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/684a78183c54c23e70d1cba320f7fc184604210b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/18c0456ea2615b1a743a6db739c74411c3b42bc6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/81b582784518196eff1050212a046bc29d3a05dd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/91840be8f710370607f949a627e070896faeddb8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 911, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64074", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:49.076Z", "date_updated": "2026-07-20T13:43:02.576Z", "publisher": "Linux", "title": "fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.02772 }, "nvd": { "published": "2026-07-19T16:17:48.010", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64074", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "statmount increments an already-overflowed seq count past the buffer size, defeats the overflow test, and writes a terminating null one byte out of bounds.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e37ea2c6f17f273813ea4e8e94c102591d598ce1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/93614949dc86f068e3c32c32cf1ee2a2323177a7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a3bf0f28d4ba16e1f35f8c983bb04426b87e2a78", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 716, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64075", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:49.679Z", "date_updated": "2026-07-19T15:39:49.679Z", "publisher": "Linux", "title": "fprobe: Fix unregister_fprobe() to wait for RCU grace period", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06239 }, "nvd": { "published": "2026-07-19T16:17:48.113", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64075", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "unregister_fprobe removes an object from an RCU list without waiting for a grace period before the object can be freed.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/56b4cfcf1518245493c60fd39c56978f508f1816", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a4f6a9005ed6cfd360ef2520430927f05f92ffb0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/657b594b2084b39a4bc6d8493aa2140cb00cea49", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 876, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64076", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:50.346Z", "date_updated": "2026-07-20T13:43:03.553Z", "publisher": "Linux", "title": "netfilter: bridge: eb_tables: close module init race", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.02771 }, "nvd": { "published": "2026-07-19T16:17:48.213", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64076", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ebtables registers globally reachable socket options before core module initialization is complete, allowing a request to race partially initialized state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c647e2a21bbbaceda6cdb8a44a56f44d231dc4b4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/02d999dc69b3918dba2414932b5d95f1f75c76cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/27414ff1b287ea9a2a11675149ec28e05539f3cc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 381, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64077", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:50.966Z", "date_updated": "2026-07-20T13:43:04.526Z", "publisher": "Linux", "title": "netfilter: ebtables: move to two-stage removal scheme", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.02767 }, "nvd": { "published": "2026-07-19T16:17:48.313", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64077", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ebtables removal can expose a partially replaced table to concurrent readers before the old table's references are safely retired.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/739d5dac7b2da44a756aa4d758ee3f1ccf5a27f1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ef395579a7631a06d61969fc712eb80402231b89", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b7f0544d86d439cb946515d2ef6a0a75e8626710", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 389, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64078", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:51.582Z", "date_updated": "2026-07-20T13:43:05.475Z", "publisher": "Linux", "title": "netfilter: x_tables: add and use xtables_unregister_table_exit", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.02767 }, "nvd": { "published": "2026-07-19T16:17:48.407", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64078", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Teardown omits the second-stage dying-list and hook cleanup, leaving state active after its lifecycle transition.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/86ee5bc9c0f0e652e19f395675a432de11b75514", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8026e5163cca1d1db436c7bfb89ddea8b5e8c2cf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b4597d5fd7d2f8cebfffd40dffb5e003cc78964c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 680, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64079", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:52.192Z", "date_updated": "2026-07-19T15:39:52.192Z", "publisher": "Linux", "title": "netfilter: x_tables: allocate hook ops while under mutex", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.05211 }, "nvd": { "published": "2026-07-19T16:17:48.503", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64079", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "xt_register_table publishes a table before allocating its hook operations, so concurrent namespace teardown can pass a null operations pointer to nf_unregister_net_hooks.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2f92c5f923979f37ab1d5445381e4b8378a196cc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b62eb8dcf2c47d4d676a434efbd57c4f776f7829", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1296, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64080", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:52.818Z", "date_updated": "2026-07-20T13:43:06.417Z", "publisher": "Linux", "title": "firmware: arm_ffa: Snapshot notifier callbacks under lock", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00145, "percentile": 0.04281 }, "nvd": { "published": "2026-07-19T16:17:48.607", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64080", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "FFA notification handlers drop notify_lock before copying a callback entry, allowing concurrent unregister to free the entry before dereference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d1e38551fadea230649bc428f0f35c9ee062a072", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0e7be42ef2490f19d859a6146324d48cafdc9d5c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/38290b180a4d5746baed796d49f88d56d2f336cd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 675, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64081", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:53.433Z", "date_updated": "2026-07-20T13:43:07.436Z", "publisher": "Linux", "title": "firmware: arm_ffa: Validate framework notification message layout", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.0014, "percentile": 0.03845 }, "nvd": { "published": "2026-07-19T16:17:48.707", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64081", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The FF-A framework-notification path uses firmware-supplied message offsets and sizes without validating that they remain within the shared RX buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3c51d99449dc5a01c08a7fce6071d6721f5aac83", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/76eb90e2b03de147e12ab68ea8afd8ea0342df0a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4a1cc9e96b311d2609a6f963a5e35bd4ae730d97", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 586, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64082", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:54.074Z", "date_updated": "2026-07-20T13:43:08.413Z", "publisher": "Linux", "title": "riscv: Fix register corruption from uninitialized cregs on error", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02186 }, "nvd": { "published": "2026-07-19T16:17:48.807", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64082", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "RISC-V error paths copy an uninitialized compatibility-register buffer into task registers after a failed user copy.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9e020156833f1ad0d425a1e3d85b65639f1c1c50", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6ebcbb53fc9bc30843054ed99fd60b8e542628f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 707, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64083", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:54.756Z", "date_updated": "2026-07-19T15:39:54.756Z", "publisher": "Linux", "title": "hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.0827 }, "nvd": { "published": "2026-07-19T16:17:48.910", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64083", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ADM1266 GPIO accessors accept zero- or one-byte block reads and combine uninitialized stack bytes into values returned to user space.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/fd9196aad9e5a3845cea17de3405ebc700382142", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ee4799becf7d2af3778007e22c2e55c4009a49c7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c603b6c6840ac0c6285f5eefea0de6242710af21", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a2d1c819348b36fccbbfcf37c5fa7a50a9b4528f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ae25cf2ea9ebd06d7ad416647dbdc7b5d0172946", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eb3cd9bb590460c6127145cb245be925d23f5232", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/64fa9328948ddcc0f7f3c23ea1756c126d9dffac", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a7232f68c43ca62f545049b7f5fbfc75137b843b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1080, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64084", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.031Z", "date_published": "2026-07-19T15:39:55.417Z", "date_updated": "2026-07-20T13:43:09.375Z", "publisher": "Linux", "title": "hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00139, "percentile": 0.03687 }, "nvd": { "published": "2026-07-19T16:17:49.043", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64084", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The adm1266 parser uses the wrong bound constant for an attacker-influenced index and accesses beyond the intended array.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d0593e15fdeb56048a72c5c6e720f702759d0ccd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/17cee2f59029039416e8f6303050038eb59ba149", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/299efd14c2eda7e5fd40025e54addd4151a01081", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4d1da9a6be5a8156c532d571c2ed237169f99244", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b96c7f0bc0713dc6403912f6527d4ff9168d6fe6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fa7ca363069a70b0d1aa51e8892e3095fe2ac1ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2aef8f08c479f4cbc83e1e6b19d1c94d4dd24f17", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d7834d92251baade796812876e95555e2066fa9f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1035, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64085", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.032Z", "date_published": "2026-07-19T15:39:56.067Z", "date_updated": "2026-07-19T15:39:56.067Z", "publisher": "Linux", "title": "hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.0827 }, "nvd": { "published": "2026-07-19T16:17:49.173", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64085", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The PMBus helper copies a device-supplied length of up to 255 bytes directly into a 64-byte trailing blackbox-record slot before validating the returned size.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/7896d87cbb05e097efc113243d4e38f9f8cea16c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9d5309500b4607b7198e19f0a3fa13eb864cd5fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6098634cfa711f11a8d65368dc51ec8f7c8241ba", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/60c4b9fe1a3dd012014b1f561a6928a0b5db1126", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/83e039f0a43e0708515b0479cb7690fb93faaaa0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/97a9cf2a8217ca1cdaf48cb9ab26e471632c7e7f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dd47b8c4a0a8ced442da3f008db28fbbd31feaf0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/43cae21424ff8e33894a0f86c6b80b840c049fd7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1202, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64086", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.032Z", "date_published": "2026-07-19T15:39:56.749Z", "date_updated": "2026-07-20T13:43:10.387Z", "publisher": "Linux", "title": "hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00139, "percentile": 0.03691 }, "nvd": { "published": "2026-07-19T16:17:49.300", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64086", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "adm1266_pmbus_block_xfer requests a 257-byte maximum response into a 256-byte read_buf and then indexes the PEC byte at the same out-of-range position.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/397d3f523bfff2f4e3dacf9b1339bd76dc207f78", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/472744f69d25a2d5111ad62f1d62579dce2c13c8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/528a9f88e88502d0c2f2052a279415074cd83715", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d94ceb16e55b6d8019ab069e357c76ac42f0ffbc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bd5be3fa5de6dbf61f1b3cec6b79c2c2f8065694", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2279c342d94eca225bf9f301c8806a05a1c81619", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a6c802145a8de0830bca803c6d415f7e9e683624", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/487566cb1ccdf3756fdd7bf8d875e612ff3169bb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 865, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64087", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.032Z", "date_published": "2026-07-19T15:39:57.371Z", "date_updated": "2026-07-19T15:39:57.371Z", "publisher": "Linux", "title": "hwmon: (pmbus/adm1266) reject implausible blackbox record_count", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.08269 }, "nvd": { "published": "2026-07-19T16:17:49.433", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64087", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A device-controlled blackbox record count can exceed the 32-record destination allocation and drive the copy loop beyond that buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/adcb163ad7cacca317872fc62bd8885e842e45e3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c2c56092710fe8a893b67b5a3d7e62808d02d84d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5469e1e7c411acc15fdd8262c99c3ebd9defd594", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f85c81e93dbd6915970bd5f3bffcf62633c4c54c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0e791cd0140fb136083565aadfbe0f705aa260d0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/75c862adf3d3caab4f49bb3530723c215376e37c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/231db52a5b64d0a9769e298dadc148e1f79b26a6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4afca954622d672ea65ed961bed01cf91caa034e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 846, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64088", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.032Z", "date_published": "2026-07-19T15:39:58.084Z", "date_updated": "2026-07-20T13:43:11.384Z", "publisher": "Linux", "title": "batman-adv: tt: fix negative tt_buff_len", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00281, "percentile": 0.20391 }, "nvd": { "published": "2026-07-19T16:17:49.557", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64088", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A translation-table length stored in signed 16-bit form wraps negative and leaves most of an allocated response buffer uninitialized.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/4c4c2f340f4c27373bfcac8dc5032ce7bb474e47", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3c96dff00998314983b68a3e7caac07a66ebe496", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/32edd2a28e112064020a2f319a8cb8a9e5a09767", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4dab98961426d0cf6a1599cda6950b7596ca2fcd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/730de8733dd90f70d7580a9b329b971f8e1474a2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ed28ead3420c373a7928622f114bc6168075d1e1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b64963a2ceeb7529310b6cf253a1e540784422f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 770, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64089", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.032Z", "date_published": "2026-07-19T15:39:58.729Z", "date_updated": "2026-07-20T13:43:12.374Z", "publisher": "Linux", "title": "batman-adv: tt: fix negative last_changeset_len", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00552, "percentile": 0.43023 }, "nvd": { "published": "2026-07-19T16:17:49.697", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64089", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A translation-table changeset length stored as signed 16-bit wraps negative, sign-extends during buffer preparation, and leaves most of an allocated response uninitialized.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6314089acf0ddf64376fdc0b1420695504c73f52", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/55dc41fe8821e9a849e147255ad572bc933a9d15", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c424e8519ac78eac5d9f4eecf06208a0d619ec14", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/22d59c72f4a47ffec121d0610f70d0d70c3c11c8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eb235472b52ef36981c5aad330485eaf2382c53b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/179eb62506a02d00370bd6478898cb632e10986c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d29abf70c665730e249d2ec8e1402095ae26bcee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fc92cdfcb295cefa4344d71a527d61b638b7bfc4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 785, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64090", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.032Z", "date_published": "2026-07-19T15:39:59.392Z", "date_updated": "2026-07-19T15:39:59.392Z", "publisher": "Linux", "title": "batman-adv: tt: avoid empty VLAN responses", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.08267 }, "nvd": { "published": "2026-07-19T16:17:49.837", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64090", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The indirect translation-table reply path can send empty VLAN state because it lacks the consistency check used by direct replies.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1f467d9a095211d3f77e8ff1bee90e73ffe01c64", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9a02c8fc963ddeecb5d8788be0740c1869fc54b7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ea4f757641430bcc8322772e161453c4db5ecb64", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/99f17d1cdb371cbd037975239b321f346d38f6d2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cfb30645280a2131e46cbd1b9a38cfd3ff893f12", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b93ca6012712ecab2b551e120d7c95038d6a89e5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ab26e346322648f5c39de017d9723c9256284fce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fa1bd704940b5bcbc32c0b28db9167405c8ee5e0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 490, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64091", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.032Z", "date_published": "2026-07-19T15:40:00.030Z", "date_updated": "2026-07-20T13:43:13.369Z", "publisher": "Linux", "title": "batman-adv: tt: fix TOCTOU race for reported vlans", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 26, "versionRangeCount": 21, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00552, "percentile": 0.43023 }, "nvd": { "published": "2026-07-19T16:17:49.967", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64091", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The VLAN list can gain qualifying entries between size calculation and buffer fill, so the later write exceeds the allocation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e4236bf3ec8d6bb15d0d8d825dcf9933a7d6666b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/724a8eb4155669797c96b70d70e354284ae3b5a8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/211ea59988e1cba43cb0367ad65d379b56f9c3bd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/65a1e67339aa8c95ac544b796946af388930ee23", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b4d4efd4e351593c81e9293d4b4408d244fa5ee7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4cc85aec8d3c9ab4dc716dc9f1ed36fca16b227f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9a9c859457bc440a55773e01ff18b1bb5bab6836", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/94d27005016be15ffc638b2ecbc4d58805ad7b48", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 980, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 26 } }, { "cve_id": "CVE-2026-64092", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.032Z", "date_published": "2026-07-19T15:40:00.603Z", "date_updated": "2026-07-19T15:40:00.603Z", "publisher": "Linux", "title": "batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 13, "versionRangeCount": 12, "defaultStatuses": [ "unaffected" ] }, "epss": { "score": 0.0018, "percentile": 0.07823 }, "nvd": { "published": "2026-07-19T16:17:50.110", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64092", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Two shutdown paths can each assume the other released the timer-held reference, leaving it permanently retained.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/7715c73f33260af724d734c41b794457e9be8dbc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/297e1bc4a915b7cd3e65a79ed906b23fb3d7aaae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0b1bedf114ea93fef929b31f0d70a9eedcc601de", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a9f0bfd624ee8a286d6fd2bf0f796e730efb49b0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b285bc0a97f43823a4967fb6d286de4c7f53d541", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d078501dde9b57210f1808cdef4b59463d1f5fc8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/77098e4bea37af51d3962efa88a5af2ea5e1ac57", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1082, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 13 } }, { "cve_id": "CVE-2026-64093", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.032Z", "date_published": "2026-07-19T15:40:01.172Z", "date_updated": "2026-07-20T13:43:14.395Z", "publisher": "Linux", "title": "batman-adv: tp_meter: directly shut down timer on cleanup", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00337, "percentile": 0.26259 }, "nvd": { "published": "2026-07-19T16:17:50.230", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64093", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "batadv_tp_sender_cleanup deletes a timer without permanently preventing the handler from rearming it during teardown, allowing timer activity to outlive the sender state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/00bf4bb9947b1190a8be8d9b6a1bcbfa3707785c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/74a76634055462833446684fd526d73c290ea43a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5bc2d50fb66b46f86543d5153a188eb1486d0b6e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f86b20ec8d17d77bddc02c5c86cfa2389d84ecff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/770bf0a35f0620b526fd4193889d1e77084e4c43", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/933880a8bc9b4042223a79255c0b1021cdc36991", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d5487249a81ea658717614009c8f46acc5b7101a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1119, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64094", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.032Z", "date_published": "2026-07-19T15:40:01.772Z", "date_updated": "2026-07-19T15:40:01.772Z", "publisher": "Linux", "title": "batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0021, "percentile": 0.11358 }, "nvd": { "published": "2026-07-19T16:17:50.353", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64094", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The batman-adv path can lose its mesh-interface association concurrently and then dereference the now-null pointer while sending an ARP request.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/4f6266735a0ba6a568b6d4c9fa51c33a5a7f2d70", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/53cb3511f6eda37d3bd923545fdba6013b6d7bb7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/efb62458c94db1fe3a287e7e89c31b0cfb03f938", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2a8c9e86529156c62d9187b9ed9454c31665ad33", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0f3ebd7bb417aabc44853cc7c2a184ebb0e05b45", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6921a7683ae9ad0208d829e71f725a9e25ccff49", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/555b8d3f5c313d81d46274fd0976352dafc80124", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f80d3d98d2ff78d9e2fe5d68b1f45948c4f7bd24", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 529, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64095", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.033Z", "date_published": "2026-07-19T15:40:02.360Z", "date_updated": "2026-07-20T13:43:15.413Z", "publisher": "Linux", "title": "batman-adv: bla: avoid double decrement of bla.num_requests", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00267, "percentile": 0.18687 }, "nvd": { "published": "2026-07-19T16:17:50.470", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64095", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Concurrent bridge-loop-avoidance paths update request state and its counter separately, allowing the counter to be decremented twice.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1f013bc94154f2e78e97d0296175664224c796e0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5328b95960774f2e189f22485616bc7b8eb2f7e3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8ff9c59d1b7b48c2596878341a5310f32895d52b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a9393751ecf7e9096f93cb6eed02db4f79125765", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/461f1e3dfb888701895b766446c55db2b10db705", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/45384612f29692fbf0c770200361a7acff90125c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/65497ad155a3246df177b5ef662cd6e5a32cb470", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/83ab69bd12b80f6ea169c8bea6977701b53a043d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1267, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64096", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.033Z", "date_published": "2026-07-19T15:40:02.969Z", "date_updated": "2026-07-20T13:43:16.405Z", "publisher": "Linux", "title": "batman-adv: mcast: fix use-after-free in orig_node RCU release", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00255, "percentile": 0.17025 }, "nvd": { "published": "2026-07-19T16:17:50.600", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64096", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The purge path removes entries visible to RCU readers without waiting for a grace period, permitting access after removal.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ff3a4487ead475e27b43280b8ee3d8464fe280e1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/78a63fb2f7d5630d1c1f2859a20d4e4226863b41", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ced48f55bac73f0822eae90509e51b42b4f646c8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/70bcb678561f0fb58f33270fc73f12f3be72b878", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aef897c9d2dd0d9339167fb82b62beff68d076cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8a3707653ab658e082ccd992e92594e01b09a3fc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/edfb1e094104a50f931553dc82ac59246569fd32", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/20c2d6a20ca936f5aaa6dd40f73f262ac45c87cc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 708, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64097", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.033Z", "date_published": "2026-07-19T15:40:03.599Z", "date_updated": "2026-07-20T13:43:17.391Z", "publisher": "Linux", "title": "drm/amd/display: Validate GPIO pin LUT table size before iterating", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02964 }, "nvd": { "published": "2026-07-19T16:17:50.727", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64097", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The AMD GPIO parsers trust a VBIOS structuresize and iterate beyond the mapped image without validating that the full table is present.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9900f6954be779011e7c2cd42addd87baf028bc5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fb30a3890d62fd50a95aef684faf64a307592e42", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/67461e0c15335894cc5d3b84cda823bf8cbdc886", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7ca695b3122297b06a3ed605bbe1cd32c85d9f5a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f2a4827e980ba07de4391fa84d9c39a12726bdd7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/86d2b20644b11d21fe52c596e6e922b4590a3e3f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 823, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64098", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.033Z", "date_published": "2026-07-19T15:40:04.264Z", "date_updated": "2026-07-20T13:43:18.356Z", "publisher": "Linux", "title": "drm/virtio: use uninterruptible resv lock for plane updates", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00146, "percentile": 0.04335 }, "nvd": { "published": "2026-07-19T16:17:50.843", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64098", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "virtio-gpu continues modifying fence and reservation state after an interruptible lock acquisition fails.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c86077d512ee980cc91322211d35dbcd3175f64c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/21ab64c77a30d56efc506c8fa2ad8959f8ce3d36", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7930eee22cd3df61e85be8aa512032ab303b7167", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8fadd01cf461fee5bb11506621339c548447e5c7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a2359a411b15f495d12cfda6a7db6855ebb7f90f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9af1b6e175c82daf4b423da339a722d8e67a735a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2704, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64099", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.033Z", "date_published": "2026-07-19T15:40:04.925Z", "date_updated": "2026-07-20T13:43:19.332Z", "publisher": "Linux", "title": "drm/v3d: Fix use-after-free of CPU job query arrays on error path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00134, "percentile": 0.03334 }, "nvd": { "published": "2026-07-19T16:17:50.983", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64099", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The V3D CPU-job error path releases the job and then reads query-array fields through the freed cpu_job object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/acd55ea40d03e06f20a9986363019e0e5173990e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0f8efc45740b0628a787d1b0be8a0ddabd700625", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/69c2a1fec2e7ca25598180816f3bc56e1842eb41", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b0fe80c0b9250b35e2211bf3117e7aca814a21b0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1487, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64100", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.033Z", "date_published": "2026-07-19T15:40:05.530Z", "date_updated": "2026-07-19T15:40:05.530Z", "publisher": "Linux", "title": "drm/msm: Fix shrinker deadlock", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.07002 }, "nvd": { "published": "2026-07-19T16:17:51.140", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64100", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The MSM shrinker acquires a dma_resv lock while memory reclaim already holds fs_reclaim, creating a circular lock dependency and deadlock.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/942968260e61d4a5d7552b20814b6277f9c553df", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/928788566c79046f71a211fc32c115400be76402", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3392291fc509d8ad6e4ad90f15b0a193f721cbc9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3998, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64101", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.033Z", "date_published": "2026-07-19T15:40:06.185Z", "date_updated": "2026-07-19T15:40:06.185Z", "publisher": "Linux", "title": "fwctl: pds: Validate RPC input size before parsing", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.07001 }, "nvd": { "published": "2026-07-19T16:17:51.273", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64101", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The PDS firmware RPC handler casts and reads a caller-sized buffer as a full request structure before checking its length.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9e3f18883a98420a3b8873c6f894bc57e9b98e41", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0d470d36551058e3f728574308b815a80bca710f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e7537735028c3ad4b0bfc02ff8fa2a1a28aa04fe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 622, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64102", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.033Z", "date_published": "2026-07-19T15:40:06.776Z", "date_updated": "2026-07-20T13:43:20.335Z", "publisher": "Linux", "title": "RDMA/siw: Reject MPA FPDU length underflow before signed receive math", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.005, "percentile": 0.40065 }, "nvd": { "published": "2026-07-19T16:17:51.383", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64102", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Soft-iWARP subtracts an unchecked peer MPA length from the fixed header size, turning an underflow into a negative signed copy length and then a huge size_t read.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/683f7cfbf514193d63c0efa079f3352bde84c2e0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4a331582011d9e8089af8aa2a61ec6b4443bb245", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/33a8b5e971e294ec2a7b74211c545e09efd8e9ac", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/14553be882d9ce91749c9d64041de66e34ad8e70", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c7c0c0f4379dedec12d24dbb9dded5d2db7fd9f2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1012896f4225e8f801ff3c1648023845b66dfb11", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/775b4dc9618a99a1fa48b57554041a5dc17e1336", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0ce1bc9e46ecabe84772bb561e373c0d9876d6f2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2504, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64103", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.034Z", "date_published": "2026-07-19T15:40:07.372Z", "date_updated": "2026-07-19T15:40:07.372Z", "publisher": "Linux", "title": "scsi: isci: Fix use-after-free in device removal path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07404 }, "nvd": { "published": "2026-07-19T16:17:51.533", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64103", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ISCI teardown does not kill the completion tasklet after interrupt scheduling is quiesced, so a queued callback can access the freed host.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1412995e10c74644b47f242aea6e4f3d4180e806", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a83d3e4daba40d49324cec1c51ed261e1ea48cf1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ab2266601a875982f2d2033f41e070a6d5e615e2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/309c6058622d080fe8c2fab87c30da82d834d989", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cb9e72c50e6c81a5903f27e0b397ce8525d7539b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b9ff8631006233ba246828ac70409d2cb2da38d3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b52a8d52c3125ec9a93106ed816582368de34426", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1472, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64104", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.034Z", "date_published": "2026-07-19T15:40:07.994Z", "date_updated": "2026-07-20T13:43:21.343Z", "publisher": "Linux", "title": "virt: sev-guest: Explicitly leak pages in unknown state", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 8, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 0, "epss": { "score": 0.00133, "percentile": 0.03239 }, "nvd": { "published": "2026-07-19T16:17:51.677", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64104", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A failed encrypted or decrypted page-state transition leaves pages in an unknowable state, so returning them to the allocator could expose unencrypted pages for unsafe reuse.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/bee400ad4f4259c9c0758e4f1960a1eed6f6f9f0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3d0cd0065deeb054b4b29236432e851806b7cc81", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fd948c3f96b18ff9ba7d3e8eae13d196593e1aaf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 572, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64105", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.034Z", "date_published": "2026-07-19T15:40:08.605Z", "date_updated": "2026-07-19T15:40:08.605Z", "publisher": "Linux", "title": "KVM: arm64: vgic: Free private_irqs when init fails after allocation", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06419 }, "nvd": { "published": "2026-07-19T16:17:51.780", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64105", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A vGIC initialization failure frees the vCPU without releasing private IRQ allocations made earlier in initialization.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/173fb86e5519dbe7aabed1f5fa7456152a4a2e38", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7023900b4988fb6f4a59d304d878003ff562e98d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e690caa54a6139d98495ac69626807623520babd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f19c354dbd457759dfcf1195ab4bdba2bb568323", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 639, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64106", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.034Z", "date_published": "2026-07-19T15:40:09.344Z", "date_updated": "2026-07-20T13:43:22.355Z", "publisher": "Linux", "title": "KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 9, "cvss_source_score_spread": 0, "epss": { "score": 0.00148, "percentile": 0.04507 }, "nvd": { "published": "2026-07-19T16:17:51.887", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64106", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The restore path accepts DTE state that the live path rejects, allowing an oversized scan state to be installed.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1716b7fea2ead941a0dfac06c4504a3437cdf00d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dab9f93251b2c86a033de6098d0c73afddd55d4a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b94538186a3eae3763b8f96dacd610920a865aa7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0680f511926589206f81f57f76ce131d7741a316", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8bcd15b690a390241179516af1b6ae49ebfd9d95", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9ce754ed8e7ab4e3999767ce1505f85c449ccb07", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 684, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64107", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.034Z", "date_published": "2026-07-19T15:40:10.079Z", "date_updated": "2026-07-19T15:40:10.079Z", "publisher": "Linux", "title": "ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00162, "percentile": 0.05904 }, "nvd": { "published": "2026-07-19T16:17:52.000", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64107", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "pcm512x_overclock_xxx_put derives a DAPM context from a general mixer control and dereferences the resulting null pointer.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/285159ca199cbbe424223d4b14db227b279b5767", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/09e8f9a9aa19aa8c1b0cc7a0ebc68f6ecf86a660", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 463, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64108", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.034Z", "date_published": "2026-07-19T15:40:10.784Z", "date_updated": "2026-07-20T13:43:23.343Z", "publisher": "Linux", "title": "cifs: Fix busy dentry used after unmounting", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02965 }, "nvd": { "published": "2026-07-19T16:17:52.100", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64108", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Deferred CIFS close work can outlive unmount and retain a dentry reference past generic_shutdown_super because the workqueue is not flushed first.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c7364cea52531534676b9f7dbc0a477c11f4c050", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bdc349a87f1fb02c18c4071858a06542bfea783d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f2deaa2f409a4598eaa10f2a93a676c0632af248", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5e7d9d0805e58fa3760894e73115b7a74024fd07", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e1ffa6cf662383f95816eed1b623429d82675e75", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c68337442f03953237a94577beb468ab2662a851", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1591, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64109", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.034Z", "date_published": "2026-07-19T15:40:11.510Z", "date_updated": "2026-07-20T13:43:24.366Z", "publisher": "Linux", "title": "af_unix: Fix UAF read of tail->len in unix_stream_data_wait()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02902 }, "nvd": { "published": "2026-07-19T16:17:52.233", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64109", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "unix_stream_data_wait reads tail->len after another thread can dequeue and free the tail socket buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/26342087fac93b3932e6af61dc91ec029cb8a623", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/38bccb927d83d7d52e5b20015a172a0b6101d11e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/acdff9907478e82208475b1151700d0b71dcdc63", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5f162f95a95834f06a8ec6140889272ad12e842f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3261, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64110", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.034Z", "date_published": "2026-07-19T15:40:12.224Z", "date_updated": "2026-07-19T15:40:12.224Z", "publisher": "Linux", "title": "igc: fix potential skb leak in igc_fpe_xmit_smd_frame()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06235 }, "nvd": { "published": "2026-07-19T16:17:52.370", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64110", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "igc_fpe_xmit_smd_frame leaves its allocated skb unreleased when transmit-descriptor initialization fails.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f1bafd35f11b3aca1c7bb38da173b8787364a04c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3ebf056556138e74c640e6dc2b3848abd398b460", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e935c37b8a94bb256fada6395a5d05e1c0c6bdaf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 749, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64111", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.035Z", "date_published": "2026-07-19T15:40:13.007Z", "date_updated": "2026-07-20T13:43:25.360Z", "publisher": "Linux", "title": "lsm: hold cred_guard_mutex for lsm_set_self_attr()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00135, "percentile": 0.03411 }, "nvd": { "published": "2026-07-19T16:17:52.463", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64111", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "lsm_set_self_attr checks ptrace-sensitive credential transitions without holding cred_guard_mutex across the decision.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/82d3acee88593e3d9e71cad4b7d6b3cf70de9d07", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5b906f31e977286888a9e31282589b545b249139", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a010cadaf5727b8417f62fe9021fcef14a5f9b51", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4a9b16541ad3faf8bccb398532bf3f8b6bbf1188", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 328, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64112", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.035Z", "date_published": "2026-07-19T15:40:13.652Z", "date_updated": "2026-07-20T13:43:26.331Z", "publisher": "Linux", "title": "rbd: eliminate a race in lock_dwork draining on unmap", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02906 }, "nvd": { "published": "2026-07-19T16:17:52.567", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64112", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "maybe_kick_acquire can requeue lock_dwork after a concurrent cancellation during unmap, allowing lock work to run after image state is released.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3427d7ae38337066ce88b68302e285d344ab756b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9dcd4f5c99b491c37be90b0bd9988db48225fb75", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9400efc76b42c751211974a25c91d2c19c65b01b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2009, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64113", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.035Z", "date_published": "2026-07-19T15:40:14.251Z", "date_updated": "2026-07-20T13:43:27.336Z", "publisher": "Linux", "title": "ixgbevf: fix use-after-free in VEPA multicast source pruning", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.005, "percentile": 0.40064 }, "nvd": { "published": "2026-07-19T16:17:52.680", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64113", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ixgbevf multicast pruning dereferences a receive-buffer object after the cleaning path has released it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1561, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64114", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.035Z", "date_published": "2026-07-19T15:40:14.854Z", "date_updated": "2026-07-20T13:43:28.323Z", "publisher": "Linux", "title": "ipv4: raw: reject IP_HDRINCL packets with ihl < 5", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00136, "percentile": 0.03449 }, "nvd": { "published": "2026-07-19T16:17:52.820", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64114", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An IPv4 header length below five yields a negative length that becomes a large size_t and drives an out-of-bounds access.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1065b9efa4126df559b03a849c139ecfae92cd25", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bc20dbd48c26e743f7e0845020c11ed2ce8b15ee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5a564f737ec54d63e8ee221d3ff396d07586d464", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3c5411fa4944ed99af3d9d1de750ea8169b6dac9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/145e9afa5b905229b4788bb72c3255f5a5f77508", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7725cd3b471740fd23d25ed1da722c671fb2a5d3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bbe0be67de296176e7243c76e3d9f02f6ae9ff0b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/915fab69823a14c170dbaa3b41978768e0fe62fc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2502, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64115", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.035Z", "date_published": "2026-07-19T15:40:15.513Z", "date_updated": "2026-07-20T13:43:29.298Z", "publisher": "Linux", "title": "vsock/vmci: fix UAF when peer resets connection during handshake", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00135, "percentile": 0.03371 }, "nvd": { "published": "2026-07-19T16:17:52.967", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64115", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "A peer reset is treated as success and leaves a pending socket linked while cleanup drops references twice, causing the delayed worker to touch freed storage.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1634, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64116", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.035Z", "date_published": "2026-07-19T15:40:16.240Z", "date_updated": "2026-07-20T13:43:30.328Z", "publisher": "Linux", "title": "ipv6: ioam: add NULL check for idev in ipv6_hop_ioam()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00511, "percentile": 0.40776 }, "nvd": { "published": "2026-07-19T16:17:53.103", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64116", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The network path dereferences idev without first establishing that the pointer is non-null.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c7e8971abd70e9d022f1c251ba2508f8dc7f2db8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/09cbfd4b81ae90963dadb1de99b63b702e73290a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1dca7e491f070ac49b3d934f16ee953a53b37f38", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/902daac307eb7e1955ce05b071950f3cba88c963", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/abdd03229414b5a52943b65a60f34b84cea5ac59", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cf75eb6617042c8cff6112daeed7791809fc9dd2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d4ea0dfd75011b78cebf3808f98ac4c4f51a6fb9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 560, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64117", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.035Z", "date_published": "2026-07-19T15:40:16.941Z", "date_updated": "2026-07-20T13:43:31.348Z", "publisher": "Linux", "title": "wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00234, "percentile": 0.14433 }, "nvd": { "published": "2026-07-19T16:17:53.217", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64117", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Mesh forwarding reuses and may free skb->cb before the RX path reads the aliased status, producing stale data or a use-after-free in rate accounting.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2fb64f94f9afb774f2fa0c7835727d7a67f89f07", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 971, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64118", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.035Z", "date_published": "2026-07-19T15:40:17.643Z", "date_updated": "2026-07-20T13:43:32.317Z", "publisher": "Linux", "title": "qed: fix double free in qed_cxt_tables_alloc()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00152, "percentile": 0.0488 }, "nvd": { "published": "2026-07-19T16:17:53.320", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64118", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An allocation-failure path frees CID bitmaps and leaves their pointers live for a second cleanup pass.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9fe030719bd083b766602692ee96c8c985798e3c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/06fa8e69019fd3c41a7b0ea8c5f509c3a33dc227", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8cf5e4d2ca6b101d163c7423a426fb0aec34f7bb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3904b993cc17ec5d7c5d3b57dbd0b775dafb9684", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bdf678a273cadbccc347f331ae2e93ff4d14834c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0e47fc1c9181ae029e0e35a865cbf2adcbae626c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a04c207f0801abdd23a169b5f902a9845059a65a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2bccfb8476ca5f3548afbd623dc7a6980d4e77de", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 880, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64119", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.035Z", "date_published": "2026-07-19T15:40:18.331Z", "date_updated": "2026-07-19T15:40:18.331Z", "publisher": "Linux", "title": "l2tp: use list_del_rcu in l2tp_session_unhash", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 10, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00167, "percentile": 0.06382 }, "nvd": { "published": "2026-07-19T16:17:53.450", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64119", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "l2tp_session_unhash() uses list_del_init() on a list traversed under RCU, making a concurrently deleted entry point to itself and trapping readers forever.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5e40919a40cb3e590ed45c2a54a4a2518aa88a99", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e0c3dd7b30cc5ee42ab502da140cda93d794a20b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/acab6314bb75be994f720ed13e9d9139cbf828a8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/979c017803c40829b03acd9e5236e354b7622360", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1819, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64120", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:19.044Z", "date_updated": "2026-07-19T15:40:19.044Z", "publisher": "Linux", "title": "net: ethtool: fix NULL pointer dereference in phy_reply_size", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06239 }, "nvd": { "published": "2026-07-19T16:17:53.563", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64120", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A Linux allocation result can be null on an error path that dereferences it before checking whether allocation succeeded.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/61f53c1e58d68723bc1db10912a53f1991f08719", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3dbe20a3809347bacda890822e7ca013bd85a18c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4908f1395fb1b832ceec11584af649874a2732ea", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 975, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64121", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:19.745Z", "date_updated": "2026-07-19T15:40:19.745Z", "publisher": "Linux", "title": "net: ifb: report ethtool stats over num_tx_queues", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06903 }, "nvd": { "published": "2026-07-19T16:17:53.663", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64121", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The IFB ethtool callback walks stats by the larger RX queue count although tx_private was allocated by the TX queue count, reading beyond the array and returning adjacent slab data.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6afdb8113cb007f9332f59a9b7fd45731b8a9de5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/16bd798cb6d8337d7c3eea1adc412f31b5181d5b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/301a554e458e2f5ec47f2c336a7cb03b877f9fd6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f8a5a76b4a683043c6eff2a060bcaa17f9316ad5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2638e1773904d7aa8f24c6e7fda2ed7d69df6fa4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5db89c99566fc4728cc92e941d8e1975711e24b5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1669, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64122", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:20.446Z", "date_updated": "2026-07-20T13:43:33.309Z", "publisher": "Linux", "title": "net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 11, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00461, "percentile": 0.3768 }, "nvd": { "published": "2026-07-19T16:17:53.790", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64122", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The TX recovery path reads sq->netdev after channel reopen has freed the channel containing that send queue.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1604a2d68414aa4cc34faac0b7faa9c14455e8d3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/152295aa7dc2c5e046606f7dadc84fce41136446", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7d260c5d2d89eb2c8c528d54b576b3aae3e20231", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1142, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 11 } }, { "cve_id": "CVE-2026-64123", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:21.161Z", "date_updated": "2026-07-20T13:43:34.311Z", "publisher": "Linux", "title": "net: hsr: defer node table free until after RCU readers", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 16, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02638 }, "nvd": { "published": "2026-07-19T16:17:53.907", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64123", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "HSR teardown frees node-table entries immediately while generic-netlink readers still hold those entries under RCU.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0ea70fb46940620848c08d9d399455c9e82fecdb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c5580114e0492bcd2e0a37613ed4c311e3fa3d4d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7713f4aafb577ff49fa67f0488d9c7dddc64d6ce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6324423a8e6591f41a16c09a8f9a84e554ac147c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8c3af18bb0d7c921a5219194037509463eb2ffde", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aaec7096f9961eb223b5b149abe9495525c205d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 916, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64124", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:21.879Z", "date_updated": "2026-07-20T13:43:35.329Z", "publisher": "Linux", "title": "net: devmem: reject dma-buf bind with non-page-aligned size or SG length", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.0277 }, "nvd": { "published": "2026-07-19T16:17:54.030", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64124", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The device-memory bind path assumes page-aligned DMA sizes and indexes one entry past tx_vec or desynchronizes scatter-gather regions when that invariant is false.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/134c517dfa63203287b2aad6558017f42435a02e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d5008e4e4ee6b739256b796702a7d1aae1b5c3b4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4eb82ba543421e9e38cc14e4e82058b78850df50", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1048, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64125", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:22.590Z", "date_updated": "2026-07-20T13:43:36.374Z", "publisher": "Linux", "title": "net: bcmgenet: keep RBUF EEE/PM disabled", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00552, "percentile": 0.43022 }, "nvd": { "published": "2026-07-19T16:17:54.130", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64125", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The driver enables incompatible RBUF EEE and power-management control bits, causing the hardware receive path to stop forwarding frames and sometimes corrupt receive processing.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2040eb83f6ada148fb32dd98b943a498005d79f2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f2782ddac82c70df313012da5f71f1f06b5553ca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b579f3a73da7a7e74213558f4cc3d865c30aaa78", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/289499907399c5a9f2ed82cb34df49112bb8488f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a212fc08f5c48a16a94092bf0a9a8b7cf4483b11", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3d4ef05266ab16d8ef7dd21658a557801eb78704", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/49bdf6bbb21b9c6e3f4d0c1910bf0ef98424be95", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9a1730245e416d11ad5c0f2c100061d61cc43f60", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1177, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64126", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:23.276Z", "date_updated": "2026-07-20T13:43:37.349Z", "publisher": "Linux", "title": "Bluetooth: MGMT: validate Add Extended Advertising Data length", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00135, "percentile": 0.03388 }, "nvd": { "published": "2026-07-19T16:17:54.260", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64126", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Bluetooth management trusts two embedded lengths without confirming that the command payload contains those bytes, enabling an out-of-bounds read.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0d5104390b445e7bd664ad583837e4c04d892c9d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/14b01b9cba04e6ce82825f68fc4c4322fa4ffa43", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a143ce77a5292f2c9285137433d879ce71d190a7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a6c75a3fad226ccbd8ef9110dee87c92c299f2ab", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f1febe93ef075314615f970a87681d9ab86691d1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0bc1a5a69f541859293d79db72bd7854ac48df51", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d3f7d17960ed50df3a6709c5158caff989c8c905", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 975, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64127", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:23.960Z", "date_updated": "2026-07-19T15:40:23.960Z", "publisher": "Linux", "title": "Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00175, "percentile": 0.07257 }, "nvd": { "published": "2026-07-19T16:17:54.387", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64127", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "l2cap_ecred_reconfigure passes the size and address of a local pointer instead of the packed request object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ed5fcd2a26f0c16fc289c8cd6b03328a0582a687", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/051922ab709c0a6917eae765c22481dfc68379e5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/356c9d1a1cbacd2a1640fff3c050e1c3472e924f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3374ef8cf99368a40f7efd51a2a375a4c5dc6f0d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2714, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64128", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:24.678Z", "date_updated": "2026-07-19T15:40:24.678Z", "publisher": "Linux", "title": "Bluetooth: ISO: drop ISO_END frames received without prior ISO_START", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0018, "percentile": 0.07823 }, "nvd": { "published": "2026-07-19T16:17:54.510", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64128", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Bluetooth ISO receiver accepts an END fragment before any START fragment and appends it through a null receive buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1c3d1e1696b72579b970e17999c503a14535205b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3af41ee7ebecb0d5c8a504861f6cfad31345310f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/39f4a82e80c8f5ed2d6952d73fbafc895721a728", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/61f2410a96dee808029e2ae4d6ef2dd635f3477f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e3a799881c12d27596232636a607e2e3fa448d63", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/84c24fb151fc1179355296d7ff29129ac7c42129", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 788, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64129", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:25.385Z", "date_updated": "2026-07-19T15:40:25.385Z", "publisher": "Linux", "title": "mm/migrate_device: fix spinlock leak in migrate_vma_insert_huge_pmd_page", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00172, "percentile": 0.06878 }, "nvd": { "published": "2026-07-19T16:17:54.627", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64129", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "migrate_vma_insert_huge_pmd_page jumps to its abort path after acquiring the PMD spinlock but skips the unlock label when address-space validation fails, leaving the lock held.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c715f7ccf7a294c058667b678a4ba50fad933c62", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/63451de16e0a08be40f9ab5e7c5c8f5c79676fb1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 522, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64130", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:26.108Z", "date_updated": "2026-07-19T15:40:26.108Z", "publisher": "Linux", "title": "mm/page_alloc: fix initialization of tags of the huge zero folio with init_on_free", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06236 }, "nvd": { "published": "2026-07-19T16:17:54.723", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64130", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The huge zero folio skips clearing allocation tags under init_on_free and exposes stale tag state on its first user mapping.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/738d18f1da3513d17b6f7bf30146cc4ac2480ffd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2f2aec5120b93a8f8b52dc50cdc60dbb8aec72f6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6a288a4ddb4a994490505ab5f41c445f8e6b6467", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2156, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64131", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:26.854Z", "date_updated": "2026-07-19T15:40:26.854Z", "publisher": "Linux", "title": "mm/memory: fix spurious warning when unmapping device-private/exclusive pages", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00172, "percentile": 0.06878 }, "nvd": { "published": "2026-07-19T16:17:54.853", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64131", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The unmap path tests whether the VMA is anonymous instead of whether the folio is anonymous, violating the device-private-page invariant and triggering warnings.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e81446b559db4c98a6c2c5e039ac9cb23658432e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e7af1b15c884ed12bb69da11aec095045d861ee8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a825691b804b35141aaf4eac91003a70846e316d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2fff0cdd942261497fb8922a194b4da3315ae864", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/52f72b3f8f6fa64abb71b711962b97f1f6aced1c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be3f38d05cc5a7c3f13e51994c5dd043ab604d28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3998, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64132", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:27.590Z", "date_updated": "2026-07-20T13:43:38.348Z", "publisher": "Linux", "title": "ipv6: ioam: refresh hdr pointer before ioam6_event()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00491, "percentile": 0.3952 }, "nvd": { "published": "2026-07-19T16:17:55.000", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64132", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Reallocating the socket buffer invalidates a saved header pointer, while the code refreshes only the trace pointer before reuse.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/769723124b7c3b2bfea4cf68ad292698b87c8d01", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/24de676da63c1122d2c13b0d546238b66d1b4e62", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5af905aa8e91ff8d94572a1e089558f21dcf24ed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e46e6bc97fb1f339730ff1ba74267fbf48e7a422", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1153, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64133", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:28.277Z", "date_updated": "2026-07-20T13:43:39.352Z", "publisher": "Linux", "title": "ALSA: asihpi: Fix potential OOB array access at reading cache", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02973 }, "nvd": { "published": "2026-07-19T16:17:55.103", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64133", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ALSA find_control indexes its cached control array without validating the supplied index.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e060e21fe9cca1e5eafd8a1c597026577771e8d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/34d0d492a2812b9289af14bca3573a89275965b2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ffa29cea7bf9a4ef2ea8084967f142e0301ac670", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7b6f8c8eb93f02a74b1de8e521c0952af10d1f43", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8778386e4387b28f2bf8425d7ffc667c6294457f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/61c5017c64e2ac9e10b70b14b17a079dbc0a805f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7d107239935793995bdc6cf29bb99e180bde4c28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7b7d6572145c1dab2dd9bfb550b188e5f0ff3c3f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 296, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64134", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:28.974Z", "date_updated": "2026-07-20T13:43:40.344Z", "publisher": "Linux", "title": "ALSA: pcm: Don't setup bogus iov_iter for silencing", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02908 }, "nvd": { "published": "2026-07-19T16:17:55.227", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64134", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ALSA constructs an iov_iter for a silence path that has no backing user buffer and later dereferences the bogus iterator.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/41a766c647294842c9b17672449f8e011048cba9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ce836587e594af39ff048d9b29dee0f5f10692c9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/feff0251386aa6bb180a0a1cf7c1f91ba868113d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c9f6768515818d71bdfc20119a81f3332c53b9c6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e4d3386b74fba8e01280484b67ee481ece00201e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 615, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64135", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:29.676Z", "date_updated": "2026-07-19T15:40:29.676Z", "publisher": "Linux", "title": "hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07403 }, "nvd": { "published": "2026-07-19T16:17:55.333", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64135", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The ADM1266 driver passes a five-byte stack buffer to a helper that may copy an SMBus block of up to 32 bytes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/33251abb9c9dd62943be76f0427c5527ee39188f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ba09f4baa5bd96c5d26c942defa546a72dbbe5bf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6ed16a40b162e9d87d9ac8bed4d7f0e3e807700e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0dbf64c502443c08c2e28a77ecbfcc5479d93228", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2b7a698d5093b548c464828d984f05ced5f3fd2a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ca560f7566df7e2826c2999e959e6b94eb938f76", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7f705e581ef3e6bb308a121a89adf5237d968204", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eee213daa1e1b402eb631bcd1b8c5aa340a6b081", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 978, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64136", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.036Z", "date_published": "2026-07-19T15:40:30.351Z", "date_updated": "2026-07-20T13:43:41.329Z", "publisher": "Linux", "title": "smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 17, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00491, "percentile": 0.39521 }, "nvd": { "published": "2026-07-19T16:17:55.463", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64136", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "There was missing lock around tc_count increment inside smb2_find_smb_sess_tcon_unlocked().", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/7df1df6f40c0720d30206aa35c0343b962350e0d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/13fb413ae22a37c69341918a6d651d19a9b0b9b7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bf4ebdb19ff9b3cdf992b50715fe61633327416a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e374f4e496fef8168784f93a4477d67be34485fd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4d8690dace005a38e6dbde9ecce2da3ad85c7c41", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 390, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 17 } }, { "cve_id": "CVE-2026-64137", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:31.045Z", "date_updated": "2026-07-20T13:43:42.369Z", "publisher": "Linux", "title": "smb: client: require net admin for CIFS SWN netlink", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02967 }, "nvd": { "published": "2026-07-19T16:17:55.570", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64137", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The CIFS witness netlink command and multicast group omit CAP_NET_ADMIN gates, exposing privileged notifications and session attributes to local users.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9cf7eb8919344932f909b2fac76296f7656fda8d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9919021a3b7974ae66a5f9915e3a48c10cfd409b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/969bc6370334a5b4720c5470783295d6484bbc95", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a3238b09c58f323e40743ce174cd0ab81b5c09ed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a8d17d22db591099519a89f14dd24810daba74c3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c2397b93fbb6f44a788fff30f99be2c20cc5e50f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d1ebfce2c1d161186a82e77590bf7da2ea1bce91", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1060, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64138", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:31.760Z", "date_updated": "2026-07-20T13:43:43.352Z", "publisher": "Linux", "title": "ksmbd: validate SID in parent security descriptor during ACL inheritance", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00415, "percentile": 0.34159 }, "nvd": { "published": "2026-07-19T16:17:55.680", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64138", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SMB ACL inheritance path consumes owner and group SID encodings from a parent security descriptor without first validating their structure, while the public record does not state the downstream failure mode.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f0e5c9c663badc9982e6941322eef1cb17de0f11", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/18d8db24b0a5b7be4829238dd4022236df02d421", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1c9d0646a9959752f11ca1080dc1ff26bd1756cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/69f030cf95488ae1186c72ac8c66fd279664ea7f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 308, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64139", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:32.459Z", "date_updated": "2026-07-19T15:40:32.459Z", "publisher": "Linux", "title": "ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 11, "versionRangeCount": 10, "defaultStatuses": [ "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.08223 }, "nvd": { "published": "2026-07-19T16:17:55.780", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64139", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Overflow exits in the ksmbd ACL-building loops bypass the per-iteration SID free, leaking kernel memory on every crafted request.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9d378e17c864da08c3a4df41dae92cfa6468b00a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/519fb0a42ce5d7e46935577309fb282a5f2c6ea3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0e198f09cb2a554c04de0fea4e790f1250a943ca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eced48cb08f07393a5ea770fdd1026452883c3ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/af92ee994cc7f7e83a41c2025f32257a2f82a7ef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1087, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 11 } }, { "cve_id": "CVE-2026-64140", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:33.194Z", "date_updated": "2026-07-20T13:43:44.317Z", "publisher": "Linux", "title": "ksmbd: fix null pointer dereference in proc_show_files()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00359, "percentile": 0.28599 }, "nvd": { "published": "2026-07-19T16:17:55.887", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64140", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SESSION_LOGOFF clears a durable file pointer tcon while leaving the pointer globally registered, and proc_show_files later dereferences that null tcon.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8eab081627b67216d1c8f638b68289b500dc9a6b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/904901561e61a2b559070b20c74a8c95491f30aa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1223, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64141", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:33.890Z", "date_updated": "2026-07-20T13:43:45.317Z", "publisher": "Linux", "title": "ksmbd: fix null pointer dereference in compare_guid_key()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 13, "versionRangeCount": 12, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00441, "percentile": 0.36231 }, "nvd": { "published": "2026-07-19T16:17:55.983", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64141", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Session logoff clears a lease entry's connection pointer but leaves the entry linked for a later lookup that dereferences the null pointer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e43cb36d4d7827710cfcd48e95e29a507f0d87be", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0836081b394ca074d1b910f2b990ff7b4b4404c7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cd5c1b75d2f454f625d7dc55bd3ae21d0855f6ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/af86896ca3239e25a6bd7d352213371265073d38", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4b83cbc4c15f09b000cc06f033f64b0824b6dc87", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1827, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 13 } }, { "cve_id": "CVE-2026-64142", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:34.605Z", "date_updated": "2026-07-20T13:43:46.278Z", "publisher": "Linux", "title": "ksmbd: close durable scavenger races against m_fp_list lookups", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 11, "versionRangeCount": 10, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0048, "percentile": 0.38881 }, "nvd": { "published": "2026-07-19T16:17:56.103", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64142", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Concurrent list-head reuse and reference-count updates allow an object to be freed while another path still uses it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3a436932eb397e909d0607d76a8325abd9d85a35", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/95f072ef934ca00711d510676b8792cbf59a5aae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5da69a65b282d2276de22e5194ba0f88c836170c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1f8f3246d55f89350a1a67bdf3744b7241048e4e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bf736184d063da1a552ffeff0481813599a182cc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3998, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 11 } }, { "cve_id": "CVE-2026-64143", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:35.337Z", "date_updated": "2026-07-19T15:40:35.337Z", "publisher": "Linux", "title": "platform/x86: uniwill-laptop: Do not enable the charging limit even when forced", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00162, "percentile": 0.05903 }, "nvd": { "published": "2026-07-19T16:17:56.243", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64143", "family": "HARDWARE_PHYSICAL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The force option enables a charging-limit mode on older hardware where that electrical state can permanently damage the battery.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c832a00c9b929b9ad26772833d425f520b2e09cd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/26cbe119f99c86dcb4a0136d2bc73c0c716d80e4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 390, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64144", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:36.041Z", "date_updated": "2026-07-19T15:40:36.041Z", "publisher": "Linux", "title": "Bluetooth: btmtk: fix urb->setup_packet leak in error paths", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00175, "percentile": 0.07257 }, "nvd": { "published": "2026-07-19T16:17:56.347", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64144", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Bluetooth driver fails to free an URB setup_packet when submission fails or the submitted URB is killed.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2a1905730e0c771b999906a7b509722f795563c6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/68c027c2003b0a8a1439d0301c59c6fd1eb3b844", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a0f5268c77eb73f84ba7c210ddfc54b1c73ff80c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0d2572bafea33c7cd1d77c6a25f25ff31a432482", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dd1dda6b8d6e1f4376a5b3055a04f0ecbdb4d6bd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 259, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64145", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:36.767Z", "date_updated": "2026-07-19T15:40:36.767Z", "publisher": "Linux", "title": "wifi: wilc1000: fix dma_buffer leak on bus acquire failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06235 }, "nvd": { "published": "2026-07-19T16:17:56.443", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64145", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The wilc1000 firmware-download error path returns after bus acquisition fails without freeing its previously allocated DMA buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/95c82d498d74c4e587db30021ca1aec90e29b5a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/32d7584441b9ecb279a03653b432612546e5efbe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dd7b6a8671939708cc4b7a46786d8c11297e8f69", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 738, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64146", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:37.474Z", "date_updated": "2026-07-19T15:40:37.474Z", "publisher": "Linux", "title": "erofs: fix metabuf leak in inode xattr initialization", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00162, "percentile": 0.05903 }, "nvd": { "published": "2026-07-19T16:17:56.547", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64146", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "EROFS xattr initialization exits through error paths without dropping the acquired metabuffer folio reference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/492c73b21fefa36f3869cb2b188ffb7fe37b3a9b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/79b09c54c6563df9846ca3094bcfd72082c3e1d7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 695, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64147", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:38.198Z", "date_updated": "2026-07-19T15:40:38.198Z", "publisher": "Linux", "title": "pds_core: fix debugfs_lookup dentry leak and error handling", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 15, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00175, "percentile": 0.07257 }, "nvd": { "published": "2026-07-19T16:17:56.643", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64147", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Firmware-reset recovery drops the referenced dentry returned by debugfs_lookup without dput and also treats an error pointer as a valid dentry.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/60ef1675b652e912f3eb064767af4432393291fd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/26e19622c485e53c3fdb299e822068a0542ddf0c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/91d13e92b983e6c6d7631012c2e20ae8057de9f2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d7f4dd4c8fb380898fef7a77d48fce7ccdb4fc32", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dc416e32baaeb620b9809e9e25fc7b30889686e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 568, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 15 } }, { "cve_id": "CVE-2026-64148", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:38.816Z", "date_updated": "2026-07-20T13:43:47.299Z", "publisher": "Linux", "title": "pds_core: fix error handling in pdsc_devcmd_wait", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00475, "percentile": 0.38564 }, "nvd": { "published": "2026-07-19T16:17:56.753", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64148", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "pdsc_devcmd_wait returns stale success after firmware stops or a command times out because its failure state is skipped or overwritten before recovery.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3231aff8ab26111c54e630b1a200fc43a729dd14", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/784dd2bdc622ed3cc6ef8e113aa1852e252de36f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/560d559324169fe0583d54c475b5329550a86f71", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0e46b6635b03d29807f810c3b415c4755a3f958d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 770, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64149", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:39.423Z", "date_updated": "2026-07-19T15:40:39.423Z", "publisher": "Linux", "title": "dma-mapping: move dma_map_resource() sanity check into debug code", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.07003 }, "nvd": { "published": "2026-07-19T16:17:56.860", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64149", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "dma_map_resource applies a pfn_valid sanity test to device MMIO in normal builds, misclassifying valid resource mappings as RAM.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/181e67bc11c5ec5b87c6c512c2078752b23ca8d4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/004a777879ff629f6e0ca3d09ad09fa3452bcc4d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/af0c3f05866237f7592219bfe05387bc3bfc99b5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1553, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64150", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:40.027Z", "date_updated": "2026-07-20T13:43:48.295Z", "publisher": "Linux", "title": "netfilter: nft_inner: release local_lock before re-enabling softirqs", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00442, "percentile": 0.36357 }, "nvd": { "published": "2026-07-19T16:17:56.970", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64150", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An error path enables bottom halves before releasing the local lock, violating the required lock-state order.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/df19b6af171695a1352314597c9a4311d48d5171", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6fecd39c6401134b58505bc4eb1adc8a0e2fe992", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a6cb3ff979855f7f0ee9450a947fe8f96c2ba37a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 237, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64151", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:40.643Z", "date_updated": "2026-07-20T13:43:49.434Z", "publisher": "Linux", "title": "iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00119, "percentile": 0.02048 }, "nvd": { "published": "2026-07-19T16:17:57.070", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64151", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The IOMMU page-table fast path proceeds even when the driver page-size bitmap omits PAGE_SIZE, violating the path assumption.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/00850f41da24423587abd6124a790dd4f12bcef3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8ef3f77c440005c7f04229a75976bfc078364247", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 452, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64152", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.037Z", "date_published": "2026-07-19T15:40:41.354Z", "date_updated": "2026-07-20T13:43:52.224Z", "publisher": "Linux", "title": "iommu: Handle unmap error when iommu_debug is enabled", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00108, "percentile": 0.01411 }, "nvd": { "published": "2026-07-19T16:17:57.170", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64152", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The IOMMU map-error path performs debug unmap bookkeeping before a matching debug map state has been established.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0cd028806efc148a75d4acf711d21db335a89661", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0735c54804c709d1b292f3b6947cfb560b2ce552", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 667, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64153", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:42.102Z", "date_updated": "2026-07-20T13:43:53.289Z", "publisher": "Linux", "title": "drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00139, "percentile": 0.03691 }, "nvd": { "published": "2026-07-19T16:17:57.270", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64153", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The MSM DRM path stores a signed iommu_map_sgtable error result in the wrong type and treats the changed negative-return contract as a successful mapping length.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3c2cdb7c07f664b77e2a75b50793b845d5742efa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3e3c3c95ef4fe17231a9149e27bcfc9dae2dd89f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7256e54583aee21e23929e7554278c2f5c1a08b1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3457807aeb88077712f0a7cb65c3ca5120773d75", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f4e37f3df436c2bdd2621c21f9c72c8f149a221d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3a45af37733446e114bf19b0209fe7d8089bdb8b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/55e0f0d1c1a4ee1e46da7da4d443eb3044fb3851", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 483, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64154", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:42.807Z", "date_updated": "2026-07-19T15:40:42.807Z", "publisher": "Linux", "title": "drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06132 }, "nvd": { "published": "2026-07-19T16:17:57.390", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64154", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "a6xx_gpu_init returns through error paths without releasing the device-node reference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2be24c945e76cd538ce5dd2e50f5d3e7d848c175", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e64bca63647db1d5518198d6c5ca2dbcc66b182b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 519, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64155", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:43.545Z", "date_updated": "2026-07-19T15:40:43.545Z", "publisher": "Linux", "title": "wifi: ath11k: fix error path leaks in some WMI WOW calls", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06967 }, "nvd": { "published": "2026-07-19T16:17:57.483", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64155", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Two ath11k WOW command error paths return after a failed send without freeing the allocated skb.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d6c7b8d0dc22c0a8743435db8f42d98524b70df3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cd43d587dd333517c806cd24696e6e1a26b9951e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3d675896ea03aca631852a2a7e91e6cb8f664967", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/008955b1348452de25bc19d6e0f0f673d4cb9a3c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/acde4692afcdaea6de3e2996ddfaeaa7ae6b0130", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d618d322b95c80d5ad7091f35a7193e4050dcc27", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/55dda532bbc261aef495e403c8900c5e2ab5fa34", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 308, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64156", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:44.277Z", "date_updated": "2026-07-19T15:40:44.277Z", "publisher": "Linux", "title": "netfs, afs: Fix write skipping in dir/link writepages", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06234 }, "nvd": { "published": "2026-07-19T16:17:57.603", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64156", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A network-filesystem write path skipped because of lock contention fails to re-mark the inode dirty, losing the pending-write state after VFS cleared it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/77bb293049d61e04c12b24ebbffafaf5ab36af90", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f91e10435c0dd37c48b1b25e6236284f656ddc0c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9871938f99cc6cb266a77265491660e2375271f5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 648, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64157", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:44.964Z", "date_updated": "2026-07-19T15:40:44.964Z", "publisher": "Linux", "title": "netfs: Fix partial invalidation of streaming-write folio", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 10, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.0642 }, "nvd": { "published": "2026-07-19T16:17:57.703", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64157", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Partial invalidation advances a streaming-write folio's dirty offset to the start instead of the end of the invalidated region, leaving stale dirty-state boundaries.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f6b2569ae29b666fd15ff2848684c445ba442a39", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3d9601c029b934b5b6a10f99791467b10eb6b211", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6a3d27116be2c5fb9a03d5cf37c486ac517f3689", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6d91acc7fb85d33ea58fca9b964a32a453937f4b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 611, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64158", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:45.692Z", "date_updated": "2026-07-20T13:43:54.323Z", "publisher": "Linux", "title": "netfs: Fix write streaming disablement if fd open O_RDWR", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00085, "percentile": 0.00377 }, "nvd": { "published": "2026-07-19T16:17:57.807", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64158", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "netfs disables write streaming based only on the current descriptor being O_RDWR even though reads can arrive through other descriptors and gaps are already filled on demand.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9adf8e47d73d5e3c2fe77dea649dcde350ccd65c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/616578e40dcba3f94810d841c5a52b7e3bc8ede7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7a9fa5b020a3a40f8291a71cd44c08d931da430d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/70a7b9193bbbfceaab5974de66834c64ccc875dd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1075, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64159", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:46.400Z", "date_updated": "2026-07-19T15:40:46.400Z", "publisher": "Linux", "title": "netfs: Fix zeropoint update where i_size > remote_i_size", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 6, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.05213 }, "nvd": { "published": "2026-07-19T16:17:57.913", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64159", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "netfs updates the zero point from the larger local i_size instead of the server's remote_i_size and later treats unwritten remote data as zero.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5cd5207de519ef0c085f4f559adf5eefcb4c5202", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4543a4d737944134a1394afe797622546fbcc98a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1612, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64160", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:47.063Z", "date_updated": "2026-07-20T13:43:55.325Z", "publisher": "Linux", "title": "netfs: Fix potential for tearing in ->remote_i_size and ->zero_point", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00407, "percentile": 0.33504 }, "nvd": { "published": "2026-07-19T16:17:58.010", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64160", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Concurrent netfs size reads and writes lack the shared seqcount and inode lock needed to prevent torn remote_i_size and zero_point values.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/55970f238d495517edc961d55c44c772594d0969", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2c8f4742bb76117d735f92a3932d85239b16c494", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 460, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64161", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:47.761Z", "date_updated": "2026-07-19T15:40:47.761Z", "publisher": "Linux", "title": "net: ti: icssm-prueth: fix eth_ports_node leak in probe", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00167, "percentile": 0.063 }, "nvd": { "published": "2026-07-19T16:17:58.113", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64161", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An error return from icssm_prueth_probe omits the matching node release and leaks the eth_ports_node reference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/994358adc0982d17731ffea7dfacd25afcc89773", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ca029dde6ad732a5aba28d6b107d7a84ba5e302b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6635fa84403c3a59455b66007c019a7cc632db30", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 330, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64162", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:48.461Z", "date_updated": "2026-07-20T13:43:56.296Z", "publisher": "Linux", "title": "idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00347, "percentile": 0.27389 }, "nvd": { "published": "2026-07-19T16:17:58.213", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64162", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The PTP worker can run before read_dev_clk_lock is initialized and then operate on the uninitialized lock.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/eb5991d4c8ba2e8153dfcda3e66a9608377b7dce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3122d70b7c0101d897fb795658a7b93f854935f2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/da4f76b6a84ede14a71282ef841768299ead0221", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2057, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64163", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:49.172Z", "date_updated": "2026-07-19T15:40:49.172Z", "publisher": "Linux", "title": "test_kprobes: clear kprobes between test runs", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00164, "percentile": 0.06019 }, "nvd": { "published": "2026-07-19T16:17:58.327", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64163", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Repeated kprobe tests reuse static probe objects without clearing state left by the prior unregister cycle.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/08d355936fcf70c81c94f9fe7310450b65c53399", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/accc0004c501a9918313142282b094d408af06fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1c24cf1fd67f6702c719ab73499392cb7af956ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/96515819d79f356f40da5540968d838ea570fab9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ef5581bb30efb939cc2bf093475c6cc85258e5cd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1342, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64164", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:49.894Z", "date_updated": "2026-07-19T15:40:49.894Z", "publisher": "Linux", "title": "btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06085 }, "nvd": { "published": "2026-07-19T16:17:58.450", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64164", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A Btrfs trace event calls a potentially sleeping dput operation while running in atomic trace context.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d78b0a80eac36879ef5478707135c446920e134b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4361954f0e158af0530caa1e57f12b531be4658f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6279992c9ba2774901c9d4dd4a481162e2534714", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/26b2290baaf6da6add0f782a100766e686a33f4f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/12a0487945c09760a5968d9333383014ea294117", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c32a7e0e3c73c1c0768556a56bd78de9f7b83780", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0a96d9a85cd2240481297156b9bb72e10b7a8036", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c73370c677646e86fc4b1780fb07027bdf847375", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1892, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64165", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:50.585Z", "date_updated": "2026-07-19T15:40:50.585Z", "publisher": "Linux", "title": "ARM: integrator: Fix early initialization", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00172, "percentile": 0.0686 }, "nvd": { "published": "2026-07-19T16:17:58.587", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64165", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ARM Integrator early initialization calls an allocating syscon registration path before memory management is initialized, so the required initialization state cannot be established.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/22c738fb51f2d8b23ddff5cc0ccb2dd685bb39d3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/812103fb6da904bd03d62cf6a9826e537318ceed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6624854554c4c2bdfed3559e5c11bb03b16e7bd1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/508b1193d63b5e073a3fe103eeb785fcba2d368c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/58a112b0973f6cd6bcb8c503d1ff88be411ed0f0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e984dc22e2c24dc34d6728e338c82b1ce7862753", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/33ad014abec90f37dade0e00560f28864187e21a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/90d77b30a666049ad24df463f52e5d529c44e8cd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1743, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64166", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:51.305Z", "date_updated": "2026-07-19T15:40:51.305Z", "publisher": "Linux", "title": "firmware: arm_ffa: Check for NULL FF-A ID table while driver registration", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06511 }, "nvd": { "published": "2026-07-19T16:17:58.723", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64166", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The FF-A bus match callback unconditionally dereferences a driver's absent id_table instead of rejecting that driver during registration.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f98f131256beaddd51ad468e95d90d857fef12bf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bc499d1acddbb75b5b4bce05f5296dd8ef9611fd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/adfff93d08a2e12ecf2a1eba272d18bc749f13c0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/34f59211984f66788390e7469f3e99d3796db4a8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/820245d86ce58898fb48b4fefc77d0cafc02801d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/198f6c86d508ed562f07dc00276cac6dbb5dd3bf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0a5e695095c557d2380131b613dea4e8d90371be", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 358, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64167", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:52.023Z", "date_updated": "2026-07-19T15:40:52.023Z", "publisher": "Linux", "title": "kho: skip KHO for crash kernel", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00161, "percentile": 0.05767 }, "nvd": { "published": "2026-07-19T16:17:58.833", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64167", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "KHO metadata is added to a crash-kernel image even when its scratch regions lie outside the crash kernel's reserved memory.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a6ac6721326a75ff2d14c68db05f93b576d8762f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a6715d7ec472a476db17787697a4abda62962284", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1101, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64168", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:52.741Z", "date_updated": "2026-07-19T15:40:52.741Z", "publisher": "Linux", "title": "spi: sprd: fix error pointer deref after DMA setup failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06116 }, "nvd": { "published": "2026-07-19T16:17:58.937", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64168", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A DMA setup failure leaves an error-valued pointer reachable by a later release path, causing invalid or repeated cleanup.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/be74e276111f3c23b8e040c8c5e308f67a573add", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a8f233fb0c7be29b97cd249f64120bf35ce72805", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0cdea166c1a07c200caf9d0b722224fca43b23ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/450c319dd04d0eeff4184889768f7ada826a2e35", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b6f1acf4e57ccf708cdc0cb70f5bb5b65162963b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be409d2bbe9ca7da7b05cc7dde7499bc481f0766", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c33b4496e95d04722055446c0a31213639438536", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3d67fffb74267772d461c02c67f1eff893ad547d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 484, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64169", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.038Z", "date_published": "2026-07-19T15:40:54.092Z", "date_updated": "2026-07-19T15:40:54.092Z", "publisher": "Linux", "title": "spi: ep93xx: fix error pointer deref after DMA setup failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00156, "percentile": 0.05287 }, "nvd": { "published": "2026-07-19T16:17:59.060", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64169", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The EP93xx SPI fallback leaves DMA channel error pointers installed and later dereferences them during cleanup.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b6c0dabea07e25bd7db19a77ebfd0d02b9e2671a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8e027db9fa310b1d5e7ad928510be800c4f004d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0e2189ab095e3657f37b8295f3f2bbcde0f27529", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5e121a81667a83e9a01d62b429e340f5a4a84abc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 431, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64170", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:40:54.999Z", "date_updated": "2026-07-19T15:40:54.999Z", "publisher": "Linux", "title": "spi: qup: fix error pointer deref after DMA setup failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06086 }, "nvd": { "published": "2026-07-19T16:17:59.163", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64170", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The QUP SPI driver falls back after DMA setup failure without clearing the error pointer and later dereferences it as a valid DMA object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0bb3bd442f0bdad3932739a61dd6c580c9c1955e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d577c55d189e7ae150973058d13e299b6855633f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9e673affb92c29d9ba879bf4ea81c5e840166b56", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/45760b72e84c1a1498f1a8a9047184c85299da20", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8f9b61d255b1e989b8913b06c8ebe0aba5e1b238", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4bb4764f2c51f03f657a28029eb0595d8223aab5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4f4051e9d644c371c50de4a042b85bba6727d5c3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a7e8f3efd50a165ba0189f6dc57f7e51a7d149db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 479, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64171", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:40:56.071Z", "date_updated": "2026-07-19T15:40:56.071Z", "publisher": "Linux", "title": "i2c: tegra: fix pm_runtime leak on mutex_lock failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00145, "percentile": 0.0428 }, "nvd": { "published": "2026-07-19T16:17:59.283", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64171", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The Tegra I2C mutex-failure path returns without releasing the runtime-power reference acquired immediately beforehand.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8f7ed203b39004c02479a9156089d87d1ac2c1d8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57cf4e8d6a57dc2ef5810f4852a23ba4c71b74bb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 422, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64172", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:40:57.153Z", "date_updated": "2026-07-20T13:43:57.277Z", "publisher": "Linux", "title": "KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00135, "percentile": 0.03413 }, "nvd": { "published": "2026-07-19T16:17:59.383", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64172", "family": "HARDWARE_PHYSICAL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Hygon Family 18h CPUs are derived from AMD Family 17h (Zen1) silicon and share the same erratum #1235: hardware may read a stale IsRunning=1 bit during ICR write emulation and silently fail to generate an AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit on the sending vCPU.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/94ade38f317ea086a181db0e6b69c574b3b70a5e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9560e6fee887a9594a89fa265b5b9c79b1591803", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9a12fa5213cfc391e0eed63902d3be98f0913765", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 823, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64173", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:40:58.251Z", "date_updated": "2026-07-19T15:40:58.251Z", "publisher": "Linux", "title": "tracing: Do not call map->ops->elt_free() if elt_alloc() fails", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06086 }, "nvd": { "published": "2026-07-19T16:17:59.493", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64173", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The tracing cleanup path calls elt_free() even when the corresponding element allocation never succeeded.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/49332e49ad5b20262cc719b03d4123b9362de701", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b559a218eece132de0c58d444877b5627cbee524", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b427e9f6d81c9341cba23ef92f860f99f830d91d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f383cff9fb382139980bac1bcd3f3f5d59f68435", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1a150947f8480262a46c860f1acb9c6597ca7097", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/798183376d9d3e278a270ea0e75a5769c8f145d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b6723339736320b2e1784258ad4490cec7aac11a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8f0f5c4fb9df0e19a341e0c6ed8dc4fda9124f03", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 309, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64174", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:40:59.360Z", "date_updated": "2026-07-19T15:40:59.360Z", "publisher": "Linux", "title": "wifi: cfg80211: advance loop vars in cfg80211_merge_profile()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00172, "percentile": 0.06882 }, "nvd": { "published": "2026-07-19T16:17:59.617", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64174", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Multi-BSSID merge loop does not advance its element variables, repeatedly copying the same continuation until the buffer or CPU budget is consumed.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5817e1e5205498a5df66eba2b34e817f4210fd0f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cedbb608494ba1e7a5c6c56b7f1d3fd470094f28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1ced0f5a851f9cae274545a42a06c459b7fd8881", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/67915715fd3874057457363c87c63e18829527df", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6cfae4914439878b8acb35c7e3b40096eeb2ad9c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1343a480f84b80c1249133a90ef87f8751d65cbb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7666dbb1bacc4ba522b96740cba7283d243d16e1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1114, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64175", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:41:00.157Z", "date_updated": "2026-07-20T13:43:58.293Z", "publisher": "Linux", "title": "wifi: iwlwifi: mld: stop TX during firmware restart", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00349, "percentile": 0.27619 }, "nvd": { "published": "2026-07-19T16:17:59.750", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64175", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The iwlwifi transmit path keeps dequeuing, submitting, failing, and freeing frames after firmware restart begins, creating an unbounded CPU and allocation-churn loop.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/dc31c69476520bb4c2a208211a8d3c310a62c4d0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/13f1786395dbbf3df73337063c798f1266be6151", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2becb38a3e217ef2b2f42fddd7db7a25905ec291", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1393, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64176", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:41:00.830Z", "date_updated": "2026-07-20T13:43:59.291Z", "publisher": "Linux", "title": "wifi: iwlwifi: mvm: fix driver-set TX rates on old devices", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 8, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00209, "percentile": 0.11225 }, "nvd": { "published": "2026-07-19T16:17:59.853", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64176", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The driver converts old-device TX rates with the wrong rate representation, sending an index where the firmware expects a PLCP value.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6fe92651b44fd3cfc8dcfdaad0e82885c384dada", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6b58a79f2cd98156856eb49e8b55db5facdd7e6d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fb84b5cbcaab3ca0f4e961d92a40ed7f3aac483b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1155, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64177", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:41:01.534Z", "date_updated": "2026-07-19T15:41:01.534Z", "publisher": "Linux", "title": "phonet/pep: disable BH around forwarded sk_receive_skb()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06086 }, "nvd": { "published": "2026-07-19T16:17:59.977", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64177", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The PEP receive path acquires a child socket lock with bottom halves enabled in process context and disabled in softirq context, permitting self-deadlock.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f08c45076e4fd8b0adbc5eb186d6e6a3e7350d7b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b2606c302d7f2b4ee48da05e32ed60aed1b0cd53", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/02c04df84de709060f63e1d52ec67488c4f6f212", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8420aa4900417797323dd567ba9d1512280c2dc3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bd795f106b3889fb0706c6e4831c4b27e2b5666b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/84bc87beb4cd77670939b446326788e4c9b3db37", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a3fc8f2dacd1c37325977fc1fbbf3d52141df99e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dbc81608e3a653dea6cf403f20cae35468b8ab9c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2801, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64178", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:41:02.293Z", "date_updated": "2026-07-20T13:44:00.259Z", "publisher": "Linux", "title": "Bluetooth: bnep: Fix UAF read of dev->name", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00249, "percentile": 0.163 }, "nvd": { "published": "2026-07-19T16:18:00.147", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64178", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A network device can be freed while another path is still reading its name.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a75bbcb10cb21acc169b785e9804f57d97873a9c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4907596f25b1720fa948371ac5f6c1f8da10a5bc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/915a92182e2cda9cd7d2479020a44c6eda986f7c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fe69f634b076ae3ca81c5a5b845d9bba527036f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b21805258d7e926adfd455fc820a447b90da3b82", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5506aec795135cdd4cbf4e845929155663b25055", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e7578529b97e5d4e439cf8f3e637c2303015338f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/59e932ded949fa6f0340bf7c6d7818f962fa4fd2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 616, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64179", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:41:03.019Z", "date_updated": "2026-07-19T15:41:03.019Z", "publisher": "Linux", "title": "net: wwan: iosm: fix potential memory leaks in ipc_imem_init()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00161, "percentile": 0.05785 }, "nvd": { "published": "2026-07-19T16:18:00.277", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64179", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ipc_imem_init omits ipc_protocol_deinit on later error paths and leaks the protocol allocation.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f1a4d57847813fae42fbb7eb35f2dd48b9cff8a9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ba6d8643019c33428f7c0658863e80e0b04a70f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6f63a60580ebdd9a1f22f89a84814d1fefe16b1c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/583fd5a8fc797c8ecf2e1a7b923740c5e5734e85", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ffb6dbb49c96be82f07c7b112e3ebc3e6fdd8dd5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8f764a7810a9f114313c439d25b11f4417c6e0dd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c5d93b2c40355e999715262a824965aac025a427", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 336, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64180", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:41:03.751Z", "date_updated": "2026-07-19T15:41:03.751Z", "publisher": "Linux", "title": "mm/memory_hotplug: fix memory block reference leak on remove", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00157, "percentile": 0.05333 }, "nvd": { "published": "2026-07-19T16:18:00.397", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64180", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Memory-block removal acquires a device reference with find_memory_block and never drops it after clearing the altmap.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b8ab30c79fc00147125b9c39f928561d9dd13d06", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/09ce923071e7852ece60d7368e05249bf32c7967", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/df64c0d21c3f85f844b2f656333e43d97e6ffa74", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/93866f55f7e292fe3d47d36c9efe5ee10213a06b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 730, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64181", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:41:04.455Z", "date_updated": "2026-07-20T13:44:01.228Z", "publisher": "Linux", "title": "mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00128, "percentile": 0.02811 }, "nvd": { "published": "2026-07-19T16:18:00.493", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64181", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The memory manager treats huge zero mappings as special even on architectures that do not implement the required PMD or PUD special marker.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/62153767e8fc3889bc6508e9ffe927aaf64c4334", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9052ea2ee2233be5d4786b8909151ca2bfbedf99", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c0c6ccd9828c3a1950623b546fa57292a77b5c73", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1471, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64182", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:41:05.186Z", "date_updated": "2026-07-19T15:41:05.186Z", "publisher": "Linux", "title": "drivers/base/memory: fix memory block reference leak in poison accounting", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00157, "percentile": 0.05334 }, "nvd": { "published": "2026-07-19T16:18:00.600", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64182", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The poison-accounting helpers acquire a memory-block device reference on every successful lookup and never release it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/686b4283f82cd630fafd7ca9b03dfc080b3ec8fa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ce60d9452a0f2effa72fd20ea270c59ca691d455", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/24840b3139d7415144b81e4f9f4c44670d15bed9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8502e2c2d0633f99d94d22ae8dabc10caae1fc2a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/03a2cc1756a0570f887d624cd6c535ea0cbd4951", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 483, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64183", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:41:05.896Z", "date_updated": "2026-07-19T15:41:05.896Z", "publisher": "Linux", "title": "efi: Allocate runtime workqueue before ACPI init", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00164, "percentile": 0.06019 }, "nvd": { "published": "2026-07-19T16:18:00.703", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64183", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ACPI PRM can invoke the EFI runtime sandbox before the workqueue it requires has been allocated.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/29cd94e678fcb3c4fd0f359deeac6d61334323fc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6996e954ae830f5b793ba6cf449885ca519dbdd2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c32a1fbe0f9a48453a552bb315cc4f1e7a74084e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e871549f7894ad4114b3dd53f241aa25a268ba8b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/13c6da02e767152c9ac4330962247a5e47011035", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1026, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64184", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:41:06.615Z", "date_updated": "2026-07-19T15:41:06.615Z", "publisher": "Linux", "title": "mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00157, "percentile": 0.05334 }, "nvd": { "published": "2026-07-19T16:18:00.817", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64184", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "damon_sysfs_memcg_path_to_id exits mem_cgroup_iter without its required break operation, retaining a cgroup reference past the iteration lifetime.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/082351f9d40007414ad6af062b3a26fa02fd4b5f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/30a361be33f3793b9ecbd10ab7be6d0564819b79", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/302e02f9ba49f81418ec2a749ae6f5cac1d424e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1bd31386ec3b9ccec10c04429948a306ec5897c0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d4e7b5c4cc353f154d5ab8bb2e1ce7714d77a6e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 376, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64185", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:41:07.340Z", "date_updated": "2026-07-19T15:41:07.340Z", "publisher": "Linux", "title": "sysfs: don't remove existing directory on update failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06444 }, "nvd": { "published": "2026-07-19T16:18:00.917", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64185", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "sysfs_update_group removes a pre-existing named directory when creation of one updated file fails, turning an update failure into deletion of prior state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c5e125c828b701afaf7493b42a14aa89362ff36d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ccadd32cc1263802a5969c9efe0e96225450428c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/14f2c14ae86c4af17a0a9f8ab46dacf2d5fd1d8a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/31527d80234caf83dc96ad478645e57df9de4472", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57b285e0368290aa55f79ba11419b96d0ebdb418", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/48fa96538bd2868034d33429e4565fda384d0736", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/708f6926f61f71e09b5e9fd668b9882ccd46e69f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/237557b8a81ab948e8332f7c0058e758f081c0a3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 690, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64186", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.039Z", "date_published": "2026-07-19T15:41:08.054Z", "date_updated": "2026-07-19T15:41:08.054Z", "publisher": "Linux", "title": "iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.0518 }, "nvd": { "published": "2026-07-19T16:18:01.037", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64186", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A u32 value converted to int can become negative and later form an out-of-bounds index or length.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/488d2c76bd9f78433a70690d1054bfae3d39a407", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/62f9dfbf1aceae88b03c5ca08f7d36e943939dec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8dfd3d8d74435344ee8dc9237596959c8b2a6cbe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1158, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64187", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.040Z", "date_published": "2026-07-20T16:27:46.653Z", "date_updated": "2026-07-24T14:34:17.271Z", "publisher": "Linux", "title": "xfs: fail recovery on a committed log item with no regions", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00161, "percentile": 0.05729 }, "nvd": { "published": "2026-07-20T17:18:21.743", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64187", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "XFS recovery accepts a committed log item with no regions and later dereferences its null ri_buf array through ITEM_TYPE.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5105426424ad6981db827cc1ada835a488fab035", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d0ae7ec3aa61db5140b107f0a63e017f63e56a96", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d50b1fd066d66ceb548ba43e332cfe8a47e5e55a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d98f22d2e11e0a36493aeb25b2933571ee90d9a4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cccbabeb9a18fcb978d76d6047f2b59214aa7749", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2094dab19d45c487285617b7b68913d0cc0c1211", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1467, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64188", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.040Z", "date_published": "2026-07-20T16:27:47.216Z", "date_updated": "2026-07-27T04:58:35.734Z", "publisher": "Linux", "title": "net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00117, "percentile": 0.01961 }, "nvd": { "published": "2026-07-20T17:18:21.853", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64188", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "rmnet frees an object immediately after removing it from an RCU-protected structure, before readers have passed a grace period.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c4e676c3505c5058922dc1a6f1ded795f6758135", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9918698cf3aee4032e12bb42fd5a951dc465339b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/310b93246bfec7d4452507e0c15477377ed9f025", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1078ae8175777e80c9637996fb4a46c55f0ce576", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/41e06fcc5df0774d212e70c5b503fc769492bce3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8b17adf6d4fb6bf61fa4c3f58366a7c082799a71", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f193e38cb257d033060b63f1cfd94af076b3a2ab", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d00c953a8f69921f484b629801766da68f27f658", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1644, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64189", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.040Z", "date_published": "2026-07-20T16:27:47.767Z", "date_updated": "2026-07-27T04:58:47.094Z", "publisher": "Linux", "title": "netfilter: ipset: fix race between dump and ip_set_list resize", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00121, "percentile": 0.02277 }, "nvd": { "published": "2026-07-20T17:18:21.997", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64189", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The ipset dump path reads a resizable array outside an RCU read-side critical section, allowing a concurrent resize to free the array while the dump still indexes it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a7a299277959683204d73333c32c092fd69327d4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1bc67c3fc98e9fc07032cc56afcdbc690c47d11e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e8a9976b61f1bc4aa7fd25fa26726dfdf2adf710", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/96fbafc20ebd9a613736c2998b89c539fe3042f5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ff86ea9b7fdf70564e60436fbee68c96bc459943", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/81d54c766337b923eec26da0a13406760b091093", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e8ee198bbc04a32d336e79160fde980e0235b39f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7cd9103283b26b917360ec99d7d2f2d761bcf1ab", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1632, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64190", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.040Z", "date_published": "2026-07-20T16:27:48.314Z", "date_updated": "2026-07-20T16:27:48.314Z", "publisher": "Linux", "title": "net: team: fix NULL pointer dereference in team_xmit during mode change", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0015, "percentile": 0.04718 }, "nvd": { "published": "2026-07-20T17:18:22.117", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64190", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A mode-change path temporarily clears the team transmit callback while another CPU can call it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/03e9405c518c4d61f28079492f252d6d4e2bac5c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/25fe708bbc59289d3d1ea4b126fbc1b460a072a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1565, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64191", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.040Z", "date_published": "2026-07-20T16:27:51.120Z", "date_updated": "2026-07-27T04:58:48.249Z", "publisher": "Linux", "title": "i2c: stub: Reject I2C block transfers with invalid length", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.0276 }, "nvd": { "published": "2026-07-20T17:18:22.217", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64191", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "i2c-stub trusts an ioctl-supplied block length above the 32-byte union capacity and reads or writes beyond the stack object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/7e9072dbd5f2f17934751873450d2c22080ead80", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/21e87f336ac6303fed54a69b1d0d79a23b25c8d0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3fd225f3e4cd67ec8ddab1afed9da03c7c43537c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1c4ffe6b4f04365485ed58d64c9bb86b46fc9037", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4bd8635f28c135a08aac6badcd7d9b5cdb34335f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5f4d2bd028ebb6e4c09a9d64842546022321d4a7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0526931b16e5a118d367b7bfce7d797e63f7ac69", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1892, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64192", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T07:54:57.040Z", "date_published": "2026-07-20T16:27:51.720Z", "date_updated": "2026-08-03T09:32:37.971Z", "publisher": "Linux", "title": "bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00162, "percentile": 0.0587 }, "nvd": { "published": "2026-07-20T17:18:22.367", "lastModified": "2026-08-03T10:16:32.263", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64192", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Linux permits BPF inode-storage maps before the BPF LSM initializes its security-blob offset, so later writes alias and clear an RCU callback pointer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5337eebdf8c5d4810b1913047f078d2815d5645f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/de984ea883405420fdc416ae8964b752df586970", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/267fdd9b6530c399dfd996e1a0a7628b45baf9f0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c76b8abce575e0c6e4096957220b4515ed847d89", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1674, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64193", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T10:13:00.756Z", "date_published": "2026-07-20T17:54:42.087Z", "date_updated": "2026-07-21T18:55:09.291Z", "publisher": "CPANSec", "title": "Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR", "affected": { "vendors": [ "NLNETLABS" ], "products": [ { "vendor": "NLNETLABS", "product": "Net::DNS" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-95", "name": "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:1", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00828, "percentile": 0.53963 }, "nvd": { "published": "2026-07-20T19:17:30.047", "lastModified": "2026-07-21T19:35:17.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64193", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled text crosses into an executable or interpreted grammar without the required context separation.", "basis": [ "CNA", "CWE-95" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56", "host": "www.net-dns.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://rt.cpan.org/Ticket/Display.html?id=179945", "host": "rt.cpan.org", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/20/12", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 522, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64194", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T10:13:00.756Z", "date_published": "2026-07-20T17:55:05.169Z", "date_updated": "2026-07-21T18:56:01.149Z", "publisher": "CPANSec", "title": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains", "affected": { "vendors": [ "NLNETLABS" ], "products": [ { "vendor": "NLNETLABS", "product": "Net::DNS" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-674", "name": "Uncontrolled Recursion", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:1", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00433, "percentile": 0.35621 }, "nvd": { "published": "2026-07-20T19:17:30.157", "lastModified": "2026-07-21T19:35:17.130", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64194", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Net::DNS recursively processes attacker-controlled structure without an effective depth limit, allowing stack exhaustion.", "basis": [ "CNA", "CWE-674" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56", "host": "www.net-dns.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://rt.cpan.org/Ticket/Display.html?id=179946", "host": "rt.cpan.org", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/20/13", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1338, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64205", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.769Z", "date_published": "2026-07-20T16:27:53.310Z", "date_updated": "2026-08-03T09:32:39.050Z", "publisher": "Linux", "title": "i2c: i801: fix hardware state machine corruption in error path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0017, "percentile": 0.06682 }, "nvd": { "published": "2026-07-20T17:18:22.487", "lastModified": "2026-08-03T10:16:32.430", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64205", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The i801 error path clears hardware ownership and status registers even when its pre-check failed and it never acquired the SMBus controller.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2ef69871b313aa0f02182795f5e0f5aa455f203c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ef5a347532932f58748dad485c15039f5168c377", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bb5133a7d5f3fe5c387770e25f2e00e682ce11ed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/00904687b9c5527d569d9a1ca72119823e735a61", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/10dd1a736d557e310a77117832874729a0175d57", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1512, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64206", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.769Z", "date_published": "2026-07-20T16:27:53.885Z", "date_updated": "2026-07-27T04:58:49.469Z", "publisher": "Linux", "title": "Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00262, "percentile": 0.179 }, "nvd": { "published": "2026-07-20T17:18:22.620", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64206", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "L2CAP teardown holds conn->lock while synchronously cancelling work whose handler needs the same lock, creating a circular wait.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/fc0c3b9cf27cfa2a06f66dae1d08c668fe0a2faa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9901f847a762a5d953871dd95767ce2aed3d684d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4a0bb0fd63fe2b0c62e1072cd1811d6f61e0081c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8daaf7f73fe998631a160d1a5a7e1b0b0480eef8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8de7b386ffad480ca59222b688c94a2da8f0d805", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d5616beb3355b5fca2280d796c1cf7ada4ee6551", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e96fbac8d3a73b0bc165383c092a30628561d320", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2641a9e0a1dd4af2e21995470a21d55dd35e5203", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1123, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64207", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.769Z", "date_published": "2026-07-20T16:27:54.447Z", "date_updated": "2026-07-20T16:27:54.447Z", "publisher": "Linux", "title": "net/sched: dualpi2: fix GSO backlog accounting", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.0518 }, "nvd": { "published": "2026-07-20T17:18:22.733", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64207", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "DualPI2 overcounts a segmented packet in its parent queue, leaving qlen nonzero after all real packets are gone and causing QFQ to dereference a null aggregate.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c4b70c1512b8f9f33f23c2c8196dfd1210207681", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/806586e33891066487db1f002be3d455cda6b516", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/05ed733b65ab977dd931e7f7ac0f62fdb81205c2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 888, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64208", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.769Z", "date_published": "2026-07-24T15:23:00.113Z", "date_updated": "2026-07-27T04:58:50.652Z", "publisher": "Linux", "title": "crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00432, "percentile": 0.35519 }, "nvd": { "published": "2026-07-24T16:16:48.420", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64208", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "RxRPC passes a message to Kerberos decrypt or verify processing without first enforcing that the packet has the required cryptographic length.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/585f9f6aef5c4542ac9d6ec45cd7dbc7df9af3ff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9217017f4bce53dddb8d547837f1f707045d64ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2b50aceafe6606ea52ed42aadd1b4d44a188aade", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 342, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64209", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.769Z", "date_published": "2026-07-24T15:23:00.691Z", "date_updated": "2026-07-24T15:23:00.691Z", "publisher": "Linux", "title": "phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.05194 }, "nvd": { "published": "2026-07-24T16:16:48.523", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64209", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The DisplayPort swing check accepts index four for a four-element array because it uses greater-than instead of greater-than-or-equal.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/cb35af6e7f3d5628178b58c631e305b1def8edf7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ea17fc4d7dc2ba6459b1a318962960520201baf1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 311, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64210", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.769Z", "date_published": "2026-07-24T15:23:01.328Z", "date_updated": "2026-07-27T04:58:51.772Z", "publisher": "Linux", "title": "net/mlx5e: xsk: Fix unlocked writing to ICOSQ", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00343, "percentile": 0.2697 }, "nvd": { "published": "2026-07-24T16:16:48.623", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64210", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "After NAPI affinity changes, two CPUs write and advance the same ICOSQ without a lock.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8d3b91e7d81000d295cd914d4d9d6f860252e2bf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c326f9c68921e2f14dfcecb2f6b4216313d50248", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3126, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64211", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.769Z", "date_published": "2026-07-24T15:23:01.889Z", "date_updated": "2026-07-24T15:23:01.889Z", "publisher": "Linux", "title": "srcu: Don't queue workqueue handlers to never-online CPUs", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.05194 }, "nvd": { "published": "2026-07-24T16:16:48.747", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64211", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SRCU queues per-CPU work while switching modes without restricting targets to possible CPUs, allowing callbacks to be assigned to CPUs that can never run them.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a4153538fcd2361c4e0039eb103265492d26044e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/593889c401426004bd0ea0f6d4fcece728b03420", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1126, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64212", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.770Z", "date_published": "2026-07-24T15:23:02.449Z", "date_updated": "2026-07-24T15:23:02.449Z", "publisher": "Linux", "title": "wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 8, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.0622 }, "nvd": { "published": "2026-07-24T16:16:48.843", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64212", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "iwl_mld_remove_link reads link->fw_id before checking whether link is null.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3a74aaad047353da3344aed32e9042d4f334f926", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b6b4db85c7baf0788c5e7ec61350c1ff2bb775e0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 500, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64213", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.770Z", "date_published": "2026-07-24T15:23:02.987Z", "date_updated": "2026-07-24T15:23:02.987Z", "publisher": "Linux", "title": "hwmon: (lm90) Add lock protection to lm90_alert", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06219 }, "nvd": { "published": "2026-07-24T16:16:48.950", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64213", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The lm90 alert handler updates shared configuration without the lock used by sysfs writers, allowing a concurrent write to re-enable an active alert line.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/bed1fc32e0eb653806fa98afcf55f9a311fc4ce2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b0b66aae8a94c3663d47e4000b0e81b89ce32186", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/873e919e3101063a7a75989510ccfc125a4391cf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 773, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64214", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.770Z", "date_published": "2026-07-24T15:23:03.529Z", "date_updated": "2026-07-24T15:23:03.529Z", "publisher": "Linux", "title": "powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06943 }, "nvd": { "published": "2026-07-24T16:16:49.053", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64214", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A redundant preemption-disable operation in the real-mode machine-check path dereferences a preemption counter that is inaccessible in that execution mode.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/51860e423592893cd7bfa7287d99a3aff4dc3a9d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a09d07ac45e283c9861a9ceea06f56d0ba851d22", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/72d8d1c36452a4d3ee134b1da48de7518c1329f9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6dcd072a5ae3aed336e4a67a7d4cc5205b240065", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8079acc5ee5235a627e4586d4f42082a9000ea64", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/31467b23823ffec1f6fff407f8e3ca9af8b7491a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2307, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64215", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.770Z", "date_published": "2026-07-24T15:23:04.085Z", "date_updated": "2026-07-24T15:23:04.085Z", "publisher": "Linux", "title": "drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00156, "percentile": 0.05233 }, "nvd": { "published": "2026-07-24T16:16:49.193", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64215", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "a8xx_hfi_send_perf_table dereferences the result of kzalloc without checking for allocation failure.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/17c993bf44a54afd1fde184ba7f9c287dfc2632e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b5c7a7f452b885bfbe102bd3a057a5f496802f8b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 289, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64216", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.770Z", "date_published": "2026-07-24T15:23:04.673Z", "date_updated": "2026-07-27T04:58:52.969Z", "publisher": "Linux", "title": "netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00448, "percentile": 0.36786 }, "nvd": { "published": "2026-07-24T16:16:49.310", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64216", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "netfs_unlock_abandoned_read_pages reads folio indexes from a request after another path can release that request.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6080fa3ecfbb4448a3b47368629534c09b6ec750", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3866d015f33aeedf81338dd99154703bef33faef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dbe556972100fabb8e5a1b3d2163831ff07b1e8e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 764, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64217", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.770Z", "date_published": "2026-07-24T15:23:05.261Z", "date_updated": "2026-07-27T04:58:54.092Z", "publisher": "Linux", "title": "netfs: Fix overrun check in netfs_extract_user_iter()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02942 }, "nvd": { "published": "2026-07-24T16:16:49.417", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64217", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "netfs_extract_user_iter permits iov_iter_extract_pages to write more page pointers than the pages array can hold.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/00efe58bbdcc93272d579ca24bfc912563f4a204", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/96cc3beb2390ba9f9c128c5733c0ccfe450dd4f9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/afeb32d9bf9aaeea51d0f723a19f14afb73bd94d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f48b9157f0f611fa436c360648603d5ded719b12", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0ef37eef83fad3542ee06db2940433ae1a92b39d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 367, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64218", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.770Z", "date_published": "2026-07-24T15:23:05.814Z", "date_updated": "2026-07-27T04:58:55.344Z", "publisher": "Linux", "title": "batman-adv: bla: fix report_work leak on backbone_gw purge", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02992 }, "nvd": { "published": "2026-07-24T16:16:49.520", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64218", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The backbone-gateway purge can free an entry while its report_work is running or leave a pending work reference uncancelled.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ce2c0ee4d76d5ee4b391fe0e31334361e25030ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3423a45e5c3d3c5129f88143a9a969787d7d5a0a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f1303adb1e59582f76c22798a2e2e150e054a9e7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/48663158222b3b7f6ee6791a67d512ede7fc94bb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eeddd7bab3d59c1e98642a204141f8c5d6194707", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c6de1a5a9c406e30b91f1515a6ce05cc84023baa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/95a7034661274cf5985708bd2f6d86ee46f88fa9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0459430add32ea41f3e2ef9351610e6d33627a6b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1032, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64219", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.770Z", "date_published": "2026-07-24T15:23:06.379Z", "date_updated": "2026-07-27T04:58:56.757Z", "publisher": "Linux", "title": "drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7, "cvss_source_score_spread": 0, "epss": { "score": 0.00135, "percentile": 0.03374 }, "nvd": { "published": "2026-07-24T16:16:49.670", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64219", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The display handler copies an unchecked payload length into a 16-byte stack array and indexes dc->links without checking link_count.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d6590e3f766e3111dd1beaf88b9384d117acfa6b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/16a5fa57565afb6bf37e18129921c270c93d8e2b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/90c398e822ca76e40548df0c061dd4f93ea92d71", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3265f3ed373fb8048be713aadcdf702579a0e53d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1ecde19bfce6535bffddad1139ff466b6d401b8e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1c8c6e912f2945b2a3e669afca6b52174b88e86e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c92f6d9600efa3ef0d9e560a2b52776d9803c29", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 829, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64220", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.770Z", "date_published": "2026-07-24T15:23:06.931Z", "date_updated": "2026-07-24T15:23:06.931Z", "publisher": "Linux", "title": "device property: set fwnode->secondary to NULL in fwnode_init()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06943 }, "nvd": { "published": "2026-07-24T16:16:49.797", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64220", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "fwnode_init() leaves the secondary pointer uninitialized, allowing later firmware-node traversal to dereference stale stack or heap contents.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f0e211d6539fae800217c10797993b7592d6ab01", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3f1024deeab3b5443c29b3de4fe475e87309b8fa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/371f53925a6714d0aa35f1aefdffc3e8cd62f480", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/34bf74b1fd2e4a44e27821a329204caf09df2976", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/508fd8ab158abd04b7f7d0f707cd6d6c405df4ea", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f59e686c778cb41b8f7aa8fab2afd6a01afb3d47", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/215c90ee656114f5e8c32408228d97082f8e0eef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 568, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64221", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.770Z", "date_published": "2026-07-24T15:23:07.502Z", "date_updated": "2026-07-27T04:58:59.450Z", "publisher": "Linux", "title": "spi: ti-qspi: fix use-after-free after DMA setup failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02667 }, "nvd": { "published": "2026-07-24T16:16:49.923", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64221", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A DMA setup failure releases the channel but leaves its pointer live for later DMA use or a second free.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9c6f306a8140962c7284197db54b96fdb5f468d6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3bbbe7ae3fdada0df4157c1ffe989f92dfa8dcd6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d6f422b122922d1abee907d673bcc990e5f3672d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f2dc841d7dc9063fe9b47ced869b1271e55052ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1cd927002120678bd5d23c760246639caa53040e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d7a076fb596c7b408ed6df74793a597990a6d860", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/178b9b570c0f75fa7e691490520328b20d19138e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ea6ec3343e05f7937a53eb6d7617b3abdb4abc19", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 511, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64222", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.770Z", "date_published": "2026-07-24T15:23:08.072Z", "date_updated": "2026-07-27T04:59:00.636Z", "publisher": "Linux", "title": "octeontx2-pf: avoid double free of pool->stack on AQ init failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7, "cvss_source_score_spread": 0, "epss": { "score": 0.00122, "percentile": 0.02292 }, "nvd": { "published": "2026-07-24T16:16:50.053", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64222", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An AQ initialization failure frees pool->stack without clearing the pointer, and shared unwind cleanup frees the same allocation again.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e6e9bc0bf963662b7042048ab0281014625d4cb4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b92e7ea408b6f1144648909c9c49a55d245d7300", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/94192b0579333c3deee2441379aab8ca98fc2e6b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4c29603498b05c049dbbbc47e882f2fbf0193cd7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0488a0bb344fb1992853b60082acff6be8164d74", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0d9b9d7dbef976ae7f855b6358f1d703014e96ea", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c4b8c5d51632538b19ee01cf6d70cbceeefbd3ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9b244c242bec48b37e82b89787afd6a4c43457e1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1032, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64223", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.770Z", "date_published": "2026-07-24T15:23:08.629Z", "date_updated": "2026-07-27T04:59:02.025Z", "publisher": "Linux", "title": "wifi: mac80211: consume only present negotiated TTLM maps", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00256, "percentile": 0.172 }, "nvd": { "published": "2026-07-24T16:16:50.197", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64223", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The negotiated TTLM parser advances for absent map entries and later reads a present entry beyond the validated element.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f7d395dc5008168ac5b9c1ac2791e59a6078cca1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2dd9304727c7041df0a599595910bdbe02ad03c5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 991, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64224", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.770Z", "date_published": "2026-07-24T15:23:09.209Z", "date_updated": "2026-07-24T15:23:09.209Z", "publisher": "Linux", "title": "octeontx2-pf: fix double free in rvu_rep_rsrc_init()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06277 }, "nvd": { "published": "2026-07-24T16:16:51.320", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64224", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A hardware-initialization error path releases resources that the caller then releases a second time.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8864b664d0443ecb8e56690e5546fcda5fe5e81b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eb72a65f2bb2cc059e2ca5d83de01fdf3ea602ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e8fb3de2a8effcaf62bec2c56b93d8bb480371d1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1109, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64225", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.771Z", "date_published": "2026-07-24T15:23:09.785Z", "date_updated": "2026-07-24T15:23:09.785Z", "publisher": "Linux", "title": "octeontx2-af: CGX: add bounds check to cgx_speed_mbps index", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00176, "percentile": 0.07379 }, "nvd": { "published": "2026-07-24T16:16:51.440", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64225", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A link-speed value can index positions 13 through 15 of a 13-element cgx_speed_mbps array.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/94071141f00bc414e8f8f7f5db3b5143d535299f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/985b5e38ac4f4d5ff03c8bfd8484353b440a1579", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/93d3dc81098cd60fb74d434ba7985ddfd9de5acb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e043017ac429caee73bd30c5a725659f1a3a4568", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8201bf45cc7c1c1a09290c4db8ab1e19801f8fec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/47a4cf2229be379cf88f92e32e1240337cd6273f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2c3d26b4a62454945ba9ef3af3174d3e40e7afef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c0bf0a4f3f1f5f57aa83e1400ba4f56f0abfd542", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 351, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64226", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.771Z", "date_published": "2026-07-24T15:23:10.388Z", "date_updated": "2026-07-27T04:59:03.180Z", "publisher": "Linux", "title": "sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02941 }, "nvd": { "published": "2026-07-24T16:16:51.673", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64226", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "scx_root_enable_workfn drops the last task reference before scx_error reads the task's command and PID.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/cf396941901858b0de426cdcd3974eea6a02c98c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/45c7c4e3db8b700307313c035ea08be829a7f21b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57e19ba3f58a67eb924022a5a60b67fd08e5cbbd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9a415cc53711f2238e0f0ca8a6bcc796c003b127", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 395, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64227", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.771Z", "date_published": "2026-07-24T15:23:10.936Z", "date_updated": "2026-07-27T04:37:25.776Z", "publisher": "Linux", "title": "ACPI: driver: Check ACPI_COMPANION() against NULL during probe", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06472 }, "nvd": { "published": "2026-07-24T16:16:51.793", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64227", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A forced platform-driver match can enter probe without an ACPI companion and dereference the absent object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a9451bf561232314755baf69a5916e0ac77f33fc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/34f4d0e4e5065237d15651df759a99e81b7f9f51", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/612ddab8fce04394bd7aebe8e0f2599642e30859", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e4865a56d013e86e46ea6acea15bb6eae01898ff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 681, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64228", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.771Z", "date_published": "2026-07-24T15:23:11.510Z", "date_updated": "2026-07-24T15:23:11.510Z", "publisher": "Linux", "title": "net: ethtool: phy: avoid NULL deref when PHY driver is unbound", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.0622 }, "nvd": { "published": "2026-07-24T16:16:51.913", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64228", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ethtool PHY reply path dereferences phydev->drv after sysfs unbind can clear that pointer while leaving the PHY attached.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3586924625559e6f9876d726c80ff0a75f0d5849", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/17fe2381f967d353183f374a1c0181a6d194158c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e3adf69f8eb121a9128c2b0029efd050d3649153", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 753, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64229", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.771Z", "date_published": "2026-07-24T15:23:12.069Z", "date_updated": "2026-07-24T15:23:12.069Z", "publisher": "Linux", "title": "x86/mm: Disable broadcast TLB flush when PCID is disabled", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06278 }, "nvd": { "published": "2026-07-24T16:16:52.023", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64229", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Booting with nopcid disables PCID but leaves INVLPGB broadcast flushing enabled, violating the feature dependency required for nonzero PCIDs.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/fed725cace3ab1c4f7f8182e35029a603d953187", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d2d6d21286719b454d5d87a8758c23d2377d88a2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/44126343d58c68adaa8343fbf1c07dd20078c35e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1544, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64230", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.771Z", "date_published": "2026-07-24T15:23:12.616Z", "date_updated": "2026-07-24T15:23:12.616Z", "publisher": "Linux", "title": "regulator: tps65219: fix irq_data.rdev not being assigned", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06278 }, "nvd": { "published": "2026-07-24T16:16:52.140", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64230", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The TPS65219 regulator IRQ path calls the notifier through irq_data.rdev even though the earlier helper removal left that pointer uninitialized.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6827647fd2dcf4e7f355478a42e82f51e0b5344c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b986f88b22a5374191c195c073350bbeb1bb6518", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f9b2d3b703d13df50c630997dfdc25648e96db0d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1250, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64231", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.771Z", "date_published": "2026-07-24T15:23:13.175Z", "date_updated": "2026-07-24T15:23:13.175Z", "publisher": "Linux", "title": "drm/msm/dsi: don't dump registers past the mapped region", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06943 }, "nvd": { "published": "2026-07-24T16:16:52.250", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64231", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The dump size is not reduced by the I/O offset, so the operation accesses an unmapped region past the available buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5e2c196c3430fb94225c4102b1028d0146544761", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/567b5e976e2e15280d78c9ef2add1954a0bbb5b1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9f8274749d9010a1a72f97e547b7eb9ebb82345b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a184aec790135938b0fadb415e55accd1f8685a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ab871d5882953e5574ae2bc47bec88c2e3d22663", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5b49a46baa853b26dbefa65c6c75dd9ff69f63d4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 868, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64232", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.771Z", "date_published": "2026-07-24T15:23:13.729Z", "date_updated": "2026-07-27T04:59:04.371Z", "publisher": "Linux", "title": "block: recompute nr_integrity_segments in blk_insert_cloned_request", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00463, "percentile": 0.37809 }, "nvd": { "published": "2026-07-24T16:16:52.367", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64232", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "blk_insert_cloned_request reuses the top queue's cached integrity-segment count without recomputing it under tighter bottom-queue limits.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/53a01bcc0242590eda4c452a5bd996f62457113b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0943f81e1b3176f27dbaf6db268fc69d8a94f0ba", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/42929c98d044f126508baf54a65b0f87f932fa75", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2c6e6a18a37b905cb584eb0dda3ae482162a81ca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1535, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64233", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.771Z", "date_published": "2026-07-24T15:27:39.710Z", "date_updated": "2026-07-24T15:27:39.710Z", "publisher": "Linux", "title": "usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00157, "percentile": 0.05315 }, "nvd": { "published": "2026-07-24T16:16:52.490", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64233", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The UVC extension-unit walk reads shared descriptors without the lock required to keep concurrent mutation from changing the traversal state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e15c414092b3c24610cc771e481a723b0f645eca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2c9e0905ef7e69f7b814cd709613f6b3b5b98805", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/caec0145e5974e85fe5192fc6a6f5aa1a98f82a6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5f1b9cff88982e2a2053d8b1fd983f7ccb9f03cc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/68aa70648b625fa684bc0b71bbfd905f4943ca20", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1525, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64234", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.771Z", "date_published": "2026-07-24T15:27:40.263Z", "date_updated": "2026-07-24T15:27:40.263Z", "publisher": "Linux", "title": "tty: serial: pch_uart: add check for dma_alloc_coherent()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06117 }, "nvd": { "published": "2026-07-24T16:16:52.610", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64234", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The pch_uart driver dereferences the result of dma_alloc_coherent without checking whether allocation returned NULL.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/760df81763b391bb5f0dcb0b7597b736da753ae4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5f2e2a240dc1846e049bc67e9c3cdf5b031d08bf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/daea997bb244aeb50cbb2e5e075fb446a6cf068f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6dd5c0ea139b586ad5a091677056dafd405cfe82", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d846df2dfbc2469a688833b4cc4f8aa80672bde8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/66f8bfea055b23719b4fd6ce207c44de37d82a59", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d8d53a343ebe74274ca17b1e1993042e99f8c863", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6fe472c1bbbe238e91141f7cabc1226e96a60d43", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 344, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64235", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.771Z", "date_published": "2026-07-24T15:27:40.814Z", "date_updated": "2026-07-27T04:59:05.504Z", "publisher": "Linux", "title": "x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00332, "percentile": 0.25714 }, "nvd": { "published": "2026-07-24T16:16:52.737", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64235", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Dynamic ftrace trampolines copy a RIP-relative per-CPU instruction without relocating its displacement to the trampoline address.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8093442a2d1d4b42b9340a86023ccb2afb30b93a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d59cc66b702757e3c5a711e78a38583eac0c2738", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9edff632ca216169846f8a63a5a3dc467e239c7a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a17dc12bfed8868e6a86f3b45c16065a70641acb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2654, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64236", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.771Z", "date_published": "2026-07-24T15:27:41.371Z", "date_updated": "2026-07-24T15:27:41.371Z", "publisher": "Linux", "title": "i2c: davinci: fix division by zero on missing clock-frequency", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.05166 }, "nvd": { "published": "2026-07-24T16:16:52.860", "lastModified": "2026-07-30T14:59:47.950", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64236", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The fallback I2C frequency is expressed in kilohertz but processed as hertz, truncating it to zero before a divider calculation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3f43865cb64dd7cb50efae1281a95585617b12a1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9b694bc0e1831cbc5c3bbfd1b156ec719128f7d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/030675aa54cf757769b3db65642433d626b3ed7c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 782, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64237", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.771Z", "date_published": "2026-07-24T15:27:41.937Z", "date_updated": "2026-07-27T04:37:26.944Z", "publisher": "Linux", "title": "Input: elan_i2c - validate firmware size before use", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06117 }, "nvd": { "published": "2026-07-24T16:16:52.960", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64237", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The firmware parser trusts an attacker-controlled size when indexing or copying firmware data and can access beyond the supplied image.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/47b52b98edfe34d0249e72f815215ef24311c3a3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c2c3b33b3c0bf2c9427c0926817ef5ffac50de6f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/331d49b4e1c9efe4479bbd22922dfcdd8c64be7b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/48b0aa9c08a3ac8e0c0345b7ca581f552324e460", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3b37190ad3ded3a15fb1dbfc4f26df520a3e59bb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bf769358419e00344c1b16fa034d058f563d46a1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d97baee9590edf303b3eca432e61de9320834fe1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/76b0d0baa9ae9c60e726bbe1b6ff0bec2c993634", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 337, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64238", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.772Z", "date_published": "2026-07-24T15:27:42.482Z", "date_updated": "2026-07-24T15:27:42.482Z", "publisher": "Linux", "title": "gpio: shared: fix deadlock on shared proxy's parent removal", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 6, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00145, "percentile": 0.04269 }, "nvd": { "published": "2026-07-24T16:16:53.090", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64238", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An overly broad lock is held across an operation that re-enters the same synchronization domain, allowing a reachable deadlock.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a554dfcd30dd5e41d1d67387b3bb85cea83e12e1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a1b836607304f71051f9f9dcccf8b5097b86a1fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 694, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64239", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.772Z", "date_published": "2026-07-24T15:27:43.057Z", "date_updated": "2026-07-24T15:27:43.057Z", "publisher": "Linux", "title": "mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00156, "percentile": 0.05275 }, "nvd": { "published": "2026-07-24T16:16:53.193", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64239", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Delayed kobject release leaves a soon-to-be-freed DAMON region on the linked list while refresh can reuse that list.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c0e37017a452addec873865c94cf7a665663a9b2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a5fa42214de55e43d165144727ce9facb9fc6b08", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0ba6c05156d9ff9fc6ca22b7690e2eec9eca66f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2c33177023c92e76806c535ddbffaa3d3fc37777", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/441f92f7d386b85bad16de49db95a307cba048a2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1688, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64240", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.772Z", "date_published": "2026-07-24T15:27:43.590Z", "date_updated": "2026-07-24T15:27:43.590Z", "publisher": "Linux", "title": "media: rc: igorplugusb: fix control request setup packet", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 12, "defaultStatuses": [ "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06117 }, "nvd": { "published": "2026-07-24T16:16:53.323", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64240", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The USB driver passes the address of a request pointer as the control setup packet, causing pointer bytes to be interpreted as protocol fields.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e823e4294511989f5962e7ad85bf4d179ba74f52", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2243ad78ce64d344754260533ae7730c2174a34a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aa22590a16e51455c6db802c774b31aadc604a9a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/060fca8e098387f949e4eedaf215d952e477ac12", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0d880d2db9856e94127ab09331363bef59f98005", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f33b5a61673bd220fdaaf4202cf1013d6d66c943", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5cc3f6db72f77d1a8f7f1cf4ac01803927ffdf15", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/171022c7d594c133a45f92357a2a91475edabe20", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 787, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64241", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.772Z", "date_published": "2026-07-24T15:27:44.144Z", "date_updated": "2026-07-24T15:27:44.144Z", "publisher": "Linux", "title": "gpio: rockchip: teardown bugs and resource leaks", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00156, "percentile": 0.05276 }, "nvd": { "published": "2026-07-24T16:16:53.443", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64241", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Driver removal leaves a chained interrupt handler registered after its owning state is torn down, so a later interrupt can call stale code and panic.", "basis": [ "CNA" ], "deepDive": false, "notes": "The record also describes clock-reference and IRQ-domain leaks; the stale handler is the selected primary safety failure." }, "references": [ { "url": "https://git.kernel.org/stable/c/cdc603ce3118232712ba443dd8b414d8f25ca467", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7f945f7f10f442270518dfd768d230227c495fcf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6be81e77e1748665d7ddab9128ff1d35eb75b87d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9500077678230e36d22bf16d2b9539c13e59a801", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1182, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64242", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.772Z", "date_published": "2026-07-24T15:27:44.730Z", "date_updated": "2026-07-24T15:27:44.730Z", "publisher": "Linux", "title": "usb: gadget: net2280: Fix double free in probe error path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06118 }, "nvd": { "published": "2026-07-24T16:16:53.553", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64242", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The probe error path frees an object explicitly after its gadget release callback has already taken ownership of the final free.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/71b3391dc81655ff058492f8e9d013b2c6e5747b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/550fa4d071a8c8e53072900869d37ae6abf4999d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c5b9fdb1e8ddf50bc6272927edb118679f170350", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/085652fda7f38040d1a2c42d72614f418feb843f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/48f89ead20e48d447ad29fa937b43b9fa981cf28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e6f8be12f0307145b9a6010f044925952b37de8b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/db2b72e83a0208ae2b3b270bf91662b1c6849a9b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c8547c74988e0b5f4cbb1b895e2a57aae084f070", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 732, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64243", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.772Z", "date_published": "2026-07-24T15:27:45.311Z", "date_updated": "2026-07-27T04:59:06.667Z", "publisher": "Linux", "title": "ASoC: codecs: simple-mux: Fix enum control bounds check", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00117, "percentile": 0.01957 }, "nvd": { "published": "2026-07-24T16:16:53.680", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64243", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The mux bounds check accepts e->items as an index even though valid zero-based values end at e->items minus one.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6fb653b62f169f6050fac45b56bf21ad097e19f6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d8cc3e747b002a8b965c529de79c0654675b9a1a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5fe860af8630cf7c78523cbd68e5a234743585aa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2ff3ac6f7664fe5639cad01712ac5e021fa7939c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/164dcbec9632ca93ae313e6da6e4e05584fa0f02", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/05ef77f02607a3dc5d7f9762cb990f76843315d4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f63ad68e18d774a5d15cd7e405ead63f6b322679", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 575, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64244", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.772Z", "date_published": "2026-07-24T15:29:59.891Z", "date_updated": "2026-07-24T15:29:59.891Z", "publisher": "Linux", "title": "drivers/base/memory: set mem->altmap after successful device registration", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00161, "percentile": 0.05765 }, "nvd": { "published": "2026-07-24T16:16:53.803", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64244", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A failed memory-block registration publishes altmap state early enough that cleanup observes an invalid lifecycle state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/802e113cf120df7208e4c7e604950a85e87120a8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/22dc0d042f02ce82aa61422ea5f232628bfd9e9c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c25bf4e44a2b6a14332f952bba0974521f5b72d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bc3dd82a0ffd488bb902f4c69c3d28fd4088d973", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/059ac6252a63edf1cea79bf30bd860a8c264b62c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a2b8d7827f48ee54a686cb80e4a1d0ff954ec42a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 516, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64245", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.772Z", "date_published": "2026-07-24T15:31:14.142Z", "date_updated": "2026-07-27T04:37:28.079Z", "publisher": "Linux", "title": "fbdev: modedb: fix a possible UAF in fb_find_mode()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0016, "percentile": 0.05656 }, "nvd": { "published": "2026-07-24T16:16:53.917", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64245", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "fb_find_mode frees mode_option_buf while name still aliases that buffer and then continues to compare through name, producing a use-after-free.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c7dc382439f7b019e207055b52e9cec051d42fa9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f906347d75c7fc377041c6d3c535d0f08846aada", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4d418cf8daf57e454b4d855bf9b2419fd8e6a540", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/13b6f0cdd5cd5e60f682ec43134ab0e2024bd356", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/85b6256469cebdac395e7447147e06b2e151014f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 752, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64246", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.772Z", "date_published": "2026-07-24T15:31:14.709Z", "date_updated": "2026-07-24T15:31:14.709Z", "publisher": "Linux", "title": "power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00161, "percentile": 0.05765 }, "nvd": { "published": "2026-07-24T16:16:54.030", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64246", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "linkstation_poweroff_init releases the device-tree node reference before of_match_node finishes using the node pointer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/93c7ee139721936b6fa717572e74d3994603ae13", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cdda7d384c05485a232ae9a849f6445accb095bf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c04d606f8b35ee7d3ed243f63893a607e9d6c0bc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3928ae803dee044b01076c478c279c0bd54164cd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2205275be9be981e70ff29610b0117d8853fac70", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d109e72f3fbccb540473285d17d7519584f7f76e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8eec545cde69e46e9a1d2b7d915ce4f5df85b3bd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 300, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64247", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.772Z", "date_published": "2026-07-24T15:31:15.304Z", "date_updated": "2026-07-27T04:59:07.831Z", "publisher": "Linux", "title": "KVM: x86: hyper-v: Bound the bank index when querying sparse banks", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00114, "percentile": 0.01689 }, "nvd": { "published": "2026-07-24T16:16:54.147", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64247", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "KVM uses an unbounded virtual-processor ID to index a fixed sparse-bank set during a nested Hyper-V TLB flush.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d18756b12aab30d07794446445c93112e5c69a2e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/83c2f52c6a78b1590034e955cff3fe0b052fe4ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e36095d8d922bb26ce860231aacf0cd14edea07c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f636cf6a1e7b7f40d48d8d08bd5f152aa61dd130", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4721f8160f17554b003e8928bb61e6c9b2fe92a3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2753, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64248", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.772Z", "date_published": "2026-07-24T15:31:15.892Z", "date_updated": "2026-07-24T15:31:15.892Z", "publisher": "Linux", "title": "MIPS: smp: report dying CPU to RCU in stop_this_cpu()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00161, "percentile": 0.05765 }, "nvd": { "published": "2026-07-24T16:16:54.280", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64248", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "CPU teardown marks the processor offline for the scheduler without first making it offline to RCU, so a grace period can wait forever.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f8a1ef884013dc99f712d3eb75624c7cd3fd94f6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e1919d026706544cb6e7251ec06e908edd6f34ee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6eda71977ee11c222f8ad4cae4d18d50448e56f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f9b57a0015c241274651f4b36627f56b1b5a8651", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9fef09df42df55ab819b285ea892e0fc1b95a9c4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9f3f3bdc6d9dac1a5a8262ee7ad0f2ff1527a7e7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2064, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64249", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.772Z", "date_published": "2026-07-24T15:31:16.458Z", "date_updated": "2026-07-24T15:31:16.458Z", "publisher": "Linux", "title": "fpga: region: fix use-after-free in child_regions_with_firmware()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06118 }, "nvd": { "published": "2026-07-24T16:16:54.450", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64249", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "child_regions_with_firmware releases child_region before an error message reads from that object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e918942bcc5355ad5b44ba557935dffc0727b0eb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/866184fc7ae42a0070f1141ae8c5dca7c24a59e2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/070b0ce947b18fa3dec0729695147f7e19599649", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fbaf509ad7cb2f7dafe73ca20c956104cfcc9d68", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e79afcb0a66d2b3c33e510eade902537e656fc00", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/369496d885b4cf6e8647cf4dc5cf3ac68fdf37a1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5e098e40e8bac43ed58645c10d5fad781966efe4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/54f3c5643ec523a04b6ec0e7c19eb10f5ebebdd3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 289, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64250", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.773Z", "date_published": "2026-07-24T15:31:17.021Z", "date_updated": "2026-07-24T15:31:17.021Z", "publisher": "Linux", "title": "LoongArch: Report dying CPU to RCU in stop_this_cpu()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00161, "percentile": 0.05764 }, "nvd": { "published": "2026-07-24T16:16:54.577", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64250", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "LoongArch offlines a CPU without reporting the dying transition to RCU, leaving RCU with stale CPU-liveness state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/262dadc619e69ebeb97affd334cd1078a9704e98", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1fa22de588a65880d6fe54c38c87fffe7d519f60", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a0269e928728f970c782319fee53d92d4ea4e512", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/90e254f18b8c224460082329dd5c42fd30995c2f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0833b2b84c2fc1387f8165f0cbf6a02d67f647a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f2539c56c74691e7a88af6372ba2b48c06ed2fe4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1738, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64251", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.773Z", "date_published": "2026-07-24T15:31:17.601Z", "date_updated": "2026-07-27T04:59:08.978Z", "publisher": "Linux", "title": "pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00117, "percentile": 0.01924 }, "nvd": { "published": "2026-07-24T16:16:54.713", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64251", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "pwrseq_debugfs_seq_next drops the device reference when its scoped variable exits, then returns the now-unreferenced pointer to seq_file.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ba0b9f04c7a5f9887b8ce672eaf049502c0548ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e91df6d273445c03f5aa302bfe147eda33d45794", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/73569a44fca2992f0ca4a4c0104069741b9873a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/257595adf9dac15ae1edd9d07753fbc576a7583d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1214, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64252", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.773Z", "date_published": "2026-07-24T15:31:19.344Z", "date_updated": "2026-07-24T15:31:19.344Z", "publisher": "Linux", "title": "MIPS: DEC: Prevent initial console buffer from landing in XKPHYS", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06117 }, "nvd": { "published": "2026-07-24T16:16:54.833", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64252", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "In 64-bit configurations calling the initial console output handler from a kernel thread other than the initial one will result in a situation where the stack has been placed in the XKPHYS 64-bit memory segment and consequently so has been the buffer allocated there that is used as the argument corresponding to the `%s' output conversion specifier for the firmware's printf() entry point.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9e22b6fc6532cd566dad6d89d8fb3885248e364a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1c80327dedf05b8c8ca025b76c21235b19dd3a86", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8a15826e5d3bdcfbef2f8e9330c69ea9ee7282e7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ab465495b1ed5efb7d2f9b90d8b20b1e0473e26f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/35212f2adc2cf15122b96b987519de235b855e46", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6e61fc2e06e44b6d30248cc5bc47a58e75c2b43e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/07c245bc39f94481fd75ff1ed54f7ab97111f3dd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7fb13fd35110ebe95eb053faf79d018f51144d85", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3943, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64253", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.773Z", "date_published": "2026-07-24T15:31:21.378Z", "date_updated": "2026-07-24T15:31:21.378Z", "publisher": "Linux", "title": "kernel/fork: clear PF_BLOCK_TS in copy_process()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00157, "percentile": 0.05315 }, "nvd": { "published": "2026-07-24T16:16:55.017", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64253", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "copy_process() inherits PF_BLOCK_TS while clearing the child's plug pointer, violating the flag-to-object lifetime invariant.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ee0801aceabdf583392477baf69a290b09448b8f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/99e6c712cc300883b8cbf03347d5359ec1a4d6dd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/77bba61a20f1b3d206f4f90e10a7bb3cd90b9619", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fd38b75c4b43295b10d69772a46d1c74dbd6fc81", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 561, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64254", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.773Z", "date_published": "2026-07-24T15:31:22.293Z", "date_updated": "2026-07-24T15:31:22.293Z", "publisher": "Linux", "title": "NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00161, "percentile": 0.05695 }, "nvd": { "published": "2026-07-24T16:16:55.130", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64254", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Teardown unmaps an offset pointer when peer scratchpad and configuration share one BAR, violating the lifetime and base-address contract of pci_iounmap().", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/eb47b9bffd07a47b84910847cb5ea066ce184055", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/06f6dd2ff2bd07eaf7178a807407ff27e85122b4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a4be4a1308f02bff79a30eea2d04ead5b63685f2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/81371dbd23601f67f01372817fdbab42c5601e43", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9764a786ba98db58f0725913c369e721253aba33", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d876153680e3d721d385e554def919bce3d18c74", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 992, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64255", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.773Z", "date_published": "2026-07-24T15:31:22.870Z", "date_updated": "2026-07-27T04:59:10.160Z", "publisher": "Linux", "title": "wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00226, "percentile": 0.13415 }, "nvd": { "published": "2026-07-24T16:16:55.257", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64255", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The BA handlers subtract one from ffs(0), wrapping the station index and accessing fw_id_to_link_sta outside its bounds.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1de92789ce31e46fa7e7d8e89c90b19cdb1c103b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fe7f339f63c9dc4ca546ed7ac38ba4bb3a99dcfc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 536, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64256", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.773Z", "date_published": "2026-07-25T08:49:08.676Z", "date_updated": "2026-07-25T08:49:08.676Z", "publisher": "Linux", "title": "xfs: don't wrap around quota ids in dqiterate", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10055 }, "nvd": { "published": "2026-07-25T10:17:04.630", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64256", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Incrementing an unsigned 32-bit quota ID at its maximum wraps to zero and restarts iteration.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/249e311c2ba392ceaf9ebfc145a46922946f069a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d1c4c40599c376aeb0c93068a2ae344e79ee4b90", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2b14fe1e0924c6b901f4256456342569c5397abe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d766e4e5e85d829629c3ba503802fe1303d7b591", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 372, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64257", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.773Z", "date_published": "2026-07-25T08:49:09.345Z", "date_updated": "2026-07-27T04:59:11.315Z", "publisher": "Linux", "title": "smb: client: reject overlapping data areas in SMB2 responses", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 13, "versionRangeCount": 10, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00672, "percentile": 0.48525 }, "nvd": { "published": "2026-07-25T10:17:05.817", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64257", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SMB2 overlap handling clears data_length and lets an overlapping response masquerade as having no data area for a length exception.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/445ece263131780dee273d727a4d6f11934feec7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/36bfa52459e45c0d5b668de2f1c91f6dc5c67775", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4a9d2657d3e05f6ed09c148cb127b4e58702275f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fdafa1e68dc75045b7b617e6e7d2854950804d83", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57cba95f0e97c6f6e45e6731da30aff091bd7460", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8986c932905ea508d66da421eb2eb6e676ace1fe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 597, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 13 } }, { "cve_id": "CVE-2026-64258", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.773Z", "date_published": "2026-07-25T08:49:10.093Z", "date_updated": "2026-07-25T08:49:10.093Z", "publisher": "Linux", "title": "fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09799 }, "nvd": { "published": "2026-07-25T10:17:05.930", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64258", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A failed ring copy clears the request but leaves its queue entry active for later processing.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0b466cf1b96e191b06b496c4de79da15315c3a9a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0a7f33010c0e4cd92937e088a54350381fd0fbf2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1c57a69be962d459c5e705f5cb4355b841b3461c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 624, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64259", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.773Z", "date_published": "2026-07-25T08:49:10.756Z", "date_updated": "2026-07-27T04:59:12.431Z", "publisher": "Linux", "title": "fuse-uring: make a fuse_req on SQE commit only findable after memcpy", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00157, "percentile": 0.0535 }, "nvd": { "published": "2026-07-25T10:17:06.033", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64259", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A FUSE request becomes discoverable before its initialization copy finishes, allowing a concurrent commit to free it during memcpy.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e1711479e9068ea31b31353a702a51e639c3d059", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a635f427d57e2012102ae4886b48d8955c59fb86", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1efd3d474fc0ba74dfd984249bca78807d739812", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 940, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64260", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.774Z", "date_published": "2026-07-25T08:49:11.395Z", "date_updated": "2026-07-27T04:59:13.568Z", "publisher": "Linux", "title": "fuse-uring: Avoid queue->stopped races and set/read that value under lock", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00162, "percentile": 0.05816 }, "nvd": { "published": "2026-07-25T10:17:06.137", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64260", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "FUSE reads and writes queue->stopped outside the required lock, allowing teardown to free a request while another CPU still processes it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/39c8e925b207afceffaa5382416ed405e0223a03", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4021a3a79eee551d95fe1e1e7c1b195d34ba8c08", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b70a3aca16934c196f92abb17b01c1647b9bb63c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 560, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64261", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.774Z", "date_published": "2026-07-25T08:49:11.999Z", "date_updated": "2026-07-27T04:59:14.752Z", "publisher": "Linux", "title": "fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00157, "percentile": 0.0535 }, "nvd": { "published": "2026-07-25T10:17:06.243", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64261", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "fuse_uring_async_stop_queues can run after the final queue reference is dropped because it does not hold a connection lifetime reference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/23a356e0bd96c8d5fb3ddff069f692bf10cab5c1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/95d7f50aff2a5f71557263ff25b97b2951f32bf8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d351da75066955144515cb2f9aa959f24a04287a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 449, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64262", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.774Z", "date_published": "2026-07-25T08:49:12.599Z", "date_updated": "2026-07-25T08:49:12.599Z", "publisher": "Linux", "title": "fuse-uring: end fuse_req on io-uring cancel task work", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.098 }, "nvd": { "published": "2026-07-25T10:17:06.350", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64262", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The fuse-uring cancel path completes the command without ending the owning fuse_req or releasing its queue entry, allowing requests and background capacity to remain stuck.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/bb476ef8e1027a9d509fbaaf81f5061a07e9e5a7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4f45f276d5b4412eade6f74f2e37f3adba0473ed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bea4fe98204b6ce7eb8e29f7bf867dd7619b3ddd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2004, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64263", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.774Z", "date_published": "2026-07-25T08:49:13.217Z", "date_updated": "2026-07-25T08:49:13.217Z", "publisher": "Linux", "title": "fuse-uring: fix moving cancelled entry to ent_in_userspace list", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09804 }, "nvd": { "published": "2026-07-25T10:17:06.460", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64263", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "fuse-uring cancellation moves an entry with no attached request onto a list whose expiry path unconditionally dereferences that request.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/50f3e03db823cabc41fe35c27d77c2bdb112baad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e8afc85acdf329361b2d8df2ad9b52364686235f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/198f45eeb9f78b2a2d6d8be95e4e43468eb2c6bc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 999, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64264", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.774Z", "date_published": "2026-07-25T08:49:13.891Z", "date_updated": "2026-07-25T08:49:13.891Z", "publisher": "Linux", "title": "fuse-uring: fix EFAULT clobber in fuse_uring_commit", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09799 }, "nvd": { "published": "2026-07-25T10:17:06.563", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64264", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "fuse_uring_commit sets -EFAULT after a partial copy but later overwrites it with the positive residual, causing callers to treat uninitialized or partial output as success.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0483fffdeeb363f320e6bf5fc0f0306007507306", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fe604c08d874648a69187f6380e5c7858627dc04", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3a0a8bc51a13951c5141262bf770eeea3e0b6228", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1204, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64265", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.774Z", "date_published": "2026-07-25T08:49:14.548Z", "date_updated": "2026-07-27T04:59:15.923Z", "publisher": "Linux", "title": "fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00159, "percentile": 0.05512 }, "nvd": { "published": "2026-07-25T10:17:06.667", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64265", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "FUSE moves an interrupted request back to pending without unlinking intr_entry, then can free the request while the interrupt list still holds that entry.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7366e6f4d2b4c7002b13fb01219e83679dad4127", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/893479015cb6442fd389d3b553ab3036c9541715", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f8fce75fedf73ac72aa09163deb8f4291fdcaad2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1050, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64266", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.775Z", "date_published": "2026-07-25T08:49:15.142Z", "date_updated": "2026-07-27T04:59:17.096Z", "publisher": "Linux", "title": "fuse: re-lock request before returning from fuse_ref_folio()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0016, "percentile": 0.05596 }, "nvd": { "published": "2026-07-25T10:17:06.783", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64266", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An unlocked asynchronous request can be freed before a later copy accesses its arguments.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1f9156714592356b4fda57beac7eab9c2a462dd3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5630da218a45ba80f0aba0846cbe8aa655da122b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1ca605cfa59377f0143fb35b5b01360f37d1b7c4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0e4a5a000123d81234e27a2f8187688cf608f755", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e6aa539720c3d8def69683ed0c07cf9faea4e8be", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be353caffa8640f5e25fb3714ce8b0cef5e410e5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/65a1c2551f7e16085acbb54aedde1feaa559ba7a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b5befa80fdbe287a98480effed9564712924add5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 500, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64267", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.775Z", "date_published": "2026-07-25T08:49:15.720Z", "date_updated": "2026-07-25T08:49:15.720Z", "publisher": "Linux", "title": "fuse: avoid 32-bit prune notification count wrap", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09801 }, "nvd": { "published": "2026-07-25T10:17:06.910", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64267", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "FUSE_NOTIFY_PRUNE multiplies an attacker-controlled count in 32-bit size_t, allowing wraparound to validate a payload shorter than the ensuing copy loop expects.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6e2d84fdeac05bfd858e84a76353fdb84f23a43e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c78c4b242299bc581e4987e5c2786c6f4760c516", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/54243797cedf55447b4c5d560e8cd709900061ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 776, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64268", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.775Z", "date_published": "2026-07-25T08:49:16.336Z", "date_updated": "2026-07-27T04:59:18.262Z", "publisher": "Linux", "title": "RDMA/siw: bound Read Response placement to the RREAD length", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00695, "percentile": 0.4943 }, "nvd": { "published": "2026-07-25T10:17:07.013", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64268", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "siw_proc_rresp accumulates continuation-segment lengths without comparing the total to the RREAD sink buffer before placement.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915ba", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b2e26c955f8dd7e8d3f16c858db05245ea4fa817", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1667, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64269", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.775Z", "date_published": "2026-07-25T08:49:16.946Z", "date_updated": "2026-07-27T04:59:19.367Z", "publisher": "Linux", "title": "RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00679, "percentile": 0.48821 }, "nvd": { "published": "2026-07-25T10:17:07.160", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64269", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "RTRS uses a peer-controlled descriptor length for an RDMA write from a fixed chunk without bounding that length to max_chunk_size, permitting a read beyond the mapped chunk.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/68c09762172f6224e9ddf9b0a60bacbb36e443eb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6cada540150894e81042a0ae0c796a21a9a877da", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2912f3d40355dabc08fdbaaf2764d02445fe88dc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6f40246f4312fdbab5a13cc440adebf95eb2aa66", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5a45d0aa1fa50a333ce5763ade744e2d89838667", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/da3e44add94b05dfde56f898421922f5cf35705f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/963af8d97a8c6a117134a8d0db1415e0489200b1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1872, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64270", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.775Z", "date_published": "2026-07-25T08:49:17.541Z", "date_updated": "2026-07-25T08:49:17.541Z", "publisher": "Linux", "title": "Input: mms114 - reject an oversized device packet size", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10055 }, "nvd": { "published": "2026-07-25T10:17:07.293", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64270", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The touchscreen driver trusts a device-reported packet length up to 255 bytes when writing into an 80-byte stack array.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5d2ea15ba03bf17ed143ff1a0995a4206edc3fb6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b78150729762d47c14fe29a2582bdca5568e62b8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8301c335305344d4da4ab9442b6a399dacfe5b8d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f3d5e77b27fded71dcb97f409262bf0abba0410e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/66725039f7090afe14c31bd259e2059a68f04023", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1306, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64271", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.775Z", "date_published": "2026-07-25T08:49:18.160Z", "date_updated": "2026-07-25T08:49:18.160Z", "publisher": "Linux", "title": "Input: touchwin - reset the packet index on every complete packet", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11393 }, "nvd": { "published": "2026-07-25T10:17:07.410", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64271", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "touchwin resets its three-byte packet index only when two device-controlled bytes match, so mismatched packets make subsequent bytes overwrite the heap object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ed9b66905407eb3d02df1aaeed82eb7a7f0eb508", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/044167cba2384bcd783547ad5e30ecd292b30919", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c9f29f128dd4057404838259af4c645318487e1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/431ad239f2924dff337c3fccb9246597c1b63185", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/70e4248793762df9832fd4fc2fc6ac7924572c36", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3e6f007b43e2fc6546e21fa74ee62c38984a6672", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a8d87184576c889759e3aab899799a482f1e1a5b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/478cdd736f2ce3114f90e775d7358136d3977b94", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1089, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64272", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.775Z", "date_published": "2026-07-25T08:49:18.766Z", "date_updated": "2026-07-25T08:49:18.766Z", "publisher": "Linux", "title": "Input: mms114 - fix touch indexing for MMS134S and MMS136", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10056 }, "nvd": { "published": "2026-07-25T10:17:07.550", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64272", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A touch-input driver advances through records with a structure stride that does not match the actual record layout, causing out-of-bounds access.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/112666835071d935fef764aab590339e97216d4a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7c00a0787af7164438bdbc97fcae9733cfc58d21", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/75b12874b4172533b9efc349db328cb1a59c3981", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a747c4eb02656afdbd92eea83b88e92715a23977", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a6ac4e24c1a8a533bb61035184fdcc7eede4cc8d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 747, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64273", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.776Z", "date_published": "2026-07-25T08:49:19.416Z", "date_updated": "2026-07-25T08:49:19.416Z", "publisher": "Linux", "title": "Input: iforce - bound the device-reported force-feedback effect index", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11389 }, "nvd": { "published": "2026-07-25T10:17:07.660", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64273", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A device-supplied force-feedback effect index is used for a bit read-modify-write without checking it against the core_effects array dimension.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b1b79e89bc33e4c682d3df7ae2aadc62b5a0c310", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d10b0507fa0f5b46764b178e3271f9012f2df677", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c0f2901c9d325d4a0574c4237fd507810d225ff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c21295616a8a52b9a5f18cd4ca8c73030eda3d4f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e5fa31f0550b55d80045669ae9080dd5b88abffa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/70019779325f2bb5f5a4098e91e79c655f50fcef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a40250f97c312e000e3616c9074022311a0efbc3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0e9943d2e4c63496b6ca84bc66fd3c71d40558e2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1726, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64274", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.776Z", "date_published": "2026-07-25T08:49:20.040Z", "date_updated": "2026-07-25T08:49:20.040Z", "publisher": "Linux", "title": "Input: goodix - clamp the device-reported contact count", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.1139 }, "nvd": { "published": "2026-07-25T10:17:07.797", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64274", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Goodix driver accepts a device-advertised contact count up to 15 while its stack buffer is sized for only 10 contacts.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e825f352ef5271255cd08cc994b0dc25648a2f38", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4bfea9c3a0981c1c7fc5d1a1b27197b2de247902", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/98b2caef249183b572c04451365246f919707845", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/719d1a2c83a46be6bf81af905e4f6adb3d32dc28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/46addbd13dbf4aacb71cfbca964a5e552d0f45ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3b32303460155603d25444274856013d211d5e1f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2a67668690129953e898923260a2dd1c7c196495", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5ed62a96e06be4e94b8296b7932afee550a70e04", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1210, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64275", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.776Z", "date_published": "2026-07-25T08:49:20.669Z", "date_updated": "2026-07-25T08:49:20.669Z", "publisher": "Linux", "title": "Input: elan_i2c - prevent division by zero and arithmetic underflow", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.1139 }, "nvd": { "published": "2026-07-25T10:17:07.927", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64275", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Zero trace counts reach a resolution division and small widths reach unsigned subtraction without zero or lower-bound checks.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/59d4cc5e7a9785e4bdc9c55273274c6b49d4b58d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f6d10af2036d1d4a847a74fe47ebbf93bce3c84c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2f281ff0163a38fdc4cb4061f0c241e643283a5e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8c1db3418a419e788691746b9c47f863c2fd4890", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/feb4866a42ec94764c7eb58012256f6f37664727", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/01e0317c256c560d8dcce2e9825eb6142ee34611", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6bac57d8fe2a077b8a85b4140eeb7999078158eb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/df2b818fa009c10ff6ba875a1663ff001cda9558", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1186, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64276", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.776Z", "date_published": "2026-07-25T08:49:21.300Z", "date_updated": "2026-07-27T04:59:20.488Z", "publisher": "Linux", "title": "Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.06041 }, "nvd": { "published": "2026-07-25T10:17:08.060", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64276", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Synaptics driver allocates at most six keymap entries but indexes up to the device-reported count of thirty-one.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 964, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64277", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.776Z", "date_published": "2026-07-25T08:49:21.936Z", "date_updated": "2026-07-27T04:59:21.704Z", "publisher": "Linux", "title": "Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.06041 }, "nvd": { "published": "2026-07-25T10:17:08.197", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64277", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The F3A device-reported GPIO count can exceed the six-entry keymap allocation while interrupt and ioctl paths index the full reported count.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1311, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64278", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.776Z", "date_published": "2026-07-25T08:49:22.535Z", "date_updated": "2026-07-25T08:49:22.535Z", "publisher": "Linux", "title": "i2c: imx-lpi2c: mark I2C adapter when hardware is powered down", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09804 }, "nvd": { "published": "2026-07-25T10:17:08.330", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64278", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A periodic I2C worker can issue transfers after suspend has powered down controller resources and before resume restores them.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b2523f26979e0b5bd1422772176b2233fcd1f6d0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5800647d19d3f1f747fda4dc67e55d6afa6ee119", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/218cfe364b55b2768221629bd4a69ad190b7fbbc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 891, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64279", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.777Z", "date_published": "2026-07-25T08:49:23.145Z", "date_updated": "2026-07-27T04:59:23.086Z", "publisher": "Linux", "title": "i2c: core: fix adapter deregistration race", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.06038 }, "nvd": { "published": "2026-07-25T10:17:08.437", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64279", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Adapter deregistration leaves the object discoverable by ID while its resources are being freed.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d39282f552dd6c35b9b84b4af78f1198c24f3373", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/11dfa37bf544cc806f21742ca2fd2d841bd7032e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9882a9bd74db08e7bae5821a7050627ae92d3380", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bb234487a447a99315add1b46aa57b72e163e1eb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b6d2af6fe9c1f5ec0484536753c979cbd40a8ac3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/35dbd1f1f603401155cbd3a180bb18e3a3b675b8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b1a58ed9eab146b36f41a55db8f5d7ce9fdedf3f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 429, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64280", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.777Z", "date_published": "2026-07-25T08:49:23.753Z", "date_updated": "2026-08-03T09:32:40.118Z", "publisher": "Linux", "title": "fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00163, "percentile": 0.05978 }, "nvd": { "published": "2026-07-25T10:17:08.553", "lastModified": "2026-08-03T10:16:32.577", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64280", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A 64-bit user-supplied DMA length is converted to an int page count without rejecting values above INT_MAX.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/16381bda90b261a656ded0568630c1b857b2ebc8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b50e6cd2395cde615f59b624819998d28c0668d6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/59070040fd12e0b78d7b4d341d9f9a183237c5ff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 597, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64281", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.777Z", "date_published": "2026-07-25T08:49:24.399Z", "date_updated": "2026-07-27T04:59:25.308Z", "publisher": "Linux", "title": "svcrdma: wake sq waiters when the transport closes", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00468, "percentile": 0.38064 }, "nvd": { "published": "2026-07-25T10:17:08.667", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64281", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The svcrdma close path marks the transport closed without waking send-queue waiters, leaving threads blocked indefinitely and pinning transport references during teardown.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/40eedc4253dbda0b29b7961200534dfcecb48ace", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e5248a7426030db1e126363f72afdb3b71339a5c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2145, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64282", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.777Z", "date_published": "2026-07-25T08:49:25.011Z", "date_updated": "2026-07-25T08:49:25.011Z", "publisher": "Linux", "title": "KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09804 }, "nvd": { "published": "2026-07-25T10:17:08.787", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64282", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "kvm_translate_vncr returns after an MMU-notifier race without releasing its reference to the faulted-in page frame.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0c93681aea0a1b8be14730a88abe77c840272e41", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cd1067ccc0dbc18890a74db116d00a4bc3c7f2f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9f76b039a72d7e06374aa96862f0232ed53f7787", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 348, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64283", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.777Z", "date_published": "2026-07-25T08:49:25.642Z", "date_updated": "2026-07-25T08:49:25.642Z", "publisher": "Linux", "title": "KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0021, "percentile": 0.11358 }, "nvd": { "published": "2026-07-25T10:17:08.910", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64283", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "KVM adds guest_memfd offset and size as signed values, allowing a large positive sum to become negative and pass the file-size bound.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f3a98d5881b9bd4807f49156143565f6aabcef1e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eba85fee7fc6cf28fec38a5bf3c378bef9a79ca6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2381, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64284", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.777Z", "date_published": "2026-07-25T08:49:26.270Z", "date_updated": "2026-07-27T04:59:26.374Z", "publisher": "Linux", "title": "KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00159, "percentile": 0.05571 }, "nvd": { "published": "2026-07-25T10:17:09.033", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64284", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A virtualization fast path returns to user space before the vendor exit handler flushes dirty-state and page-modification-log updates.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b3436d9b9b1affe1c3191ac9831308923f5f03c3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4ad73ef0e7966ecfe67de0060537b4cb14d9acd4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f2ca2b5326211bd38490f0497eb583721ce0bbc0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0ffedf43910e44b76c2c1db4e9fbf12b268190c1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 699, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64285", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.777Z", "date_published": "2026-07-25T08:49:26.898Z", "date_updated": "2026-07-25T08:49:26.898Z", "publisher": "Linux", "title": "KVM: SEV: Pin source page for write when adding CPUID data for SNP guest", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00189, "percentile": 0.08822 }, "nvd": { "published": "2026-07-25T10:17:09.140", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64285", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "KVM pins a source page as read-only even though rejected SNP CPUID data can be written back through a kernel mapping.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/dcdb476f5fc5701ec06c23efe3e3529f07ca391e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f13e900599089b10113ceb36013423f0837c6792", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 784, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64286", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:27.542Z", "date_updated": "2026-07-27T04:59:27.373Z", "publisher": "Linux", "title": "KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.0017, "percentile": 0.06679 }, "nvd": { "published": "2026-07-25T10:17:09.243", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64286", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "KVM arm64 leaves __hyp_running_vcpu pointing at a stale private vCPU while flushing and copying host vCPU context.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/477145860dba4c30f0b4e36f02f4c5291c1c888b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dfaef40d8a1533940fc1af788d70fce07362b4ce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d4f4d61715d1061ba83b88196a3605662be30750", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e8042f6e1d7befb2fb6b10a75918642bcd0acf9a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 621, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64287", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:28.168Z", "date_updated": "2026-07-27T04:59:28.711Z", "publisher": "Linux", "title": "KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.0017, "percentile": 0.06679 }, "nvd": { "published": "2026-07-25T10:17:09.353", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64287", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The pKVM flush path copies host-controlled used_lrs without clamping it before indexing the EL2 list-register array.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9fa301d8298778dd799fa4dcf7a7f440715d146e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c646431865f4b1a5b14067233fa27b11e05e0d46", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7fca3fcef81c713bc82a37bf741e0f28e6d04a6f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8cc8bbbfab14c22c5551d0dd19b208a44b141c76", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 888, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64288", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:28.789Z", "date_updated": "2026-07-25T08:49:28.789Z", "publisher": "Linux", "title": "KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09803 }, "nvd": { "published": "2026-07-25T10:17:09.473", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64288", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet (no pseudo-TLB allocated).", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/7c73a269a880b1399baacfb9d521415e6ef7ecc2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5fd30133af864a1de0a0bd87d3fe3cf23205fbc7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4be6cbeb93d26994bd1827ddbce391e3c4395c8f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 733, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64289", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:29.434Z", "date_updated": "2026-07-25T08:49:29.434Z", "publisher": "Linux", "title": "iommufd: Set upper bounds on cache invalidation entry_num and entry_len", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10056 }, "nvd": { "published": "2026-07-25T10:17:09.603", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64289", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The cache-invalidation ioctl accepts multi-gigabyte entry lengths and huge entry counts that drive uninterruptible scans and non-preemptible loops.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d2bd041e0efaf7d81789779b135279d18b33d6d5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/32ca4aed2a66205b072fcfecabe220289a8149ff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2c6381d90898089287e0a358f06f89f6b4b389f2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4d70986002f2f3eaaed89124fb2522bded38b016", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 926, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64290", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:30.049Z", "date_updated": "2026-08-03T09:32:41.191Z", "publisher": "Linux", "title": "iommufd: Break the loop on failure in iommufd_fault_fops_read()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10056 }, "nvd": { "published": "2026-07-25T10:17:09.730", "lastModified": "2026-08-03T10:16:32.710", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64290", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "After copy_to_user() fails, only the inner fault-list loop exits and the outer loop retries the same restored fault forever while holding the mutex.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a38e0714affc5c0bbb40cba5a65d6d32a5e72a71", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f66c16b175509642ee7082df57c9bf3deaebae1a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/172fc8b19825a0f5884c38f2289188284e2d45ee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 454, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64291", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:30.686Z", "date_updated": "2026-07-25T08:49:30.686Z", "publisher": "Linux", "title": "iommufd: Set veventq_depth upper bound", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09802 }, "nvd": { "published": "2026-07-25T10:17:09.837", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64291", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "iommufd accepts an almost U32-sized userspace queue depth without a practical upper bound, allowing excessive kernel-memory allocation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f565297edf316016be4a1a9e2eb9f39359313f43", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e7b5e55652746b1221b9c10ff80eae8a154101ba", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6ebf2eb46fbd5b40393ff8fbb847ba96925beaff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 478, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64292", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:31.325Z", "date_updated": "2026-07-25T08:49:31.325Z", "publisher": "Linux", "title": "iommufd: Move vevent memory allocation outside spinlock", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09801 }, "nvd": { "published": "2026-07-25T10:17:09.937", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64292", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "iommufd allocates a user-sized event queue while holding a spinlock with atomic-reserve semantics, allowing large queues to exhaust atomic memory reserves.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/779480ea79551c31964e74b9aef0e730faa3aa11", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c5fc40200cd0a87d66a368eee00df4d1cca946e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/47443565d10c51366c9382dbc8597cd6c460b8a2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 968, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64293", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:31.945Z", "date_updated": "2026-07-27T04:59:30.042Z", "publisher": "Linux", "title": "iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00162, "percentile": 0.05816 }, "nvd": { "published": "2026-07-25T10:17:10.047", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64293", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A vEVENT read bound uses the pointer size instead of the header size and can copy beyond a 32-bit caller's supplied buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/04a177f91160ee18da98f5689482cf0f589ec869", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be93d186ae88a92e7aa77e122d4e661fa57b1e39", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1485, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64294", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:32.570Z", "date_updated": "2026-07-25T08:49:32.570Z", "publisher": "Linux", "title": "mm: do file ownership checks with the proper mount idmap", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10056 }, "nvd": { "published": "2026-07-25T10:17:10.160", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64294", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An ownership check uses the nop idmap instead of the mount idmap and therefore evaluates the wrong identity mapping.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/744b23aa430d52f5c8e4dbff7d71496d6643bed2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8344bdf0629457e532797b42d9d2bbf2a2900bbf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5c942ad7df75925ee166e7f0fb36892d8dde376b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/04ba248d02d9eaa3d9077b00a6134caa75fa3e90", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e187bc02f8fa4226d62814592cf064ee4557c470", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1199, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64295", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:33.194Z", "date_updated": "2026-07-25T08:49:33.194Z", "publisher": "Linux", "title": "mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00203, "percentile": 0.10472 }, "nvd": { "published": "2026-07-25T10:17:10.277", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64295", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "page_ext iteration advances one PFN past its requested count and dereferences an uninitialized memory section.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8dcaa0f87a88d720d13106f3a306c6b61d189d86", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/377b1cd6bbcf327338cd951cc2fd74bc75540235", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ffd017237cfe99e6e5602ab14179b0e6878a0840", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1860, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64296", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:33.847Z", "date_updated": "2026-07-27T04:59:31.233Z", "publisher": "Linux", "title": "exfat: bound uniname advance in exfat_find_dir_entry()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.0604 }, "nvd": { "published": "2026-07-25T10:17:10.390", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64296", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "exfat_find_dir_entry advances its output pointer by fixed filename slots while its guard counts shorter extracted fragments, allowing the pointer to pass the output buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/72a2589d82eb001c94b74bcfe6f9a599bd9bef60", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fae76a94b35ee8c0e2eb6f64caca01d75c6d34e4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cf85180b8a015029ee147694eaf4e0b3537e9432", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ce4736c1e6c4cfbf1ac409a8c328a0b69546c9a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/727bf7783a2936ffd55c628dddfd69343e511dcf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/33c0b96d7e1672be1de0053786637ea46fb81507", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c8e041c68c0bbb73aa62371ee63947bb6949d8b2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3a1230e7b043c62737b05a3e9275ca83a43ad20a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1418, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64297", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:34.486Z", "date_updated": "2026-07-25T08:49:34.486Z", "publisher": "Linux", "title": "module: decompress: check return value of module_extend_max_pages()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00206, "percentile": 0.10771 }, "nvd": { "published": "2026-07-25T10:17:10.530", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64297", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Module decompression ignores a failed page-array expansion and later dereferences ZERO_SIZE_PTR as though allocation succeeded.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e7f174715f9f0cbcb9e87b52e4fc4ef149baac98", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/afcc0515bbdd28d509a2b5870faaa89b137f5d53", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/168072baf9ad516d5a06046514c7fea4c0671990", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a82e170637e050a803b4f37542371ef216bf66d2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e7da02659c229f73492fb1ed87ceda4090153aaa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/786d2d84416a9a1c1a47b71a68d679d886284be2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 919, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64298", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:35.101Z", "date_updated": "2026-07-27T04:59:32.362Z", "publisher": "Linux", "title": "NFSv4: include MAY_WRITE in open permission mask for O_TRUNC", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0016, "percentile": 0.05657 }, "nvd": { "published": "2026-07-25T10:17:10.657", "lastModified": "2026-07-30T15:00:27.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64298", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The NFS delegated-open permission mask derives access only from O_ACCMODE and omits MAY_WRITE for O_TRUNC, allowing read-only open to truncate a non-writable file.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/4817c8974315b666e895b7d1bb83cd3664c323b1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cb148a2762d644bff1894728e8835a9a4b84f9ea", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/30fdf4df6c3c00efec947e4ddf97f0fdd4473628", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/22c1fd1355ad4ca27aa7f0fa02719122dd92d9de", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6bd7d0a06b53c4e797e1a9cea0d2d41aa1b26230", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a937e92c1d00534b5c2e3e9f4381b7e988180797", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e36501b7d4abdcd6d69a7cb901b2f286b7a3d041", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5140f099ecd8a2f2808b7f7b720ee1bad8468974", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1071, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64299", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:35.742Z", "date_updated": "2026-07-27T04:59:33.536Z", "publisher": "Linux", "title": "tracing: Prevent out-of-bounds read in glob matching", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0016, "percentile": 0.05612 }, "nvd": { "published": "2026-07-25T10:17:10.793", "lastModified": "2026-07-27T05:16:40.550", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64299", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The tracing glob matcher ignores the supplied field length and scans a non-null-terminated event string past its boundary.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/265f3a690f6c7d69ef7d2ca50b04b4853a211df3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ee5b8888d3248618251fb69a2fad92afcb81557e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/56d4c9ab84714eebb285a2fee68aaedf81e3ef15", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/35ae19764eabfe9c29029d3b5713c86e6855acdf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ebb55902856973906c8bb339a3a34824ed4a5086", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2dad64a97e1df47f5d9ccb17fa319aa348617226", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e5d5f3bd053a5f14787526c9f0f55ef900d43ac6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0a6070839b1ef276d5b05bedfb787743e140fb17", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1101, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64300", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:36.372Z", "date_updated": "2026-07-27T04:59:34.711Z", "publisher": "Linux", "title": "perf/aux: Fix page UAF in map_range()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00162, "percentile": 0.05815 }, "nvd": { "published": "2026-07-25T10:17:10.930", "lastModified": "2026-07-27T05:16:40.693", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64300", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "map_range walks shared AUX pages without rb->aux_mutex while another event reallocates and frees them, leaving a mapping to a freed physical page.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c8b7e113f7b61eef2f017e6329c27c2331058c5a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0cff05bd2186020f8706233e261016d149cc24db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5948aaf64f81f217a25dcc2bf6c0779bca19566c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1084, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64301", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.778Z", "date_published": "2026-07-25T08:49:36.999Z", "date_updated": "2026-07-25T08:49:36.999Z", "publisher": "Linux", "title": "regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00206, "percentile": 0.10772 }, "nvd": { "published": "2026-07-25T10:17:11.043", "lastModified": "2026-07-25T10:17:11.043", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64301", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "scmi_regulator_probe returns from a child-node processing failure without dropping the device-tree node reference acquired by of_find_node_by_name.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1e446e8f8c763be3de7d0362e024cdf46194ffef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/637c11e3d8d43a7ee654591cda8d17c55a9234fa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e2baf8ea13fb4b10bec2c4751aea05c00dabcd0f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3e1441a4d06d35a314961e40057bd1f0106bbc14", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/22cb337370e6539b0418832c6040e9b00c1b74ca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a935b64548fcfe1d5b4dbdd31dddfb0d7019367f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fa11039d6cdff84584a3ef8cc1f5e1b56e045da2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 474, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64302", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:37.621Z", "date_updated": "2026-07-25T08:49:37.621Z", "publisher": "Linux", "title": "x86/mm: Fix freeing of PMD-sized vmemmap pages", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 9, "versionRangeCount": 8, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09801 }, "nvd": { "published": "2026-07-25T10:17:11.170", "lastModified": "2026-07-25T10:17:11.170", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64302", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Only the first page in a PMD vmemmap allocation is freed, leaking the remaining pages on each affected teardown.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/add1e4112e00b619614784bf630aeebfdefa23e1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/03f6ecbc446c33b38fd452cd3c494092a8116967", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/39406c05f8f150f1685839acd38ffdd69ff92031", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1131, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 9 } }, { "cve_id": "CVE-2026-64303", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:38.223Z", "date_updated": "2026-07-27T04:59:35.874Z", "publisher": "Linux", "title": "spi: fsl-lpspi: terminate the RX channel on TX prepare failure path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00675, "percentile": 0.48684 }, "nvd": { "published": "2026-07-25T10:17:11.277", "lastModified": "2026-07-27T05:16:40.813", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64303", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "A transmit-DMA preparation failure leaves the issued receive-DMA channel running while the SPI core unmaps its buffers.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ad370d1c7a9a832f77b2341513cd31188c9443af", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cce2063404b2341e7b2bbf85eddfcd70a31a0033", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/af39a2698f69b584d14a00cffe0f51a2caa15337", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e65505d91fa036a238968e4c10744244d1b968c4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d5c1060218a3749c8a18b36f8169d910fce20639", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/808033d80d5c9f8adf7e8de9317389270ce13430", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9d000bdd250d649a11cd7f733175686877344582", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/01980b5da56e573d62798d0ff6c86bcaa2b22cbe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 613, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64304", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:38.873Z", "date_updated": "2026-07-27T04:59:37.100Z", "publisher": "Linux", "title": "crypto: qat - validate RSA CRT component lengths", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.0604 }, "nvd": { "published": "2026-07-25T10:17:11.403", "lastModified": "2026-07-27T05:16:40.950", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64304", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The QAT RSA CRT path copies key components into hardware buffers without first bounding each component length.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6d99c5fadd2df488103f64d6475b63ba6852202b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c34369473bfe92a0b46ec78d6358e30341c7f481", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1002719d13072a5e4be1e993aa61dffb4a604e82", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/500319830d76911c120dc0b9605f8c16d7702844", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3d61a214fdcda41f1ebfabbb483404032a7b4d91", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6fb62b767f3e27661e8f8d2f7b85f4e098fcdb1a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ce42224487c504aee4b7ff3a7342e7b4d7e28cc9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b3ac78756588059729b9195fcc9f4b37d54057a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 708, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64305", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:39.536Z", "date_updated": "2026-07-25T08:49:39.536Z", "publisher": "Linux", "title": "crypto: qat - protect service table iterations with service_lock", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06421 }, "nvd": { "published": "2026-07-25T10:17:11.530", "lastModified": "2026-07-25T10:17:11.530", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64305", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "QAT service-table traversal runs without service_lock while concurrent registration or removal can mutate and free entries in the same list.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/222fa7b453b612f4407f260146d89a2ce2bc831d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c3c5925791cff3b84d313293fd60f384d877d793", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0dbcecea740d943002c1cbdafa39bdfc108e32a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 976, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64306", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:40.153Z", "date_updated": "2026-07-25T08:49:40.153Z", "publisher": "Linux", "title": "crypto: drbg - Fix returning success on failure in CTR_DRBG", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11388 }, "nvd": { "published": "2026-07-25T10:17:11.653", "lastModified": "2026-07-25T10:17:11.653", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64306", "family": "CRYPTO_SECRET", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "CTR_DRBG reports success after generation fails, leaving callers to consume an uninitialized output buffer as random bytes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/074db6db03a0aaa78f05ca9d4838053713796665", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7b03312491f9fe6ba4d60c4023e7e61d2d1fed96", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/75597e8774f319152744d24e0683d9393540a951", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cc42fb40171c249bb859071d81b4eb007398a0bc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bbbac12083eff489b35d848332f0dff311131344", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/23b8b188cb32e5531d0f8d3af9506f8959cb369e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a9e886f73dd717027028bb7e3bbca93601ecdfc7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 240, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64307", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:40.782Z", "date_updated": "2026-07-25T08:49:40.782Z", "publisher": "Linux", "title": "crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 11, "versionRangeCount": 10, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00215, "percentile": 0.12026 }, "nvd": { "published": "2026-07-25T10:17:11.800", "lastModified": "2026-07-25T10:17:11.800", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64307", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SNP_CONFIG can retry failed SNP initialization while normal VMs are active and clear global HSAVE state needed by their next VMRUN.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/345a6e869b33687e9268044bcaeeefd7c61da675", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/441ea32cf2755a0dc593557056b00b7caa0651f5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/20f548cdac94860a164e5ebba4f7e4a01051cb06", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/08f0e65e784c4b20e6e620dd4f68d8636073a3d2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1078, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 11 } }, { "cve_id": "CVE-2026-64308", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:41.411Z", "date_updated": "2026-07-25T08:49:41.411Z", "publisher": "Linux", "title": "crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 11, "versionRangeCount": 10, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00215, "percentile": 0.12027 }, "nvd": { "published": "2026-07-25T10:17:11.917", "lastModified": "2026-07-25T10:17:11.917", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64308", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SEV-SNP initialization and shutdown paths permit lifecycle operations in an invalid order, leaving resources reachable after teardown.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/61cf5eef20657bff9ca235fe938a99ce5ff65c06", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/92567ed9306d5a3d1b007eb4faeff30cc3ffc3e4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8836801847b9479ac046cb18a24981e1b0b05e9d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f91e9dbb5845d1e5abf1028e6df57dcf61583e1b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 952, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 11 } }, { "cve_id": "CVE-2026-64309", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:42.035Z", "date_updated": "2026-07-25T08:49:42.035Z", "publisher": "Linux", "title": "crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 11, "versionRangeCount": 10, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00215, "percentile": 0.12026 }, "nvd": { "published": "2026-07-25T10:17:12.030", "lastModified": "2026-07-25T10:17:12.030", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64309", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SNP_COMMIT ioctl unnecessarily initializes SEV-SNP, so an initialization failure can zero global MSR_VM_HSAVE_PA while ordinary VMs are still active.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/74768f73854d647a6462f252dc8782ab8a835211", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7a361c74bb12f3398c388905f1d325be642cd36e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/67ed191b4c8bdf432a3f32d1eb302880b4795cd1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5a1364da2f04217a36e2fdfa2db4ee025b383a20", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 808, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 11 } }, { "cve_id": "CVE-2026-64310", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:42.683Z", "date_updated": "2026-07-25T08:49:42.683Z", "publisher": "Linux", "title": "crypto: ccp - Do not initialize SNP for SEV ioctls", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 11, "versionRangeCount": 10, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00215, "percentile": 0.12027 }, "nvd": { "published": "2026-07-25T10:17:12.147", "lastModified": "2026-07-25T10:17:12.147", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64310", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SEV-only ioctls unnecessarily initialize and shut down SNP, allowing a failed transition to clear host-save state used by running virtual machines.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5181e88da99c3d1d41e25db3472a62b8d4b42cdd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9e983d0a74a6a2348e4ce61647ec8a4dfbe198ac", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d51207735e7c224cf591fa260c557a451a69a5cf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fb1758e74b8061aacfbce7bbb7a7cc650537e167", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1380, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 11 } }, { "cve_id": "CVE-2026-64311", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:43.318Z", "date_updated": "2026-07-27T04:59:38.278Z", "publisher": "Linux", "title": "crypto: loongson - Remove broken and unused loongson-rng", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00157, "percentile": 0.05351 }, "nvd": { "published": "2026-07-25T10:17:12.263", "lastModified": "2026-07-27T05:16:41.087", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64311", "family": "CRYPTO_SECRET", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The Loongson RNG driver lacks forward security and also contains a completion-related lifetime error, with the random-generation design as the primary reported failure.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/037ec8353711c79353b12d5634e0c9ff363a9efa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/43de8b9f01b7dd2f6ca5360c6bf2f203c02288dc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/af3d1bb9a09daf928fc3f173689fb7904d6a6d4f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1192, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64312", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:43.940Z", "date_updated": "2026-07-27T04:59:39.447Z", "publisher": "Linux", "title": "crypto: pcrypt - restore callback for non-parallel fallback", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 29, "versionRangeCount": 25, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00501, "percentile": 0.40145 }, "nvd": { "published": "2026-07-25T10:17:12.373", "lastModified": "2026-07-27T05:16:41.210", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64312", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The nonparallel fallback retains the padata completion callback even though the request was never enrolled in padata.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ae93c5b3e2a2968b56d772ca1d06615927b7cc36", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ed459fe319376e876de433d12b6c6772e612ca36", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 710, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 29 } }, { "cve_id": "CVE-2026-64313", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:44.546Z", "date_updated": "2026-07-27T04:59:40.630Z", "publisher": "Linux", "title": "crypto: ecc - Fix carry overflow in vli multiplication", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00345, "percentile": 0.27118 }, "nvd": { "published": "2026-07-25T10:17:12.517", "lastModified": "2026-07-27T05:16:41.360", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64313", "family": "CRYPTO_SECRET", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ECC multi-precision multiplication drops a carry when the high word is saturated and the low-word addition also overflows, producing an incorrect cryptographic result.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d11b2bb99bec1f5557c01cac42231e23745f49b8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b709e0e768766abe29a49e1c1922a1604be602f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/24a54dfa06d09813b4802a374fad3d2c0e16a884", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/677450e5ef850c4d28b7956aa01104548c2a894e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5275e0fca256d081e2e7d4ba3dd8216c6e50d44e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/774ddddf5eb26eeca177350413e3e2bc50930ee9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ebaae7c4251cc0cdb2602f334d4f08a3e82d271e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/27b536a2ec8e2f85a0380c2d13c9ecbc7aaab406", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 746, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64314", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:45.170Z", "date_updated": "2026-07-25T08:49:45.170Z", "publisher": "Linux", "title": "crypto: chacha20poly1305 - validate poly1305 template argument", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.098 }, "nvd": { "published": "2026-07-25T10:17:12.647", "lastModified": "2026-07-25T10:17:12.647", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64314", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A missing crypto-template argument is returned as an error pointer and passed directly to strcmp.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0016d3c21c6ab60a20be7f565cefb5999f3adeb6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e74df53b36cdc6b6b9e5488ec883d1d55624737f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/265b861bece38318b8e0fc8fac0643d4ef906d31", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 696, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64315", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:45.787Z", "date_updated": "2026-07-27T04:59:41.861Z", "publisher": "Linux", "title": "crypto: caam - use print_hex_dump_devel to guard key hex dumps", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7, "cvss_source_score_spread": 0, "epss": { "score": 0.00145, "percentile": 0.04267 }, "nvd": { "published": "2026-07-25T10:17:12.750", "lastModified": "2026-07-27T05:16:41.510", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64315", "family": "EXPOSURE_OUTPUT", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "CAAM setkey paths print cryptographic key bytes when dynamic debug is enabled.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1ec775f6a124cce6278ae58b7d1c78a3bc6eef23", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bcf3cf74dfb6981e18b22cbf561f859a0f7faa26", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6407dc85d0a4306681cf6c9be7f05e05dcb67a37", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c8cfe11e48b2a4646fa662fcaa92e14810a28d46", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8904b425cfcafe6a820c94b9bdf4b10f7d70f9d7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d0b8cafd529b4ec759190c6081f7a76efb563a8f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/59057f5d4e9a195c6dd61695ad3bc4481ddf4f14", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8005dc808bcce7d6cc2ae015a3cde1683bee602d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 282, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64316", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:46.415Z", "date_updated": "2026-07-25T08:49:46.415Z", "publisher": "Linux", "title": "crypto: caam - use print_hex_dump_devel to guard key hex dumps", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07402 }, "nvd": { "published": "2026-07-25T10:17:12.877", "lastModified": "2026-07-25T10:17:12.877", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64316", "family": "EXPOSURE_OUTPUT", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Runtime debug logging can print cryptographic key bytes from setkey and split-key generation paths.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/45c0e3615e5bca5f1fc93357af8d19975c092d4f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8b56ba10105ca34a4b75f7e33d41d96a63815591", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9a53dc0a0ae0486e164e5af3de5f99ab42c5a23e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ebd37eef6e4f435e18829c0c0c9ba3a6618cb2dd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cea7302d5d05df74cfb4107897b1ca34163c06b9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6f7b8e0321f3a8fbbd267d2ac15c671ab59e919e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8cf5fb0503129e53052fe29302379cf83891d0fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3f57657b6ea23f933371f2c2846322f441773cee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 302, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64317", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:47.067Z", "date_updated": "2026-07-27T04:59:43.002Z", "publisher": "Linux", "title": "isofs: bound Rock Ridge symlink components to the SL record", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0016, "percentile": 0.05613 }, "nvd": { "published": "2026-07-25T10:17:13.010", "lastModified": "2026-07-27T05:16:41.640", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64317", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ISOFS Rock Ridge symlink parser reads each component length and copies its text without first proving the component fits inside the SL record, allowing an out-of-bounds read.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1015e1c4b2fadd9c09704e24738e46598778c869", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/36fe7d25dbc40da0c6b1dd4513a4f69ac6164eee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a22cb6bb54dc167047ea9e70d97dfbc2c15649e3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b736b12108fd116c41777628f5a333791604df26", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6bf41db09ef935d76fcc84ccf213b42c18de95ee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b5699642640d6cff357638738c5293985cd5a53d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9830725078c8483c6831ec10222ae724806ea36b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5fa1d6a5ec2356d2107dead614437c66fa7138b1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1643, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64318", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.779Z", "date_published": "2026-07-25T08:49:47.690Z", "date_updated": "2026-07-27T04:59:44.420Z", "publisher": "Linux", "title": "partitions: aix: bound the pp_count scan to the ppe array", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0016, "percentile": 0.05613 }, "nvd": { "published": "2026-07-25T10:17:13.147", "lastModified": "2026-07-27T05:16:41.787", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64318", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The AIX partition scanner trusts an on-disk pp_count up to 65535 while the allocated ppe array contains only 1016 entries.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/09861651617ba0fec089e8b9477439e68398c110", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5eacdb1967378f5e5591cd27a2d8cdee2df1a599", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b5e9c09309e18fd9839ad007c238120353ca0cc4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fd94a779020f2ecc8b2607f4c20b34acb1763b9a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4671bb74bba05fdd4acf670a35758c29e8c97b83", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ce93228e2193a17d2c58b656e439bb39fe5c3af8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2dc0bfd2fe355fb930de63c2f2eb8ced8570c579", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1130, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64319", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.780Z", "date_published": "2026-07-25T08:49:48.291Z", "date_updated": "2026-07-27T04:59:45.613Z", "publisher": "Linux", "title": "nvmet-auth: validate reply message payload bounds against transfer length", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00524, "percentile": 0.41525 }, "nvd": { "published": "2026-07-25T10:17:13.290", "lastModified": "2026-07-27T05:16:41.930", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64319", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "nvmet-auth uses attacker-controlled hash and DH lengths to address a variable reply payload before checking that those fields fit the transfer buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/80cd28b56ab62d3e7ed0a7bf05282e6d3ee5b2a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/999f6205ede984a786f35f727b01f971b98e215d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6d7649c1231dac14d906985d2936967e23041c26", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/caa71b3a43ea5c13fe7141cb019ebcb03b8ac857", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3a413ece2504c70aa34a20be4dafec04e8c741f9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1001, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64320", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.780Z", "date_published": "2026-07-25T08:49:48.908Z", "date_updated": "2026-07-27T04:59:46.816Z", "publisher": "Linux", "title": "nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00728, "percentile": 0.5064 }, "nvd": { "published": "2026-07-25T10:17:13.407", "lastModified": "2026-07-27T05:16:42.073", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64320", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The copy path checks only offset alignment and then reads buffer plus offset for data_len bytes without validating the source bound.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/33b974eb626154ae9348f2bac7de84cb2a3d9dd4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/56c021a0869260d04c4b65d1471936aaf9177114", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a29b316b9bbfd269f323ab4ba9906a894025680f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/53cd102a7a56079b11b897835bd9b94c14e6322c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2360, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64321", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.780Z", "date_published": "2026-07-25T08:49:49.541Z", "date_updated": "2026-07-25T08:49:49.541Z", "publisher": "Linux", "title": "nvme: target: rdma: fix ndev refcount leak on queue connect", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06422 }, "nvd": { "published": "2026-07-25T10:17:13.530", "lastModified": "2026-07-25T10:17:13.530", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64321", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The NVMe RDMA busy return path omits the kref release acquired for ndev during queue connection.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d65fe42820b890a6a4644de0a95a812471f79ad3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a8803c4f0ac3fa7df5551bbb5a8800c434a94357", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5828517d17eda27f21d29ea14800c9e0a57bad11", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/badc53620fe813b3a9f727ef9526f98567c2c898", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 498, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64322", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.780Z", "date_published": "2026-07-25T08:49:50.180Z", "date_updated": "2026-07-27T04:59:48.014Z", "publisher": "Linux", "title": "udf: validate sparing table length as an entry count, not a byte count", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 28, "versionRangeCount": 22, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.0604 }, "nvd": { "published": "2026-07-25T10:17:13.640", "lastModified": "2026-07-27T05:16:42.210", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64322", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "UDF validates a sparing-table entry count as though it were a byte length and then accesses entries beyond the supplied table.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2d726135099313958f8975532a2e15322ff150ce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7285276aa50d2839afb5957ffd491ad282dc8f72", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2a219acb2ce674d99bbd1b7b35ed8c384dac7200", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/04f4599a9efb90992d072a814960edf0cd62805d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7f7774b9da0ef17b87bfa238cf966ad0b3376150", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3ec997bd5508e9b25210b5bbec89031629cdb093", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1176, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 28 } }, { "cve_id": "CVE-2026-64323", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.780Z", "date_published": "2026-07-25T08:49:51.097Z", "date_updated": "2026-07-27T04:59:49.230Z", "publisher": "Linux", "title": "udf: validate VAT header length against the VAT inode size", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0016, "percentile": 0.05613 }, "nvd": { "published": "2026-07-25T10:17:13.790", "lastModified": "2026-07-27T05:16:42.370", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64323", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "A crafted UDF VAT header length can exceed the inode size, underflow the entry count, and drive an out-of-bounds read of inline inode data.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/883962731420ec271ed8c1cd76524f4b17faa982", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/55287a3555ff0515b3aff181d2c08c0462a41709", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/74580fdf022909e184223cacc364feb826982d96", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d8202786b3d75125c84ebc4de6d946f92fde0ee8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1086, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64324", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.780Z", "date_published": "2026-07-25T08:49:52.063Z", "date_updated": "2026-07-27T04:59:50.432Z", "publisher": "Linux", "title": "udf: validate free block extents against the partition length", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 28, "versionRangeCount": 24, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00156, "percentile": 0.05237 }, "nvd": { "published": "2026-07-25T10:17:13.923", "lastModified": "2026-07-27T05:16:42.513", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64324", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "udf_free_blocks omits the extent offset from its partition-length bound, allowing a crafted extent to index past the space-bitmap array.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/fdd6229d2ae9914c1f25d1041db0f4f312a4fa76", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b54aee5652fcd7c23a0904a4623ec462c3edc70c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/12af328d2ee8d68e81ba612246d0b54b22d23e1f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fb49099206c5c57af28a157249fa7bcb5518f99e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9442d75429b0c556292a7454fe888d54259f5240", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/335202ab25b01fdd45889ff25eab70864686dea3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be87de7789a82a030a4896bc7683415ec9fa6f2b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5f0419457f89dce1a3f1c8e62a3adf2f39ab8168", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1283, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 28 } }, { "cve_id": "CVE-2026-64325", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.780Z", "date_published": "2026-07-25T08:49:53.238Z", "date_updated": "2026-07-25T08:49:53.238Z", "publisher": "Linux", "title": "wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00189, "percentile": 0.08822 }, "nvd": { "published": "2026-07-25T10:17:14.097", "lastModified": "2026-07-25T10:17:14.097", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64325", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A queued channel-switch callback can run after disconnect clears dev->new_ctx and dereference the stale NULL state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/77e7b127472a191e086e1e0b1b051703f33b1801", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/351dd7d2c80d23e56dcce6faa4e62bea5b0877c7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1401, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64326", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.780Z", "date_published": "2026-07-25T08:49:54.327Z", "date_updated": "2026-07-25T08:49:54.327Z", "publisher": "Linux", "title": "block: skip sync_blockdev() on surprise removal in bdev_mark_dead()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10053 }, "nvd": { "published": "2026-07-25T10:17:14.207", "lastModified": "2026-07-25T10:17:14.207", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64326", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Surprise removal still calls sync_blockdev() even though the device is gone, leaving writeback waits with no completion path.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d6998ddd507c81e3829489a6ead23f17f5acb7fe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f41cf35ee2a1e31374b3f54e7579c55153506e70", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9818bcae3c0ca1dde4b9a334125c46676e0a9b29", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aa4c4a9315764b2b7a7182e72cc5ea87520436b4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/49f06cff50a4ccf3b7a1a662ceb892b3b21a527a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1016, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64327", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.780Z", "date_published": "2026-07-25T08:49:55.426Z", "date_updated": "2026-07-25T08:49:55.426Z", "publisher": "Linux", "title": "usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10054 }, "nvd": { "published": "2026-07-25T10:17:14.327", "lastModified": "2026-07-25T10:17:14.327", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64327", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "FunctionFS initializes endpoint direction only after host connection, so earlier userspace DMA ioctls operate with the wrong direction state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/82cf1142e5ccf2b6d6d22ef713aaf3e5f2b5716b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9e04055ab5fc0470a0031ee6934739f9aa8f34a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f99f32ea9aa976afcbec20647ed33b50a52002c1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/82cfd4739011bdc7e87b5d585703427e89ddfaa5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 671, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64328", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.780Z", "date_published": "2026-07-25T08:49:56.340Z", "date_updated": "2026-07-25T08:49:56.340Z", "publisher": "Linux", "title": "usb: gadget: f_fs: Fix DMA fence leak", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.002, "percentile": 0.10054 }, "nvd": { "published": "2026-07-25T10:17:14.430", "lastModified": "2026-07-25T10:17:14.430", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64328", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ffs_dmabuf_transfer retains the initial DMA-fence reference after adding a second reservation reference, leaking each completed fence.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b7475b2dce5e121e687280ba5732ccefe77ffd2f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e086c16962a1b0142e2675610e9c06fcfcd4c3a8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0cae3d6109427c455bad0a18dfb3e2a91657e38a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/baa6b6068a3f2bf2ed525a1cb37975905dadc658", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 984, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64329", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.780Z", "date_published": "2026-07-25T08:49:57.098Z", "date_updated": "2026-07-25T08:49:57.098Z", "publisher": "Linux", "title": "usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07406 }, "nvd": { "published": "2026-07-25T10:17:14.540", "lastModified": "2026-07-25T10:17:14.540", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64329", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Device removal frees the UCSI object before disabling an in-flight IRQ handler that can still dereference it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f1adeb1ff8bef1467d6961059810795d02bbad5d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/99381e762273a2410a3f0216000be32b013c0ea9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1a160076d3d0dcd4a98a4599ad96eec0790b099b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c32df11147822d22facee8fa30c2e8971d12f426", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/86c9ee928c4a370e323e432aaf8dca79c4ba7c85", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f5c772b76bbd95de8be51cf849c6098f6af6fcf9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dbb500bad02146b388041877574829016591ddc8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1f0bdc2884b67de337215079bba166df0cdf4ac5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1107, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64330", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:49:57.734Z", "date_updated": "2026-07-25T08:49:57.734Z", "publisher": "Linux", "title": "usb: typec: tcpm: Validate SVID index in svdm_consume_modes()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07408 }, "nvd": { "published": "2026-07-25T10:17:14.673", "lastModified": "2026-07-25T10:17:14.673", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64330", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An unchecked SVID index permits a read beyond the array bounds.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1145, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64331", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:49:58.370Z", "date_updated": "2026-07-25T08:49:58.370Z", "publisher": "Linux", "title": "usbip: vudc: fix NULL deref in vep_dequeue()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07409 }, "nvd": { "published": "2026-07-25T10:17:14.813", "lastModified": "2026-07-25T10:17:14.813", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64331", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The FunctionFS request lacks a valid UDC reference and vep_dequeue dereferences it during AIO cancellation.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9858c91d9ee6a13c45311569039413729fc9b757", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1226293ec9bed3d4cc5b05eeeb811d315ca51652", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3750f75f29f99c0223601e2ee73ad084adec47bd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d0ebf9cc7c2ddf95a7cfc654b940bdacb7edde97", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0025276175fbbe0dcbf3f84d090b0adee769e9d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/347b59e9f96719d89b6ef555d02a18ada1a5846f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0443e4416aa1ee97748d1ed904eaf3352c60045e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c5371e0b91b24159a3ebaa61e70b0980bcf03c0a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1011, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64332", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:49:59.005Z", "date_updated": "2026-07-25T08:49:59.005Z", "publisher": "Linux", "title": "USB: ulpi: fix memory leak on registration failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07411 }, "nvd": { "published": "2026-07-25T10:17:14.950", "lastModified": "2026-07-25T10:17:14.950", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64332", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Early ULPI registration failures leave the allocated device name and its initial reference unreleased.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d5b32f36c50894ac2df8fa184e6f35f3a6665ecd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/88187a43135c79d0e43573b4d8f880bbb919eceb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5c098f20f15db7f9126129686d1c6da2ce8bbeb0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/624c57147df1977e0d3da53f1da7117861b9cf19", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e5493c9a98ffe083acf13ac064828ae598ba3c16", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8af6812795869a66e9b26044f455b13deecdb69c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 325, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64333", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:49:59.616Z", "date_updated": "2026-07-27T04:59:51.692Z", "publisher": "Linux", "title": "USB: serial: digi_acceleport: fix write buffer corruption", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00164, "percentile": 0.06039 }, "nvd": { "published": "2026-07-25T10:17:15.080", "lastModified": "2026-07-27T05:16:42.670", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64333", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The serial command timeout path updates and resubmits a write URB that is still unavailable instead of returning or waiting.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5d9dc88bdf8897788b0eed57113e9eca7fd42ea9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2f296974acc279f05f284441bfe3064074958d11", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e60e4873e9178da9f4f2674e4c2ff085d5a84f79", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/699dfb6917503b3cda4d5da6941cf79c3c1b4c8b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a274b3794fe1852c3d9fe6d900b94053c0b03410", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1243f120790042c2ac92e84e797dacc75fff4366", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a3a13fdc53103b07335918e2cdeb465038a71725", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/24ca1fea8f2753bf33e1d458ec1ae5d9b7796a65", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 788, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64334", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:50:00.229Z", "date_updated": "2026-07-25T08:50:00.229Z", "publisher": "Linux", "title": "USB: serial: digi_acceleport: fix hard lockup on disconnect", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.0741 }, "nvd": { "published": "2026-07-25T10:17:15.207", "lastModified": "2026-07-25T10:17:15.207", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64334", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Digi USB serial driver retries persistent OOB URB submission failures indefinitely while interrupts are disabled.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6e51147c2744d15730084dc89cc99180d3de4184", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6a8592ace932081ea11aea41c460a1ca0f6344a4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5a82d842e8c35227d7227f19e5e654df1451782c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bcfeae431db9986c2b313e6a760f2ac8df61e138", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2067b3838da6e4af03bae3630414193188d754b2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2b7dc482f859f2d027db07ff0efc1c5df5b3451a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/79bc131df0e50f8f663c1fdbbe952aaf193a8d39", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5c1ea24b53bf3bfb859f0a05573997487975da23", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 531, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64335", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:50:00.835Z", "date_updated": "2026-07-25T08:50:00.835Z", "publisher": "Linux", "title": "USB: serial: digi_acceleport: fix broken rx after throttle", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07402 }, "nvd": { "published": "2026-07-25T10:17:15.337", "lastModified": "2026-07-25T10:17:15.337", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64335", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Closing a throttled serial port leaves throttle state set and the read URB unsubmitted when the port is reopened.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/4f3f6f44db71e469933a7c36c5d57d937ba0a21b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d5d2660caef78d4c996d34d123574c8e86f5b5ac", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/61954033326fc7e637ed2aeeb4b52021e0ee4657", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8d50a910194f66566a5eb252b33283855c8d5203", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/abacd67e6f689c62d8a13e3da25f4272bc9ad4af", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eab394781e9321c0c7e97a24fd092387cb262f40", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/92fa3e1a49848509ea3f7995751963fc65095998", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/83a3dfc018943b05b6daf3a6f891833e1aabfa1f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 386, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64336", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:50:01.444Z", "date_updated": "2026-07-25T08:50:01.444Z", "publisher": "Linux", "title": "USB: serial: keyspan_pda: fix information leak", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06905 }, "nvd": { "published": "2026-07-25T10:17:15.463", "lastModified": "2026-07-25T10:17:15.463", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64336", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "keyspan_pda_write reports more accepted characters than the caller supplied, causing the line discipline to continue reading beyond the tty write buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b069b7029862fafaff331d4c664d97d4ae828d6d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e52ca411f50539ff1d0c877b9312771ca8a858c1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2f7a6b8ab3845bd1da02604f1a874b52a4555a72", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e1494191a3aac665d3a2fce16169a97c346253ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cf6ca0aefae03958cfb5b189b0adbfb25c06bfac", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d4b12b6b395e43a2b1d80be3745631fcaa9c047b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6bfc8d01ac4068eced509f8fc74d0cd205e4dcec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 652, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64337", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:50:02.066Z", "date_updated": "2026-07-25T08:50:02.066Z", "publisher": "Linux", "title": "usb: mtu3: unmap request DMA on queue failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11393 }, "nvd": { "published": "2026-07-25T10:17:15.590", "lastModified": "2026-07-25T10:17:15.590", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64337", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "mtu3_gadget_queue maps a DMA request before checking ring capacity and returns EAGAIN on failure without unmapping it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3cee30f1138281a1d247bb053a1ad4f7c5b04e98", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f3c4026524d3660c73ef2838b99776d37631e039", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e8f739a3860d043dcc135371637e82f53132efe5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4183874b7925f4a98b400cf857bea26ee87da236", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/00c3fef4c2dc2c7cbd8281f8fda09d1913420f09", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/835b0596d4c9bdef93f842d8f826978fb4956b74", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0bddda5a11665c210339de76d27ebbd1a2e0b43c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 565, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64338", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:50:02.673Z", "date_updated": "2026-07-25T08:50:02.673Z", "publisher": "Linux", "title": "USB: misc: uss720: unregister parport on probe failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 28, "versionRangeCount": 24, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.0741 }, "nvd": { "published": "2026-07-25T10:17:15.717", "lastModified": "2026-07-25T10:17:15.717", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64338", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "After registering a parport, a later failure frees its private state without unregistering the still-referenced port.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6bbb98bec71b577fda4f4b48f7aea5874b04a576", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/93563243377f8e9b46cc94d9c4f06533dd31b141", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1712fd71a5aaf81e47c747f180535fa963ad7830", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0b3073f40cc9f95d5ff0037eb0a06f5c1725a7ea", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5e62d7857fd51b908b8371062ee839739a086bbe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/729b68a5bad71220ae0914c8bdab9488ad5be6c8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/48dd0b2ec9f2e97c486eb68cd0a64b25c1c3df3e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b4ecbdc4f8830f5586c4a5cfc384c00f20f8f8b3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 999, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 28 } }, { "cve_id": "CVE-2026-64339", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:50:03.272Z", "date_updated": "2026-07-25T08:50:03.272Z", "publisher": "Linux", "title": "usb: misc: usbio: bound bulk IN response length to the received transfer", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00198, "percentile": 0.09804 }, "nvd": { "published": "2026-07-25T10:17:15.870", "lastModified": "2026-07-25T10:17:15.870", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64339", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The Linux path trusts a length or offset that can read beyond the initialized input buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/48394f94211cf8fe0ea8604fc441633abf90fc94", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fc1b546973c1442d5b947fcdd03581f20ecc5bd2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8c6314489550fa81d41723a0ff33f655b5b6c7b6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1982, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64340", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:50:03.896Z", "date_updated": "2026-07-25T08:50:03.896Z", "publisher": "Linux", "title": "USB: legousbtower: fix use-after-free on disconnect race", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07404 }, "nvd": { "published": "2026-07-25T10:17:15.983", "lastModified": "2026-07-25T10:17:15.983", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64340", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "legousbtower releases a mutex through an object whose lifetime can already have ended.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/11d069f85851997b4ea0adf242ed9672dc749b8f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b4222c05066b252b451f9c8c4730b5b60824ea66", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ab2bfd7bec4f134b377ec42f513e90c35db94160", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/766738ecf2b819e54d38763c8d1c8ae6cff14b39", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9ba62966461a8e3cc593b62c56ec62eb2d80436d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/62fc8eb1b1481051f7bab4aa93d79809053dd09f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 710, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64341", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:50:04.512Z", "date_updated": "2026-07-25T08:50:04.512Z", "publisher": "Linux", "title": "USB: iowarrior: fix use-after-free on disconnect race", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06234 }, "nvd": { "published": "2026-07-25T10:17:16.117", "lastModified": "2026-07-25T10:17:16.117", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64341", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The iowarrior disconnect and release paths use mutex_unlock as if it ended object lifetime, allowing one path to free the mutex-containing object while the other still accesses it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3c0a7b29ebb391d5f50b115e86f842b709195b08", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/71590982700fdeb39a37a500c877228b0140978e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c602254ba4c10f60a73cd99d147874f86a3f485c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 688, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64342", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:50:05.169Z", "date_updated": "2026-07-25T08:50:05.169Z", "publisher": "Linux", "title": "USB: iowarrior: fix use-after-free on disconnect", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.0741 }, "nvd": { "published": "2026-07-25T10:17:16.227", "lastModified": "2026-07-25T10:17:16.227", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64342", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "USB write completions can run after disconnect because submitted URBs are not stopped during teardown.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d058d377291567b72aea33b017215cbfb383b0ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a7bbe946ca3a6eeb6f364d5e84b05e02c7c0d595", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/97ad9337127be04ca0b027c2b01e69302353f404", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/164398601a7f160bc3df1efa454f983302cef03f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f328b0e9a0dbd162f5db1b83026b689f2fea2241", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b748f97aff339e7f08dca9cf38a05b980fb66fea", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e4596816984efc537e7c04c1af0c639394f967f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bc0e4f16c44e50daa0b1ea729934baa3b4815dee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 282, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64343", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:50:05.828Z", "date_updated": "2026-07-25T08:50:05.828Z", "publisher": "Linux", "title": "USB: ldusb: fix use-after-free on disconnect race", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07407 }, "nvd": { "published": "2026-07-25T10:17:16.353", "lastModified": "2026-07-25T10:17:16.353", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64343", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ldusb releases driver data while mutex_unlock() can still access the embedded mutex during a disconnect/release race.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/fc55923a972e715f9a27187b47d4920709e23d85", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/af59829e67e11ba2511a9f8e4b9111afc7d1f550", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d8f69404e1d671326f86d378b9f5bfbd56490e9d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a3e794136ab5e3ad1e7019175a4b837aec86db4b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/19bdfc7b3c179331eafa423d87e1336f43bbfeb8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 703, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64344", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:50:06.461Z", "date_updated": "2026-07-25T08:50:06.461Z", "publisher": "Linux", "title": "USB: idmouse: fix use-after-free on disconnect race", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.0741 }, "nvd": { "published": "2026-07-25T10:17:16.487", "lastModified": "2026-07-25T10:17:16.487", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64344", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The idmouse release path relies on mutex_unlock() for lifetime while disconnect can free the same driver data, causing a use-after-free after the unlock.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/31e75fed8f90cfea9f8285e7ed135b0e452bf872", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8d53b14ad4ccbff6d306b3a39c812303f4a87d41", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f62622e947f82a3854a8502d09492ffbdeb252b4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/54c2b7356b4aeea467f9fb13b85e9e036bc428cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e88cff5fbaa629f3cab45c8b46f395d62c2eb515", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ff002c153f9722caece3983cc23dc4d9d4652cb4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 705, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64345", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.781Z", "date_published": "2026-07-25T08:50:07.069Z", "date_updated": "2026-07-25T08:50:07.069Z", "publisher": "Linux", "title": "usb: gadget: f_printer: take kref only for successful open", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 28, "versionRangeCount": 20, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06905 }, "nvd": { "published": "2026-07-25T10:17:16.623", "lastModified": "2026-07-25T10:17:16.623", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64345", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "printer_open increments the device reference before discovering that the device is busy, and the failed open has no release callback to drop it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/94ec20d97aa51547965a539f660a1fe79c6929a3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/75c0ad13e136961328253742501b4efc3988a587", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bf20c94fa6aaff945f0ae3a23f3212cd299f28d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8a5eba992c862b0c94411eecf9b7121e8636db38", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7f1f24c367938c5537e2308bf9a965f051d14774", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/30adce93d5c4a5a1ec29d9249e3fdfcc391d406b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 423, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 28 } }, { "cve_id": "CVE-2026-64346", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:07.680Z", "date_updated": "2026-07-27T04:37:30.473Z", "publisher": "Linux", "title": "usb: gadget: udc: Fix use-after-free in gadget_match_driver", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00206, "percentile": 0.10772 }, "nvd": { "published": "2026-07-25T10:17:16.757", "lastModified": "2026-07-27T05:16:42.813", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64346", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "USB gadget teardown can free the UDC management object while a concurrent driver match still dereferences it because their reference lifetimes are decoupled.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/50eeb8e8a4f389efc91b93cff14a683e714ec194", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7a5214dae906d9f58e07bc4995e8181ee74439f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d026f71df141c9b064ff32a78af5391a31ef75c2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b52476a83d9e12df00765359d728a875b128bef1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/54fa390aae393eb130f307a85562e3001cc39a52", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/67e511d2989eb1c8c588b599ce2fcc6bb8e6f7ea", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1525, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64347", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:08.338Z", "date_updated": "2026-07-25T08:50:08.338Z", "publisher": "Linux", "title": "usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07408 }, "nvd": { "published": "2026-07-25T10:17:16.893", "lastModified": "2026-07-25T10:17:16.893", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64347", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "list_first_entry on an empty configuration list yields a fabricated container pointer that the OTG handler later dereferences and copies from.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2454264b2ab4cf0055c0bfd39e79f830452bd0db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d3e72cfef2e38bd588055739a8100d14f9773b17", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8ac463fe6c0f85bdb1ce8c30e8c9e060802e4483", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/56add2b9b2e89ec61c0761165d758f73004fdfdf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/91b3ecd34b60f950c50c560974945b6596a6f207", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/01feaf024f29618d5ffa7ab0fd858e0579dcbf7b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fcb21bf747640c9d6bd1eda9da85420f076d59c1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f8f680609c2b3ab795ffcd6f21585b6dfc46d395", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1143, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64348", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:08.983Z", "date_updated": "2026-07-25T08:50:08.983Z", "publisher": "Linux", "title": "usb: free iso schedules on failed submit", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.069 }, "nvd": { "published": "2026-07-25T10:17:17.040", "lastModified": "2026-07-25T10:17:17.040", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64348", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A failed isochronous USB submit exits before linking the URB and never frees the staged schedule stored in hcpriv.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b0d00d077f9738d215af9b50c74dffab7a1de19f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be5004395dfd0b6ec310db359f887fa396fd0dd2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8890699eea19027ef6e4f9cbcf27cba5e789793f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6bc17a78a05671d303820224fb37ca339c1dc2cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4bb88aee6b868cbf73bf453f62497802f5fe4769", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b9399d25fbb34a05bbe76eeedd730f62ff2670e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1112, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64349", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:09.647Z", "date_updated": "2026-07-25T08:50:09.647Z", "publisher": "Linux", "title": "usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 9, "versionRangeCount": 8, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06239 }, "nvd": { "published": "2026-07-25T10:17:17.170", "lastModified": "2026-07-25T10:17:17.170", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64349", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "dwc3_ulpi_setup passes a register-space pointer to helpers that expect the enclosing dwc3 structure, causing incompatible pointer interpretation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/41a4e80d5af04855e68ac88f5e2cd07fa67287f8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4349e487a1149ff33b65d53427b8aca57f2e4578", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e0f844d9d74200d311c6438a0f04270834ba5365", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 846, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 9 } }, { "cve_id": "CVE-2026-64350", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:10.270Z", "date_updated": "2026-07-25T08:50:10.270Z", "publisher": "Linux", "title": "usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.069 }, "nvd": { "published": "2026-07-25T10:17:17.280", "lastModified": "2026-07-25T10:17:17.280", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64350", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A later allocation failure frees stream rings but leaves the previously allocated stream context array unreleased.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/37283f5a47127fbdea567749a2110766af53d18d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cb8e9391b7f4f77d112c51910cd7c355a337ef76", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fde3c095e1d48e0ac3ab8bc32905da42fe58a36a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d9643bbe93a6aee24edee1a86e0303aa74bcd320", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c00826e87bb75e14e0381b05da5f18ffd0241ab6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/963075c4da0cd43b3d17b107c355e1eb0ee64a58", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3348f444a4ce43dd5c2d1aa41634cb6eff33aa64", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 502, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64351", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:10.882Z", "date_updated": "2026-07-25T08:50:10.882Z", "publisher": "Linux", "title": "net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00185, "percentile": 0.08361 }, "nvd": { "published": "2026-07-25T10:17:17.407", "lastModified": "2026-07-25T10:17:17.407", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64351", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "kalmia_rx_fixup subtracts two headers from a short frame, underflows the length, and reads past the receive buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/391706889a5112feafdc0c68db3ecc7ed325d09c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/46ab32870d010e9a057bc5659cea22b7e728ca88", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c466097d85d52f3aa200736cb4759e66d4bbf6e3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e24eb271061db384a3c3ef6f107fe515e68ef222", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/51e65f1d78457ea4f9513d90ab22c9dccbb35110", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/47b6bcef6e679593d2e86e04ee72c46a4e2f7139", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 975, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64352", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:11.522Z", "date_updated": "2026-07-25T08:50:11.522Z", "publisher": "Linux", "title": "bpf: Allow LPM map access from sleepable BPF programs", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06906 }, "nvd": { "published": "2026-07-25T10:17:17.547", "lastModified": "2026-07-25T10:17:17.547", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64352", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "LPM trie code uses RCU annotations that reject the Tasks Trace RCU context held by sleepable BPF programs, producing a lockdep-only warning.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f0967d4f1ba4323a3cb7dc8fdba74dd3a8caaf04", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/304ca50582f0c047370f85e13caec456f78c9fcc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ec662a8b2cde01e76b37ccd4b992d0342299e69c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9bfdf4b81b0e56d47bc6c46c34a46638be716695", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57454944737f3ad9a8703aecbbb79713b513a94b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bd6ad9a6b30498d845413e863fb95c6fab3babe3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2f884d371fafea137afea504d49ee4a7c8d7985b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2660, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64353", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:12.120Z", "date_updated": "2026-07-25T08:50:12.120Z", "publisher": "Linux", "title": "bpf: Keep dynamic inner array lookups nullable", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06238 }, "nvd": { "published": "2026-07-25T10:17:17.700", "lastModified": "2026-07-25T10:17:17.700", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64353", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The BPF verifier uses an inner-map template size to mark a dynamic concrete-array lookup non-null even when the concrete map is smaller, allowing an out-of-range lookup result to be treated as valid.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0b92ad64d6e4bde85e6b9888404f9a7a2b65d269", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d57db0d975053e01410c54e708a85b6d32ef2ebd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/53040a81ae57cdca8af8ac36fe4e661730cf7c6b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 741, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64354", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:12.752Z", "date_updated": "2026-07-27T04:59:52.875Z", "publisher": "Linux", "title": "bpf: Validate BTF repeated field counts before expansion", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 10, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02907 }, "nvd": { "published": "2026-07-25T10:17:17.810", "lastModified": "2026-07-27T05:16:42.943", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64354", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "BTF repeated-field count arithmetic wraps in 32 bits and lets memcpy write beyond the fixed BTF_FIELDS_MAX scratch array.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c5ff816d5f13900c3f1f3298cfcc61339e056e56", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cd407de2ef5dc70f1970b343ffaa16186340fdfd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ff77d013b737c0f77d925e2f2c59f0cf3d76bd35", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b9452b594fd3aecbfd4aa0a6a1f741330a37dab7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 729, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64355", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:13.410Z", "date_updated": "2026-07-27T04:59:54.016Z", "publisher": "Linux", "title": "bpf: Reject fragmented frames in devmap", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00502, "percentile": 0.40222 }, "nvd": { "published": "2026-07-25T10:17:17.920", "lastModified": "2026-07-27T05:16:43.060", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64355", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "devmap clones only the linear part of a fragmented XDP frame but preserves the fragment flag, so the free path interprets uninitialized tail data as metadata.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/47baddc856ae7e93a565dd9deeb797999b179466", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/07a4c11ee8ef4abcb39d922e9e410ae269671cdf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bccbab36ff228e0825eb85d9b0f9b8434cd0a399", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c5b4f5efcb55c1af3fe44ff712d31b7fb098a831", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a9bb2d9c798cb62a4050a991c27b752770c33afe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/51d07c12ca411e692c424ecdabf077f1e61a61be", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aa496720618f1a6054f1c870bf10b4f6c99bf656", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 875, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64356", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:14.049Z", "date_updated": "2026-07-25T08:50:14.049Z", "publisher": "Linux", "title": "xfs: fix memory leak in xfs_dqinode_metadir_create()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00179, "percentile": 0.07617 }, "nvd": { "published": "2026-07-25T10:17:18.040", "lastModified": "2026-07-25T10:17:18.040", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64356", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Create and commit failure paths omit releases for update, transaction, or inode references.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c3d3d2212c2966973dd7d603c6c6e6ed6fc7fbe1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/06a2e6dbaa26c0740ac76dfa66b0aedc78d05820", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/45de375b25060edf46e20abb36521ba530336ceb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1325, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64357", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:14.676Z", "date_updated": "2026-07-25T08:50:14.676Z", "publisher": "Linux", "title": "xfs: fix exchmaps reservation limit check", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06422 }, "nvd": { "published": "2026-07-25T10:17:18.150", "lastModified": "2026-07-25T10:17:18.150", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64357", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "XFS checks the pre-overhead reservation instead of the computed value before storing it in an unsigned-int transaction reservation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c597c8580d50127fc1221b5a5b653a94d49e23e3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a62ef2d13d6e7270dd5e88c6082bf2d0edcd5112", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4707344b0d36d1012c8a1716e20167cd3afdd5f1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0a5213bbff62b51c7d4999ac8c7e11ea57d00d45", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 563, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64358", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:15.303Z", "date_updated": "2026-07-25T08:50:15.303Z", "publisher": "Linux", "title": "media: mtk-jpeg: cancel workqueue on release for supported platforms only", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 17, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06422 }, "nvd": { "published": "2026-07-25T10:17:18.253", "lastModified": "2026-07-25T10:17:18.253", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64358", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The MediaTek JPEG release path cancels a workqueue on platforms where that work item was never initialized.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0fed0fc34ce734b4b8c2f6a467d38bddcb21dda9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ac0774961a6ea174a71d4ffa39966edafbf7662d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/973408ceab14555a8548b97c8cc7b54208c3f251", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4c4b4af4a9f278da096f0dbdb6b59594701d29bf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b1845a227fda37b2fe5327df3ca0015d7e290235", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 927, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 17 } }, { "cve_id": "CVE-2026-64359", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.782Z", "date_published": "2026-07-25T08:50:15.947Z", "date_updated": "2026-07-25T08:50:15.947Z", "publisher": "Linux", "title": "nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07401 }, "nvd": { "published": "2026-07-25T10:17:18.377", "lastModified": "2026-07-25T10:17:18.377", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64359", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "NILFS2 validates attacker-supplied segment numbers only after entering the locked cleaning path, allowing repeated invalid entries and warning output to hold the segment lock long enough to stall other operations.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3ed388ec3b8922383d1e2d4432d7bd4cbbf8364e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/876c98e0fc65f071680c03c2e2ee3ef7ff9ca078", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/39607452b1400c7bf748f15122df4d058b768c5b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/286f77d002a337735c0846d7480a82d9cda2aa31", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0789f0a6710713254a08f3a7d2ecbb6d1cbcf0aa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/223463c488b0554212a94de971ea538eb2805fc7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d26aef771b4f6923da9f89d6d5b70d8def5853de", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0e7a690fe435f8d5ea3feb7c1d8d73ba7e8b8aa9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2397, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64360", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.783Z", "date_published": "2026-07-25T08:50:16.573Z", "date_updated": "2026-07-25T08:50:16.573Z", "publisher": "Linux", "title": "hfs/hfsplus: zero-initialize buffer in hfs_bnode_read", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 29, "versionRangeCount": 25, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07411 }, "nvd": { "published": "2026-07-25T10:17:18.530", "lastModified": "2026-07-25T10:17:18.530", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64360", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corrects the length to zero.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/34684a04777358b2b40ac729e54c8e45359e46b3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0b189b2204f1a2612dc68f8d139fb5b80539e710", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8f72fd25a57a457866350359ddd27a43caa62c95", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/16ca053c2be5f4f3044dccf7fc19237dc820d394", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d2afc7ecee476f9251dd87444f7fb6a424410922", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f3461b84a4865d9b5e70fbb71da72ae044a3bcd2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d5b45bad75cd2730b8452aed4d3b20a2b2a12576", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 735, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 29 } }, { "cve_id": "CVE-2026-64361", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.783Z", "date_published": "2026-07-25T08:50:17.345Z", "date_updated": "2026-07-27T04:59:55.178Z", "publisher": "Linux", "title": "hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 29, "versionRangeCount": 25, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02972 }, "nvd": { "published": "2026-07-25T10:17:18.677", "lastModified": "2026-07-27T05:16:43.193", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64361", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A 32-bit off-plus-length bounds calculation wraps, allowing an underflowed length to pass before a multi-gigabyte memmove.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c8dd112173c02adf539fe2ad34a45f5e0068780d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/671c3fcc2ad31c1311ea6414382a2d95104ae1b9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b6a481642ea1977be2f84dc08c5affd742c177e7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7399c3baee7bb622a92f0b895cd4d3009a693f2b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/607217f7ad419b53926f71e3f75001813bbc08ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c25d3c931a63e762fcaa9cb125b901c53b62403f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/966cb76fb2857a4242cab6ea2ea17acf818a3da7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 857, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 29 } }, { "cve_id": "CVE-2026-64362", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.783Z", "date_published": "2026-07-25T08:50:18.008Z", "date_updated": "2026-07-25T08:50:18.008Z", "publisher": "Linux", "title": "HID: lg-g15: cancel pending work on remove to fix a use-after-free", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07407 }, "nvd": { "published": "2026-07-25T10:17:18.820", "lastModified": "2026-07-25T10:17:18.820", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64362", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The HID driver frees device-managed state on unplug without cancelling work items that later recover and dereference that state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3b9a3919aac6977262f04d5365c0456877522a44", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4aef9676c26dff8723b56834951cfc6b618f0986", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/acce9dee807f21184fff19ad17c8ed464247e7f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/33cd1a000daf929356aacf2b191d31714ff0615e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dfc6e61f83113cc18346b6988f07271c0063357d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4d0d51bc12d246accbfbb94de05d729c68c9b8fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8131f4226688c4be5f30874d167e44dab838eb09", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7705b4140d188ce22656f6e541ae7ef834c7e11a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1096, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64363", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.783Z", "date_published": "2026-07-25T08:50:18.824Z", "date_updated": "2026-07-25T08:50:18.824Z", "publisher": "Linux", "title": "HID: appleir: fix UAF on pending key_up_timer in remove()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00211, "percentile": 0.11393 }, "nvd": { "published": "2026-07-25T10:17:18.960", "lastModified": "2026-07-25T10:17:18.960", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64363", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Apple IR teardown can free input_dev while a timer or raw-event callback remains able to dereference and rearm work against it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/89ef67359672bf4cd6921524e39f61648fe38c0f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3d30a0bb0e79621ae921b487835c56198adfafa3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/37a52c61d4f78153c38ae1f7491dfcc8ac828dcf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/05e3decc55d1deca9410e0eb36466651fcbe57a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3755f6e25776b8b12ddf062f9b573f05090e4034", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b363d964ca829c1761c9f04188dfa28f90b0f2d4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6b0838e86da88b1d3bff86f19761ff25af73eaca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/75fe87e19d8aff81eb2c64d15d244ab8da4de945", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2145, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64364", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.783Z", "date_published": "2026-07-25T08:50:19.441Z", "date_updated": "2026-07-27T04:59:56.321Z", "publisher": "Linux", "title": "HID: multitouch: fix out-of-bounds bit access on mt_io_flags", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 25, "versionRangeCount": 23, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00345, "percentile": 0.27118 }, "nvd": { "published": "2026-07-25T10:17:19.110", "lastModified": "2026-07-27T05:16:43.347", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64364", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The HID driver treats one unsigned long as a bitmap indexed by an attacker-reported contact count up to 255, corrupting adjacent structure members past that word.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1920, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 25 } }, { "cve_id": "CVE-2026-64365", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.783Z", "date_published": "2026-07-25T08:50:20.039Z", "date_updated": "2026-07-25T08:50:20.039Z", "publisher": "Linux", "title": "HID: letsketch: fix UAF on inrange_timer at driver unbind", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06905 }, "nvd": { "published": "2026-07-25T10:17:19.280", "lastModified": "2026-07-25T10:17:19.280", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64365", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Driver teardown frees device and input objects without draining a timer whose callback still dereferences them.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2bb6e7143cf70ed281822d26c1848b2897ac36e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/523db788c0f84612707638e266e8957ca7e3a756", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/17f5928d7010bc9e002930326b59e60e40c09ee3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3eca1a8165b5e7996e699e9df76cb4645e184d42", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/df3d8aa1a9392da3de66398e7a03422463806b21", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/46c8beeccd8ab2c863827254a85ea877654a3534", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1656, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64366", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.783Z", "date_published": "2026-07-25T08:50:20.612Z", "date_updated": "2026-07-27T04:59:57.437Z", "publisher": "Linux", "title": "HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00253, "percentile": 0.16832 }, "nvd": { "published": "2026-07-25T10:17:19.403", "lastModified": "2026-07-27T05:16:43.517", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64366", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An empty FIFO path reuses a stale length, corrupting parser state and allowing an out-of-bounds write.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ca899a926c11a59211b764b0155d9a1cdcc32b81", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57bdd10ad50d68341f500a7b330f0d8949e510ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6b3014ec0e9a390ca563030b2d7689921f0daef5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 962, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64367", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.783Z", "date_published": "2026-07-25T08:50:21.214Z", "date_updated": "2026-07-27T04:59:58.577Z", "publisher": "Linux", "title": "HID: hid-goodix-spi: validate report size to prevent stack buffer overflow", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00142, "percentile": 0.03976 }, "nvd": { "published": "2026-07-25T10:17:19.510", "lastModified": "2026-07-27T05:16:43.640", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64367", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "goodix_hid_set_raw_report copies a caller-sized report into a fixed 128-byte stack buffer without checking the remaining capacity.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ad47ad624f2fce0bc44bbadb664242461a97d774", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dae1d000ddfd5c2140b036e47fff0c497ae9c64b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/835fcc8655569737e3f057d42875a96259db74c2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/db0a0768d09273aadadeb76730cd658d720333a4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 806, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64368", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.783Z", "date_published": "2026-07-25T08:50:21.831Z", "date_updated": "2026-07-27T04:59:59.923Z", "publisher": "Linux", "title": "mm/slab: do not limit zeroing to orig_size when only red zoning is enabled", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00417, "percentile": 0.3433 }, "nvd": { "published": "2026-07-25T10:17:19.613", "lastModified": "2026-07-27T05:16:43.820", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64368", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "With red zoning enabled but requested-size tracking disabled, the slab allocator zeros only orig_size and violates the full-object __GFP_ZERO guarantee used by krealloc.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6256899c3a34674bba6076884aedbba49fc695e4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7e706d50fa119eead6376bf0ef973e8d73a96030", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2382971aaaef5bf85a651234c64906f59580b8be", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0d18ccef142f04433dfb2a0c120cf223d2b8a42c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/648927ceb84021a25a0fbd5673740956f318d534", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1105, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64369", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.783Z", "date_published": "2026-07-25T08:50:22.543Z", "date_updated": "2026-07-25T08:50:22.543Z", "publisher": "Linux", "title": "s390: Revert support for DCACHE_WORD_ACCESS", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00181, "percentile": 0.07852 }, "nvd": { "published": "2026-07-25T10:17:19.743", "lastModified": "2026-07-25T10:17:19.743", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64369", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An unaligned cross-page access to donated secure memory enters an exception path that cannot resolve and loops indefinitely.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c9e0f1517631ac08987f8385817119bccf2f1f12", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be79d285bea70d0edd5015bd487311bfa8cbebc9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c94806905e02cc8e17a69c822d93c41743b7ffc5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/37540b8c287fc817bdbd0c62bb75ad6eab0e5d03", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1011, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64370", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.783Z", "date_published": "2026-07-25T08:50:23.257Z", "date_updated": "2026-07-25T08:50:23.257Z", "publisher": "Linux", "title": "posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07405 }, "nvd": { "published": "2026-07-25T10:17:19.880", "lastModified": "2026-07-25T10:17:19.880", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64370", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The CPU nanosleep error path returns after timer setup failure without releasing the pid reference acquired during timer creation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/afed3cdc1cca133f804fcf57ff228974f424b23a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8a270b1258797f61b61da44f8bfd41a581b5c85b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d605d00085adc3fddf67de01dc2a44aebf1a3fb5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e5ffc638faf5dc7d9dc85c9a95e10bf97442e0c0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eb4cec29a78334d09bcfb41c0660cdd62ba05843", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7776f9226e99eb49d97492b0b445027cfcb189da", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8f06363446c5d043c9a7c008b250040e9de98cf9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/87bd2ad568e15b90d5f7d4bcd70342d05dad649c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 578, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64371", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.783Z", "date_published": "2026-07-25T08:50:23.981Z", "date_updated": "2026-07-25T08:50:23.981Z", "publisher": "Linux", "title": "proc: protect ptrace_may_access() with exec_update_lock (part 1)", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 22, "versionRangeCount": 19, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07405 }, "nvd": { "published": "2026-07-25T10:17:20.010", "lastModified": "2026-07-25T10:17:20.010", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64371", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Procfs authorization checks race process exec state because several ptrace_may_access call sites omit exec_update_lock protection.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ae1e630bcaac739f625822078edbaea98366930d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d54f14655fd7d7b293698a8b6918563c4c0465e7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bb43679356f1f2a4c6b1c88aec4f021e5b5c74e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7456ae990a9738962b33146916fabca62ae3d4e0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4bfe8c481846cee52473a2f7d7b30ee8e6749fc4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f9b4b03ccc9c69bf7f7298d4559906ebea7143b3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c1cfd63326f5d09999134e9052c353faf738286e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6650527444dadc63d84aa939d14ecba4fadb2f69", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 619, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 22 } }, { "cve_id": "CVE-2026-64372", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.783Z", "date_published": "2026-07-25T08:50:24.733Z", "date_updated": "2026-07-27T05:00:01.364Z", "publisher": "Linux", "title": "cpufreq: pcc: fix use-after-free and double free in _OSC evaluation", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02635 }, "nvd": { "published": "2026-07-25T10:17:20.147", "lastModified": "2026-07-27T05:16:43.950", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64372", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "pcc_cpufreq_do_osc frees the first ACPI result but retains its pointer and length, so the second evaluation writes into freed memory and later frees it again.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8e454e9d0bc03446d610ee49abec9dfd424f6541", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/632666a63116d8061c62a988d1ca39dcd6d27c9b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5cdb25f144b101083d8bf3fd023ad87fbe6850d7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/982c9f92d57bda2b769851ff6d90d43dcf5f3734", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a36ca93a8ba57464e521d70a337d37f069064111", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6ba6f6783be2ffeb2cbcdc9321c4b9f708f796f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0e3c739a2f6fc1de5b19a8839ab80696b9cb2a29", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/266d3dd8b757b48a576e90f018b51f7b7563cc32", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 757, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64373", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:25.427Z", "date_updated": "2026-07-25T08:50:25.427Z", "publisher": "Linux", "title": "cpufreq: Fix hotplug-suspend race during reboot", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 28, "versionRangeCount": 22, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07407 }, "nvd": { "published": "2026-07-25T10:17:20.283", "lastModified": "2026-07-25T10:17:20.283", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64373", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "CPU hotplug can free cpufreq governor_data while the reboot-time suspend path accesses it because that path lacked the CPU read lock.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6d5dd354c37abaf4d60400c55c71f23ba2b33639", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9103078c7b3091a2fbb52af176f95982ee7dd7f8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cd4524ff6567fa4458a5bec4b017105e671d393e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/73255d702c7560185fd5951aadcf7eb057c2f453", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a0ef2fc89d28ca62923376c4b8ffaa57136a36be", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6e175c00c62dca3d91b987015808b5d52e8db2b4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a0106b41f9a724868d390b8b3b4ea5ca0e04ea53", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a9029dd55696c651ee46912afa2a166fa456bb3e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1053, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 28 } }, { "cve_id": "CVE-2026-64374", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:26.130Z", "date_updated": "2026-07-27T05:00:02.525Z", "publisher": "Linux", "title": "sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00501, "percentile": 0.40145 }, "nvd": { "published": "2026-07-25T10:17:20.433", "lastModified": "2026-07-27T05:16:44.083", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64374", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Repeated RT_PUSH_IPIs indefinitely postpone softirq completion and keep the CPU in a livelock.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b99f04ae3d200d2f8844aa29145bd18eccbeecde", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d8312a56d9a162e3ec76476aa487e7d20bc602e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/44aae426dbfd51286f7eb601cfa14bc32164812a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/860aaff72c8446fed5e576249e19952883a18885", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/89237c8fc15d8016a194076e648ccb57d75e65ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4bd0da48fbc1dbef6774175129107fbbdd353e26", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a18f80bf5359238c4f067d691b96af00286fdd89", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dd29c017aed628076e915fe4cdfb5392fd4c5cab", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3572, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64375", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:26.869Z", "date_updated": "2026-07-27T05:00:03.722Z", "publisher": "Linux", "title": "proc: protect ptrace_may_access() with exec_update_lock (FD links)", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02972 }, "nvd": { "published": "2026-07-25T10:17:20.593", "lastModified": "2026-07-27T05:16:44.250", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64375", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The proc file-descriptor link path checks ptrace access on one task lookup and performs access through a second lookup without locking the task across both.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6253dfee5afba536bb54fc6fe6c091c3758fafe1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/65bf0d2b6e914f1448d6a2fde193dcf60936a651", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/de497d7aa2fae453a7e7c8f7d3e8682e565e3aaf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/138c692d2b2d63d26f2eb957d0e4fcc5d61f9ff2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/83b17872e3166c295c599279fc9562ac3840c638", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/497c6bae5167428596575f20af6613ff5671f383", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dfd1894cb64cbd8758b461ed713800fe73db4f82", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6255da28d4bb5349fe18e84cb043ccd394eba75d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 606, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64376", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:27.577Z", "date_updated": "2026-07-25T08:50:27.577Z", "publisher": "Linux", "title": "firmware_loader: fix device reference leak in firmware_upload_register()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06905 }, "nvd": { "published": "2026-07-25T10:17:20.717", "lastModified": "2026-07-25T10:17:20.717", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64376", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The firmware loader retains a device reference after the operation ends and never releases it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/517676ec7dfca064e08f94007a4abd21969de0a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/46d403da376a8b7c1187193294953816e1a8d7fe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2619b47a0c8114eef980a56ade7e3ef4b58eb384", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/92f41769e5fd16bcd9ba97500d0517332e0a5b45", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/15432f19562fdb9199cce6d9fc24db12c71ed574", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/896df22ee57648b0c505bd76ddbc6b2341834696", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1039, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64377", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:28.299Z", "date_updated": "2026-07-25T08:50:28.299Z", "publisher": "Linux", "title": "cpufreq: qcom-cpufreq-hw: Fix possible double free", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06423 }, "nvd": { "published": "2026-07-25T10:17:20.837", "lastModified": "2026-07-25T10:17:20.837", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64377", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "qcom_cpufreq frees a devm-managed array element manually, allowing device detach to free the same allocation again or freeing a pointer that is not the allocation base.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/28a03a3f6e6cda0b0da3b43761d175dec5d14d13", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e904961332801c87355f5d11c65bb433e717c489", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9de568ef6cdfc7912d5ea8db02843c0e4ef0c75d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bcb8889c4981fdde42d4fd2c29a77d510fe21da2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 864, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64378", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:29.006Z", "date_updated": "2026-07-27T05:00:04.907Z", "publisher": "Linux", "title": "writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 16, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02962 }, "nvd": { "published": "2026-07-25T10:17:20.940", "lastModified": "2026-07-27T05:16:44.393", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64378", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Unmount can destroy writeback state after an inode switch passes its active check but before that switch queues its work.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/087d5b8b501c570f84bf655164e6698c3ce146e0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3c9c9648f77e4d14e50676bc51c2174ba9c8d361", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5c3265f3252b2ee50707adaaa3f9bd0df3df72de", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c923cc3cb5cd8945ceaf08252754110643446593", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/685fc15a410885b6d4dee64de0dce721b9428b12", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/53eeaf4d63068dbc7708b0c7adb20151c812feca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3274, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64379", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:29.717Z", "date_updated": "2026-07-27T05:00:07.664Z", "publisher": "Linux", "title": "smb: client: mask server-provided mode to 07777 in modefromsid", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00309, "percentile": 0.23242 }, "nvd": { "published": "2026-07-25T10:17:21.090", "lastModified": "2026-07-27T05:16:44.557", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64379", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SMB client applies an unmasked server-supplied NFS mode SID, permitting bits outside the intended 07777 permission domain.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ee2216dbdf0c677e89bb43e03247dba590ed00ef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f511807feee7cb29b61bdfa86472c7e9e2e5df94", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/08c600b7e1818539ba5efee4cdb06215c245ca78", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c6c484a7d5bff6b929a86d7ed5130f29834c6a0d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f80add1bfb3425100a325b14f19648e75669a954", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e3d9c7160d483fc8f9e225aafad8ecbbc43f3151", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 331, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64380", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:30.476Z", "date_updated": "2026-07-27T05:00:08.926Z", "publisher": "Linux", "title": "smb: client: harden POSIX SID length parsing", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00443, "percentile": 0.36426 }, "nvd": { "published": "2026-07-25T10:17:21.220", "lastModified": "2026-07-27T05:16:44.690", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64380", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SID parser trusts an encoded length that exceeds the available object and reads beyond the supplied buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/171605aed68380c2fa75dff9b3a1ed427c50065b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4213c1208978483021d7d125c131de3985d38f61", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/96e889bc1e759c83f25093e8c2f3da31b4973f30", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0de5b8e76847f5de26f364a82c6602c4881c30da", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/427eb7eb46425fec845a43e861f3d6e2899cae59", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/86c5d470f5d42e61123b2f4b4f0b91f4eee5b980", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/46a84715a015cb48e1b9c219dc88c03d8a541ea4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7ad2bcf2441430bb2e918fb3ef9a90d775a6e422", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 385, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64381", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:31.209Z", "date_updated": "2026-07-25T08:50:31.209Z", "publisher": "Linux", "title": "smb: client: Fix next buffer leak in receive_encrypted_standard()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07405 }, "nvd": { "published": "2026-07-25T10:17:21.347", "lastModified": "2026-07-25T10:17:21.347", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64381", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "receive_encrypted_standard allocates next_buffer before enforcing MAX_COMPOUND and returns on the limit path without attaching or freeing the buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/94e4f672db029414b9888b5137a7559f1febf2d8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/68fc0b6cc03ca58060c0f36454e169f5fe258974", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/07e0ab81df1790afa35732a4e8e07ff831b29008", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9136a08dc29328edd9867f2545e73906ac9df93b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/67097772df7791c53d608f04bd31c676ccf79b83", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/297243e365fc9fe2f8e9b7dd535a65d922cd108b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/927d4805aea0a287d36dd4f826ee24d69a2afee3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1c6267a1d5cf4c73b656f8181b310cbbb3e4767b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 493, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64382", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:31.937Z", "date_updated": "2026-07-27T05:00:10.074Z", "publisher": "Linux", "title": "smb: client: fix double-free in SMB2_open() replay", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 13, "versionRangeCount": 12, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00354, "percentile": 0.28115 }, "nvd": { "published": "2026-07-25T10:17:21.477", "lastModified": "2026-07-27T05:16:44.823", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64382", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SMB2_open retry cleanup retains stale response-buffer state and can free the same response a second time after initialization fails.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/02bc2896bdc3e29362d6e40d404006944a159c25", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3196b5192f246df4272072f61a2f4a3e9967f55d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/14498ff5ce0f272ce0ef988721413e06b7038972", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ff2d30927bc3bf3c629f0768d2068096e64ef5ce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b55e182f2324bc6a604c21a47aa6c448f719a532", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 402, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 13 } }, { "cve_id": "CVE-2026-64383", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:32.634Z", "date_updated": "2026-07-27T05:00:11.278Z", "publisher": "Linux", "title": "smb: client: fix double-free in SMB2_flush() replay", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 13, "versionRangeCount": 12, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00457, "percentile": 0.37417 }, "nvd": { "published": "2026-07-25T10:17:21.587", "lastModified": "2026-07-27T05:16:44.947", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64383", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SMB2_flush carries a response pointer across replay attempts and frees the stale pointer again when the retry fails before replacing it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6e27f40b682a5e42a2daae3ce6d96f0e0e16dedb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/878757163eea684750107a31ea134c103863515d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3407240cde132a4b72d6429a2625a09a2f78adaf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/013a9a3da46c5dabcf18f65ea6a47874ba12a15d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4be31c943a3a27a5a0251dbb8f5cb89059ec3d5a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 606, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 13 } }, { "cve_id": "CVE-2026-64384", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:33.306Z", "date_updated": "2026-07-27T05:00:12.445Z", "publisher": "Linux", "title": "smb: client: fix change notify replay double-free", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 13, "versionRangeCount": 12, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00457, "percentile": 0.37417 }, "nvd": { "published": "2026-07-25T10:17:21.700", "lastModified": "2026-07-27T05:16:45.087", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64384", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SMB change-notify replay path retains stale response bookkeeping and frees the same response buffer again after a later initialization failure.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5821f9dbb8b5b24391850a13418e633edd0fb003", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d684f4134998085702009b94c35c2003fc9e72d3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/52af1975f0dfae990c5a0e85872cc41be0e88a68", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/901891513951bc8322ece754863909ea45af95c6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/145f820dcbb2cced374f2532f8a61a44dce4a615", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 403, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 13 } }, { "cve_id": "CVE-2026-64385", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:33.997Z", "date_updated": "2026-07-27T05:00:13.594Z", "publisher": "Linux", "title": "smb: client: fix double-free in SMB2_ioctl() replay", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 13, "versionRangeCount": 12, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00457, "percentile": 0.3742 }, "nvd": { "published": "2026-07-25T10:17:21.810", "lastModified": "2026-07-27T05:16:45.203", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64385", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An SMB2 ioctl retry frees a response but retains stale response bookkeeping, so initialization failure on the next attempt frees the same buffer again.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0be4bc64882edaefaaee8d1e27d083643eb778e6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/96fcfc8ae7359346156e492ca610e830d2649ad6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/276c8efbc49f9303ac76d0d4deab7128581b0f3b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fc65ffb4ef1bf540da16b17c225ae51091e07d72", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 404, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 13 } }, { "cve_id": "CVE-2026-64386", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:34.729Z", "date_updated": "2026-07-27T05:00:14.821Z", "publisher": "Linux", "title": "smb: client: fix query_info() replay double-free", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 13, "versionRangeCount": 12, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00457, "percentile": 0.37416 }, "nvd": { "published": "2026-07-25T10:17:21.917", "lastModified": "2026-07-27T05:16:45.323", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64386", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A replayable SMB error frees a response buffer while stale response bookkeeping causes cleanup to free the same buffer again.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/100fb7c455fa86d248b8bd7bb9de757c192870b4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3c81dda84799f76b42aec598564316e2964440db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f1add4acb656f5a82806a1ab0e63fed3d8b1bfca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/89234773e8348918111aa15f6922b58cf3843364", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2a88561d66eb855813cf004a0abe648bbb17de5e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 406, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 13 } }, { "cve_id": "CVE-2026-64387", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:35.543Z", "date_updated": "2026-07-27T05:00:15.962Z", "publisher": "Linux", "title": "smb: client: fix query directory replay double-free", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 13, "versionRangeCount": 12, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00457, "percentile": 0.37417 }, "nvd": { "published": "2026-07-25T10:17:22.020", "lastModified": "2026-07-27T05:16:45.450", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64387", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SMB query-directory retry cleanup retains stale response bookkeeping and frees the same response buffer twice.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3409aedf3c81a810243da94164f6621c9d205c98", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1665f25b1dea30bf2d02e16245d203a944c9d994", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/00b0fa425941438b664950a8ee65dfba2def4336", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3317a5d015fca976475aa71df224056777316fde", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9647492b5e41954be59d5157eddbcd4cdc1656f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 414, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 13 } }, { "cve_id": "CVE-2026-64388", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.784Z", "date_published": "2026-07-25T08:50:36.202Z", "date_updated": "2026-07-27T05:00:17.102Z", "publisher": "Linux", "title": "smb/client: fix chown/chgrp with SMB3 POSIX Extensions", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02187 }, "nvd": { "published": "2026-07-25T10:17:22.127", "lastModified": "2026-07-27T05:16:45.570", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64388", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SMB3 POSIX setattr path ignores requested UID and GID changes unless unrelated CIFS mount flags are also set.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/550cfb8a81181331d4d0f76ab75ee58a0bf41e3e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/760ef2c579c2609cf17fb1cd5392f64d42d43d33", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 518, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64389", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:36.817Z", "date_updated": "2026-07-27T05:00:18.260Z", "publisher": "Linux", "title": "ksmbd: validate NTLMv2 response before updating session key", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00453, "percentile": 0.37147 }, "nvd": { "published": "2026-07-25T10:17:22.227", "lastModified": "2026-07-27T05:16:45.683", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64389", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ksmbd stores a derived NTLMv2 session key before validating the NTLMv2 response and continues key exchange after validation failure, allowing rejected authentication data to alter an existing session.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b56400364aed5c34d6e1a0b493081290a5328a9c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/89ca7756d5566ba636bb9092cdbe57dab095e136", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/954d196bebb2b50151cb96454c72dc113b2af1ac", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1305, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64390", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:37.406Z", "date_updated": "2026-07-27T05:00:19.433Z", "publisher": "Linux", "title": "ksmbd: track the connection owning a byte-range lock", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00467, "percentile": 0.38058 }, "nvd": { "published": "2026-07-25T10:17:22.330", "lastModified": "2026-07-27T05:16:45.810", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64390", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SMB multichannel removes a byte-range lock under a different connection's spinlock from the list that owns it, allowing concurrent access after free.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/22d38cf75b556c20b039743bdf3654d535b858be", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/66eb3643164e5e1029907793926c132f8b5c6148", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ea5c9bf99f626a15cc59f645dc895f2b3f01992e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fe20d492a69a6f79e637f438072b212e21ed3b78", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/427faaa52b0b399940c1a88065a5c310d10dad15", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5fecc15a30cb9ebd310f7b52c1ab607edcea78f6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 999, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64391", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:38.013Z", "date_updated": "2026-07-27T05:00:20.631Z", "publisher": "Linux", "title": "ksmbd: use opener credentials for ADS I/O", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00457, "percentile": 0.37416 }, "nvd": { "published": "2026-07-25T10:17:22.453", "lastModified": "2026-07-27T05:16:45.943", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64391", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ksmbd performs alternate-data-stream xattr I/O with the current worker credentials instead of the credentials captured when the SMB handle was opened.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a8f5d39971bbad9340d49cd41b0e2da9452a649d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2b4592cea214683de0f2ce6f8c22c097fb0ea1ab", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/52a56cf53ec834c44ac1b4d16d585f26613ee5ce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/baa5e094886fffa7e6272edcb5e08be5ce28262c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 399, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64392", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:38.634Z", "date_updated": "2026-07-27T05:00:21.820Z", "publisher": "Linux", "title": "ksmbd: use opener credentials for delete-on-close", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00469, "percentile": 0.3813 }, "nvd": { "published": "2026-07-25T10:17:22.557", "lastModified": "2026-07-27T05:16:46.063", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64392", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Deferred delete-on-close teardown runs under worker credentials instead of the credentials of the opener who requested deletion.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f08b3f451f12eee4abd8a5981803bc36db84458b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/18c59109bb6fb816d5102171666f87cf1e29901d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e72c15085b6d86f45d224d98aa75b5cace4aaab9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4b7059974549d278e30fe70e2a4e421f9839817d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/52e2f21911158ec961cd5aae19c56460db382af0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 589, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64393", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:39.239Z", "date_updated": "2026-07-27T05:00:22.986Z", "publisher": "Linux", "title": "ksmbd: run set info with opener credentials", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00479, "percentile": 0.38811 }, "nvd": { "published": "2026-07-25T10:17:22.663", "lastModified": "2026-07-27T05:16:46.190", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64393", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ksmbd SET_INFO validates the SMB handle but runs path-based VFS permission checks with worker credentials instead of the opener's credentials.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5cbabf3a71575cd31bc7785d92d4ab42338a654b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b35afd5cf8fab236ef21117e42ee45691d4ffa7b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0ce682867fd506f61f40c76bde7e4205bde34e87", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/20ee516a62989a8d505ee432f9e59525ea23984e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8cc9ec711f5255167247a9ab6a7179b787426ed7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b383bcad3d2fe634b26efbce53e22bbb5753a520", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 687, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64394", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:39.797Z", "date_updated": "2026-07-27T05:00:24.660Z", "publisher": "Linux", "title": "ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0047, "percentile": 0.38207 }, "nvd": { "published": "2026-07-25T10:17:22.790", "lastModified": "2026-07-27T05:16:46.327", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64394", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ksmbd processes SMB2 SET_INFO SECURITY without requiring WRITE_DAC or WRITE_OWNER on the selected object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0848b1d8b403f530878195dcbe241a2fddb9d0e1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e6aa731f1b4b3e08caebf66a99f04b22bdab2e99", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9ab2ffd3ed3d4ca1667c52de27026ddabc11e537", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f56535db508ead8dec1c481ad93d7d8acd8f8f1e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aae600cdaffc6d9ce97645f129799a103a97d06d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/44df157a1183a7f746caa970c169255da5ac61f8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1734, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64395", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:40.393Z", "date_updated": "2026-07-27T05:00:25.842Z", "publisher": "Linux", "title": "ksmbd: require source read access for duplicate extents", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00406, "percentile": 0.33388 }, "nvd": { "published": "2026-07-25T10:17:22.923", "lastModified": "2026-07-27T05:16:46.473", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64395", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "ksmbd clones file contents from a source handle without requiring FILE_READ_DATA on that handle.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2d2ab6983620c2d60ce7db72133984ca3873b929", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/67bdad9cf01b25030e3bf00bbce6c309319d6663", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/db231af842868268839f9f9619c68cb27830d8be", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a10942af27832c2761d020863a46e79bebe0567d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cedff600f1642aa982178503552f0d007bc829c8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 543, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64396", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:40.993Z", "date_updated": "2026-07-27T05:00:26.968Z", "publisher": "Linux", "title": "ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00435, "percentile": 0.35785 }, "nvd": { "published": "2026-07-25T10:17:23.040", "lastModified": "2026-07-27T05:16:46.603", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64396", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "If the lock waiter is subsequently woken up but the work state is no longer KSMBD_WORK_ACTIVE (e.g., due to a concurrent cancellation), the cleanup path calls locks_free_lock(flock) without dequeuing the work from the async_requests list.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/367c42a611fe488b7b03f1f6737f4dee0e8b20a2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7703fd9aba1f2483c8e55f9ff73b7663e0761ed9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/463bbd79698513af4dad50fe1c573825f297ca2e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5aa1cb01155f96824003baf7997cdf1f150caba3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5c75275c0fc9a2deb0d8f5604edcb16f288171c8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d20d1c8ba5765d1d12eefc0aee6385ab3f240e1e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1268, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64397", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:41.620Z", "date_updated": "2026-07-27T05:00:28.217Z", "publisher": "Linux", "title": "ksmbd: serialize QUERY_DIRECTORY requests per file", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00477, "percentile": 0.38723 }, "nvd": { "published": "2026-07-25T10:17:23.160", "lastModified": "2026-07-27T05:16:46.740", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64397", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Concurrent QUERY_DIRECTORY calls replace a shared pointer to stack-private enumeration state while an earlier callback still uses it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1426fd79102539bc0ab5c8fced047ad4313b9908", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2a64dbf9c739ddf7a25a066507597bf89f8f73d2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/64dac2d486ec1eb18dc00968b16a230b6b75ec24", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fd22b039a5a05bc1d6818e9dcd1001fb432a829d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be6d26bf27499977c746abc163659915082348d8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 759, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64398", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:42.221Z", "date_updated": "2026-07-27T05:00:29.523Z", "publisher": "Linux", "title": "ksmbd: add a permission check for FSCTL_SET_ZERO_DATA", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00464, "percentile": 0.37869 }, "nvd": { "published": "2026-07-25T10:17:23.280", "lastModified": "2026-07-27T05:16:46.877", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64398", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SMB SET_ZERO_DATA path checks only share writability and not the handle's FILE_WRITE_DATA right before zeroing file contents.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/25377f369688dd0bd814dc8965ed26d44238ecaa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3072d82461f498c85daea8766e9d8bfbada31605", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ca53bb17f4e8232cfaece3953d3cef62c559b039", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/deffa929086d7902e30918adf3dd27ccfe9c08b1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3320ba068198adc144c89d6661b805acce01735b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1089, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64399", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:42.925Z", "date_updated": "2026-07-27T05:00:30.802Z", "publisher": "Linux", "title": "ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00491, "percentile": 0.3955 }, "nvd": { "published": "2026-07-25T10:17:23.397", "lastModified": "2026-07-27T05:16:47.010", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64399", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ksmbd duplicate-extents ioctl writes destination data without checking either share writability or FILE_WRITE_DATA on the destination handle.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/bf460ad5958d506492de4524a656439da3f99c51", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/620d133d469295ee7c017ca6aafac335f65c4a5a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9b9cf7e65cbeaae1b6636144bacee611cdd7a5d6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/baae7b39673ec21073a25e3d14f8feaada01d5df", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c917e4522d251071dde9871b9142d8ea1186ebfe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/388e4139db27a9e3612c9d356b826f5b1ff6a9e3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 755, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64400", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:43.655Z", "date_updated": "2026-07-27T05:00:31.935Z", "publisher": "Linux", "title": "ksmbd: prevent path traversal bypass by restricting caseless retry", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 8, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "max_cvss_observed_across_sources": 8.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00357, "percentile": 0.28392 }, "nvd": { "published": "2026-07-25T10:17:23.510", "lastModified": "2026-07-27T05:16:47.173", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64400", "family": "FILE_OBJECT_SELECTION", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The caseless retry treats a LOOKUP_BENEATH traversal rejection like a missing file and reconstructs a path outside the share root.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8c9a4f1327eb71efbf14842e7b8a6d965077eb67", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/54bab9ba5a9f156ffa9324fcbe5a356fd0242f95", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1067, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64401", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:44.361Z", "date_updated": "2026-07-27T05:00:33.097Z", "publisher": "Linux", "title": "smb: client: resolve SWN tcon from live registrations", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02636 }, "nvd": { "published": "2026-07-25T10:17:23.610", "lastModified": "2026-07-27T05:16:47.303", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64401", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A cached tcon raw pointer outlives the mount that owns it and is later dereferenced.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/51d18db392e5386a7bb9e816d611f14e600cca3c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aa3c0cab4b28c5007ec570c63e1d6ad6943ed0fd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/945b4a4a54497db1dcb2f20ef801a84e884dac21", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/91b8a58c6ac15c7db6518f696389933282f88da7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0700f946659d0ab2352ec8a9b1c6fc74b13a27d7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ec457f9afe5ae9538bdcd58fd4cb442b9787e183", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2013, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64402", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:45.075Z", "date_updated": "2026-07-27T05:00:34.312Z", "publisher": "Linux", "title": "coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02901 }, "nvd": { "published": "2026-07-25T10:17:23.737", "lastModified": "2026-07-27T05:16:47.443", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64402", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "smb_sync_perf_buffer derives its first destination page index from an unnormalized head value and writes beyond dst_pages.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/38dbc8db8341ccdf8e1e1a067453d33ad751864b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4c5a0a946373da99a80398289b28845b5ae40cd1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/661a019ac0413ecec9e5d1dfcc12fbca8e78d5fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/daf6246ab988fc8bdc82ad7c8d0b1c182d11b15f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/98495b5a4d77dd22e106f462b76e1093a55b29a7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 775, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64403", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:45.796Z", "date_updated": "2026-07-27T05:00:37.177Z", "publisher": "Linux", "title": "Bluetooth: L2CAP: validate option length before reading conf opt value", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 32, "versionRangeCount": 24, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00265, "percentile": 0.18236 }, "nvd": { "published": "2026-07-25T10:17:23.850", "lastModified": "2026-07-27T05:16:47.560", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64403", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "l2cap_get_conf_opt dereferences the attacker-sized option value before callers establish that the full option remains inside the packet buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/cca81b4bc672604a84f6d224a55cc77ec7dee619", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f70d4aa88068096f35d73e3a05eff33c0a16b9cd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7d871e969b941ce25653f7716203a0ea4d07ad4b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/98d93c226bdfaa79bbdd86981921d7f106374225", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/996d3da39899aceb8f4910911a3f19a45a7d9d1b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/73abbaf91aa33da87c008fb62c148ade561bb606", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6b47bdaacfd0045687880177e0987055d8f4765a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/687617555cedfb74c9e3cb85d759b908dcb17856", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1294, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 32 } }, { "cve_id": "CVE-2026-64404", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.785Z", "date_published": "2026-07-25T08:50:46.523Z", "date_updated": "2026-07-25T08:50:46.523Z", "publisher": "Linux", "title": "Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 11, "versionRangeCount": 10, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06423 }, "nvd": { "published": "2026-07-25T10:17:24.003", "lastModified": "2026-07-25T10:17:24.003", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64404", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "iso_conn_big_sync drops the socket lock and later dereferences conn without rechecking whether controller-driven teardown cleared it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b3e647a4aa4d2d054f86a783f5c426035e1dc237", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b84eeb7636d6962dd882d5e0b31475e4f404313c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/01afd198c2c286cd3b81f44d4e33a2e638711550", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d5541eb148da72d5e0a1bca8ecd171f9fc8b366f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1115, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 11 } }, { "cve_id": "CVE-2026-64405", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:47.262Z", "date_updated": "2026-07-25T08:50:47.262Z", "publisher": "Linux", "title": "Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 19, "versionRangeCount": 16, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06903 }, "nvd": { "published": "2026-07-25T10:17:24.110", "lastModified": "2026-07-25T10:17:24.110", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64405", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "hci_abort_conn dereferences hdev->sent_cmd while that pointer can be null even though the request status remains pending.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/903227b6168bb99fd57d4e3c9c1b5014986198e0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/83b22d7f7c384564fa42c3cf19bec715c693d7a2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/70c397b62ee015e19b3924d9da741c8dda017819", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/61701912c58a05f6a043f097cc177a964abef348", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b42cb640a0493d16b61ddd267420274be15efdc1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/12917f591cea1af36087dba5b9ec888652f0b42a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1767, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 19 } }, { "cve_id": "CVE-2026-64406", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:47.978Z", "date_updated": "2026-07-27T05:00:38.367Z", "publisher": "Linux", "title": "Bluetooth: fix UAF in bt_accept_dequeue()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 26, "versionRangeCount": 24, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8, "cvss_source_score_spread": 0, "epss": { "score": 0.00274, "percentile": 0.19591 }, "nvd": { "published": "2026-07-25T10:17:24.243", "lastModified": "2026-07-27T05:16:47.730", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64406", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Bluetooth dequeue drops its temporary socket reference before unlink drops the queue reference, allowing the final later hold to touch freed storage.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c0577c55219be42b6ea2ea8db11e85bfab6f4e8d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/96ad400d5132eb333f28f6f1e2d58f0728ca9547", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0a98ff4e7b867f72fbb4e1237d81e9fa02ded0a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c66a95e60b65d876a927123b0ed36bd6177d9ca6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6303ed4bbe0095f4cc195225479bf506e010d1db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/26168db1ce5a9766cde021b18e590a101c056614", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/50c662bdcd51b03033a0abed6716bfd377ba1049", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4bd0b274054f2679f28b70222b607bb0afc3ab9a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 661, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 26 } }, { "cve_id": "CVE-2026-64407", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:48.912Z", "date_updated": "2026-07-25T08:50:48.912Z", "publisher": "Linux", "title": "Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06417 }, "nvd": { "published": "2026-07-25T10:17:24.407", "lastModified": "2026-07-25T10:17:24.407", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64407", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "nxp_recv_fw_req_v3 checks only an offset's lower bound and sends offset-plus-length data without verifying that it remains inside the firmware image.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/21e60eb4d95854196e7c0e77383f35e7ac95df61", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/441088792ffec3ca01f4efe2934060570eb11eb8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2a68a773089204af1c8581dc79668b775418c5ee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/49bcb39e3a041ce26021f77971eaccb49a275118", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/badff6c3bed8923a1257a853f137d447976eec30", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1044, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64408", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:49.807Z", "date_updated": "2026-07-27T05:00:39.563Z", "publisher": "Linux", "title": "Bluetooth: bnep: pin L2CAP connection during netdev registration", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00262, "percentile": 0.1791 }, "nvd": { "published": "2026-07-25T10:17:24.517", "lastModified": "2026-07-27T05:16:47.873", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64408", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "bnep_add_connection reads an L2CAP connection without pinning it while controller teardown can free the same parent before netdev registration uses it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/390b5db3ff8745187f094c4e915663b7b1f98944", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/46a88784c4c9b96954dd86f747ce93f65efa1302", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/551ae773ec64045b4e72099132654887e0270bcc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ae215c5b6422d8eda443b861b124bd1be6969c31", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/df22adc7eafc22e651561813c11dc51a796b12ee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a6b22dbd80926556290ad2243be25218d6956a19", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/563a8573047182f550b1e1e030615755cd8c41da", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bb067a99a0356196c0b89a95721985485ebce5a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 568, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64409", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:50.604Z", "date_updated": "2026-07-25T08:50:50.604Z", "publisher": "Linux", "title": "Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06901 }, "nvd": { "published": "2026-07-25T10:17:24.633", "lastModified": "2026-07-25T10:17:24.633", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64409", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An OR condition makes the timeout predicate permanently true, so the loop retains the host lock and never terminates.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f6682c23b6fac4780d297ae4662053d17e58fd52", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/466540e045d01fcacf383a5beb8a2dad2fc53a26", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7b429d611060e87752e848851815537963726493", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0039bdde36b23ccf1196635f1d52c5490481544d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0f0a83e26a9c7fd4b243c315ce07161d2496d83d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a257407e2bbbb099ed427719a50563f67fa366d8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1210, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64410", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:51.377Z", "date_updated": "2026-07-27T05:00:40.745Z", "publisher": "Linux", "title": "netfilter: flowtable: IPIP tunnel hardware offload is not yet support", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0038, "percentile": 0.30707 }, "nvd": { "published": "2026-07-25T10:17:24.753", "lastModified": "2026-07-27T05:16:48.003", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64410", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SOURCE_TRACED", "confidence": "high", "mechanism": "The flowtable path queues unsupported IPIP tunnels for hardware offload and gates retries only after the unsupported work has been enqueued.", "basis": [ "CNA", "Linux upstream patch" ], "deepDive": true, "notes": "Read the upstream Linux patch via the kernel source mirror https://kernel.googlesource.com/pub/scm/linux/kernel/git/axboe/linux/+/6c5dcab95f4cd42a1648739ec9300fbb4b1a021f%5E%21/ after git.kernel.org presented an anti-bot gate; the diff adds an explicit IPIP hardware-offload support check and moves NF_FLOW_HW retry gating, while the public patch does not state a security impact commensurate with the shard CVSS 9.8." }, "references": [ { "url": "https://git.kernel.org/stable/c/9efe838c13133acb70c78d04c49e8362fe533566", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c5dcab95f4cd42a1648739ec9300fbb4b1a021f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 869, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64411", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:52.143Z", "date_updated": "2026-07-27T05:00:41.895Z", "publisher": "Linux", "title": "netfilter: ebtables: terminate table name before find_table_lock()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02654 }, "nvd": { "published": "2026-07-25T10:17:24.853", "lastModified": "2026-07-27T05:16:48.123", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64411", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ebtables path consumes a table name without guaranteed NUL termination and can read beyond the user-supplied buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/4c046ca4e35a83ea32f6e748f54139f5fe2a1d01", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ab63ccefb9c71627f957a0724c2b9ebc869c6f20", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c6f539311e58e76aa96feef0f1572b13a564f8a2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2664f537ca5bcb2ef3fac2683dcca602e51fad24", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7436da6c1bc44654b7f11a17e746f6999fd37250", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b6183b1b88a722b6d8ea0cecc99eba168a15e0be", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a622d2e9608c9dff47fc2e5759ac7aa3a836b45d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1390, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64412", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:52.946Z", "date_updated": "2026-07-27T05:00:43.047Z", "publisher": "Linux", "title": "netfilter: ebtables: module names must be null-terminated", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02654 }, "nvd": { "published": "2026-07-25T10:17:24.990", "lastModified": "2026-07-27T05:16:48.263", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64412", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "ebtables passes an attacker-influenced module-name buffer to request_module without first requiring a terminating NUL byte.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/43dd2332b8a27b3ac5108791680cade654ab0f96", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5777c8f1c3610786d8482b8f620f40fccaf1542b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0ddca0f90fa3395111d078ae4399615cf3ea94aa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d2367d99f2455f373996d9ddbe833dbe9f942213", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/da32e78bbb187ed7b137e0007034185570a3a172", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/13a5f532e3a4fc75c33060a026def1572c208643", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7b217960e88b5d2d1e8cdcbcaf3bdf6fe199a0c8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/084d23f818321390509e9738a0b08bbf46df6425", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 232, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64413", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:53.759Z", "date_updated": "2026-07-27T05:00:44.228Z", "publisher": "Linux", "title": "netfilter: ebtables: zero chainstack array", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7, "cvss_source_score_spread": 0, "epss": { "score": 0.00122, "percentile": 0.02298 }, "nvd": { "published": "2026-07-25T10:17:25.110", "lastModified": "2026-07-27T05:16:48.390", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64413", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A sparse CPU mask leaves an uninitialized chainstack pointer that an allocation-failure cleanup path can free.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2ade612967e2cdfb9290ebcb773f302c82f311fa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/42bef500d07b5769d916e9122a3e3fa3fd2245ef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fc7f105451044501a50cfd530cfa3b472c54acbc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9e6c5169db423e51dcc66a73fd15409c0d38e088", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/29bf41a9b59aff9f6197df58641a00037d567ca8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9f74d28e903fa4fdf82f870d0aeadddc8196e41c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5ee856e4208acafaaaf7b84824d39b78c21345d6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cbfe53599eebffd188938ab6774cc41794f6f9d5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 575, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64414", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:54.495Z", "date_updated": "2026-07-27T05:00:45.364Z", "publisher": "Linux", "title": "netfilter: handle unreadable frags", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00441, "percentile": 0.36229 }, "nvd": { "published": "2026-07-25T10:17:25.237", "lastModified": "2026-07-27T05:16:48.540", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64414", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Several netfilter paths continue handling fragment payload after skb_copy_bits() reports that the fragments are unreadable instead of dropping or limiting processing.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3b13e7635795394705920cca1e1db7e4ca2e334b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fc5bfe63bacf8a3ae307b62b34206406ca733354", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57056be3ec12e7d9ecd20a60d4060f510e4f284c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/da5b58478a9c1b85608c9e40a3b8432d071b409e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 666, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64415", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:55.226Z", "date_updated": "2026-07-25T08:50:55.226Z", "publisher": "Linux", "title": "mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06418 }, "nvd": { "published": "2026-07-25T10:17:25.343", "lastModified": "2026-07-25T10:17:25.343", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64415", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "swap_reclaim_full_clusters() can scan a very large full-cluster list without cond_resched(), monopolizing a CPU until the watchdog reports a soft lockup.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/60cbe67d1342f34b66df1c2ee328e3cd333767d7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/69c0e6246575b780ae0d3f411c749bcf13c221f3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2a55fdf9f746a1a6ced7fd62ea1080b8a917e0b0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/66366d291f666ddeda5f8c84f253e308de3e6b55", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1342, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64416", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:55.997Z", "date_updated": "2026-07-25T08:50:55.997Z", "publisher": "Linux", "title": "mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06416 }, "nvd": { "published": "2026-07-25T10:17:25.453", "lastModified": "2026-07-25T10:17:25.453", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64416", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "On a swapless host, lookup_swap_cgroup_id passes an unregistered null map to the lookup helper for a corrupted swap-like PTE.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/818416fef38759f23210de449663cd9d7e293d39", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b415c00bf23df577a4a95673d00ae76687bcc1d4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6a4196d19f477524d2f92adca90fc1fbe9a0420a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/63b02a9409cb5180398491b093e48bcb5315f5fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1556, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64417", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:56.800Z", "date_updated": "2026-07-25T08:50:56.800Z", "publisher": "Linux", "title": "mm: shrinker: fix NULL pointer dereference in debugfs", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06904 }, "nvd": { "published": "2026-07-25T10:17:25.567", "lastModified": "2026-07-25T10:17:25.567", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64417", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "debugfs creates scan and count files without checking that the corresponding shrinker callback exists, allowing a call through a null function pointer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ebb45c2648b1f60715fd283700f651e05e431231", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/09d2407985b8ce3e831f9d4310fe7ac06a6b3ae9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/36f8534f461222291a74156ab91f3ba9f09b6f93", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/006467ab932698612398f853344a7405164541f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b9beed2322f3538b0d2d53307062da4102b8d8d8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e30453c61e185e914fde83c650e268067b140218", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1117, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64418", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:57.594Z", "date_updated": "2026-07-27T05:00:46.575Z", "publisher": "Linux", "title": "mm: shrinker: fix shrinker_info teardown race with expansion", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00125, "percentile": 0.02601 }, "nvd": { "published": "2026-07-25T10:17:25.727", "lastModified": "2026-07-27T05:16:48.697", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64418", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Shrinker teardown drops shrinker_mutex while expansion can still copy and later free the same published shrinker_info array.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b9a280a9a454ed514636351d53fe2a233dc5054b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6465ff3ce65131c774a312d450abe10f4b9f3875", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/284c267f013e45d8c89d9fb9373105dc8e6c0947", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/65476d31d8056e859c48580f82295ce159196ffe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2234, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64419", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:58.342Z", "date_updated": "2026-07-25T08:50:58.342Z", "publisher": "Linux", "title": "mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06902 }, "nvd": { "published": "2026-07-25T10:17:25.847", "lastModified": "2026-07-25T10:17:25.847", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64419", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The shrinker debug path invokes a callback that can sleep while inside an RCU read-side critical section.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/de5f69b8dae8698ac5e48dfcd30017887cdf4e5a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e441cbfbd0eaa6404278e985033c33caba4db767", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2fed79f0fe8c8d28a972c290dbfd693c3546c8c4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/560e21e8ccff813e84d05f6500907c549a3d6985", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/86237e56091e70f09c0fbf217f9d9c0e08f556c4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b902890c62d200b3509cb5e09cf1e0a66553c128", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1251, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64420", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:59.115Z", "date_updated": "2026-07-27T05:00:47.741Z", "publisher": "Linux", "title": "mfd: cros_ec: Delay dev_set_drvdata() until probe success", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7, "cvss_source_score_spread": 0, "epss": { "score": 0.00118, "percentile": 0.02009 }, "nvd": { "published": "2026-07-25T10:17:25.963", "lastModified": "2026-07-27T05:16:48.827", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64420", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Probe publishes drvdata before initialization succeeds, allowing subdrivers to retrieve and use the pointer after failure frees its cros_ec_dev object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/24522713034d521ea4b5f5f36342e2b2f7e73bd6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f7e81dc181d9fe8ab977158042cd193e8cc12091", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/257203d83204b192d1265a916b42ca0d499bb117", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/729ae27dc2503a7c1f92da1859efb45da03e4fa0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ed2941e5db016a0c600b25f1972620e6e223d9fa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b5f41d5bf08e7b1b14fa0bd640975e6d78dc006d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fc030c5b116f668d4ca86dca63742ddbc98d1665", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8b2c1d41bc36c100b38ce5ee6def246c527eaf8a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1349, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64421", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.786Z", "date_published": "2026-07-25T08:50:59.926Z", "date_updated": "2026-07-25T08:50:59.926Z", "publisher": "Linux", "title": "media: nxp: imx8-isi: Fix use-after-free on remove", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06419 }, "nvd": { "published": "2026-07-25T10:17:26.097", "lastModified": "2026-07-25T10:17:26.097", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64421", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The remove path frees crossbar pads before unregistering media links that still reference those pads.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d22fb719654bfde6f682c9f14629f5f9534175b7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ba2aa5d325270cd965c44458c5ff5ab555e6af51", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ef382a6baf0a95cf199fdf6bba2fd08e58b0a249", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c12a5b2261351cd3b03921ce4720332ff5184b50", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b670bf89824ede5d07d20bb9bfbafb754846081d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1407, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64422", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:00.671Z", "date_updated": "2026-07-27T05:00:48.900Z", "publisher": "Linux", "title": "net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00132, "percentile": 0.03164 }, "nvd": { "published": "2026-07-25T10:17:26.213", "lastModified": "2026-07-27T05:16:48.970", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64422", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A negative TCP reordering value wraps to a large unsigned value and overflows the MTU probe size calculation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f0d88a4cd03affff6c08adf6c63964e235aede43", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/27ddf4486c7dbf5bdd393fa8bef6b67179796d98", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/782708ca1ea1f68b8cbb5ea3a7f5f18d0000efae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e81f805824a8109504fce090641b17d135b48cd1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/99206ce2244f8a3ed64298d0667c9055845a5dc7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bbae351c0f32f7c200249e4aa6561b2b419dcf69", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a094ac95d3b69adfa1676eb9c8eae6835d4f1671", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/efb8763d7bbb40cff4cc55a6b62c3095a038149c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1090, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64423", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:01.485Z", "date_updated": "2026-07-27T05:00:50.059Z", "publisher": "Linux", "title": "ipv4: igmp: remove multicast group from hash table on device destruction", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02636 }, "nvd": { "published": "2026-07-25T10:17:26.350", "lastModified": "2026-07-27T05:16:49.113", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64423", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Device destruction schedules multicast memberships for reclamation without first unlinking them from the hash table traversed by RCU readers.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/412ba7def06ffe974ba9a1d862b022362c54ffa5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c6cb5f8ebe1c1a78710c19f102db9fe48b9e6ba9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5f42729d74bd6c61306d864423290d92962de4e1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/76d030ac95e17f91d69a595f17ebc5979700cf9a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8820b530cb2388503d7418228d03ba074bf7a03e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2ca18df1c2611f70eb3eb487e02ae85eb703b284", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f91883031e5a62877a29ce139442973cbea769f1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7993211bde166471dffac074dc965489f86531f8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1834, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64424", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:02.276Z", "date_updated": "2026-07-25T08:51:02.276Z", "publisher": "Linux", "title": "netpoll: fix a use-after-free on shutdown path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06419 }, "nvd": { "published": "2026-07-25T10:17:26.483", "lastModified": "2026-07-25T10:17:26.483", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64424", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Netpoll cleanup frees npinfo after a non-synchronous work cancellation, allowing the pending TX worker to resume and dereference the freed object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/95ecc5b58042f6b6743b589e6588f1cd7ba336aa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a33f37f8d079da7236ed7b7e2aed2a34ab81e7cf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5ed09a108d93a3b002cc79823d9455b50c4a8be7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/45f1458a85017a023f138b22ac5c76abd477db42", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1804, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64425", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:03.036Z", "date_updated": "2026-07-25T08:51:03.036Z", "publisher": "Linux", "title": "io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 24, "versionRangeCount": 23, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07409 }, "nvd": { "published": "2026-07-25T10:17:26.600", "lastModified": "2026-07-25T10:17:26.600", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64425", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The io-wq worker snapshots the exit bit once for a linked-work chain and continues later linked items after exit begins.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/14b7ecad2ec56699325180a744f4b19f046401bb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d179533c610e1b4c6aa436e3c1fd1b719d2c727c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6e2f51f3e06773c2ee98ad09738f0908b48f76f9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ea61b04e1d7242cb37f5ed2cc91cf21a493f6597", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b6f179a653a934736c88d820fe0098c3c2532549", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1636d85dc139b07c0449308f2bb5e0c7a2e0da99", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ab85765cbe3258b43dc6729af0e6ce3a87a133d8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/29bef9934b2521f787bb15dd1985d4c0d12ae02a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1012, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 24 } }, { "cve_id": "CVE-2026-64426", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:03.867Z", "date_updated": "2026-07-25T08:51:03.867Z", "publisher": "Linux", "title": "io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06238 }, "nvd": { "published": "2026-07-25T10:17:26.737", "lastModified": "2026-07-25T10:17:26.737", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64426", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "io_uring marks a NOP as fixed-file from one flag but acquires a normal file reference from another, causing completion to skip the required put.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/722869fcff598fad20d5ab79c305897a7534708b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7267717f35787167fcce4bc14f6ef3fa06682dcf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2564ca2e31bd8ee8348362941af2ee4671e487ca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1238, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64427", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:04.686Z", "date_updated": "2026-07-25T08:51:04.686Z", "publisher": "Linux", "title": "HID: logitech-dj: Fix maxfield check in DJ short report validation", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.05212 }, "nvd": { "published": "2026-07-25T10:17:26.843", "lastModified": "2026-07-25T10:17:26.843", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64427", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An error path dereferences field zero even when maxfield is zero and no field exists.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/7a89ad762fad53d56b7002d7ffc923a4b7f4006f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/590cc4d782487632a52f37c2171bee1eeea29627", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1505, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64428", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:05.460Z", "date_updated": "2026-07-25T08:51:05.460Z", "publisher": "Linux", "title": "gpio: sch: use raw_spinlock_t in the irq startup path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.069 }, "nvd": { "published": "2026-07-25T10:17:26.947", "lastModified": "2026-07-25T10:17:26.947", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64428", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SCH GPIO interrupt startup path takes a PREEMPT_RT sleeping spinlock from a non-sleepable callback.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3b1aa05ec27eeccc889ecaa3f2d9baa9f453e50d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4f03a15cc73c83740fc355ee22b336492d17b4da", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7a550256d68bbdfa0903ab1c4595c04a6815493a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a235cec779bb39ec8f961a935b28a2ce278c6c64", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4508366ab7dd0c2917a51a9c2e23cc1b9d35157a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/41cad91a09d69e8fff4e936db29b1054b4e9f9f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/286533cb14a3c8a8bd39ff64ea2fc8e1aa0f638b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1419, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64429", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:06.016Z", "date_updated": "2026-07-25T08:51:06.016Z", "publisher": "Linux", "title": "gpio: eic-sprd: use raw_spinlock_t in the irq startup path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07406 }, "nvd": { "published": "2026-07-25T10:17:27.070", "lastModified": "2026-07-25T10:17:27.070", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64429", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Spreadtrum GPIO IRQ-startup path uses a sleeping lock while executing in atomic interrupt context.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/96612bf2712cd961dbd9b52f3a9b4ab668f57628", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/581ac2ad001ff1128931191f249a7f2074672b7a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e244cd8b51001ba480f274c44dba9002813a4739", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/19d63fd528719ce7d06d9aeb88d25b7d6478198a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6112fba4150039ccd90e29f2d1b788c73ad7b3dd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4750909a40da9016185e0ac991510a278cecb1e7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5c3c9ec1172a4c3384b8b800b3a8896cc2c1b20e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/90f0109019e6817eb40a486671b7722d1544ae29", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1332, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64430", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:06.612Z", "date_updated": "2026-07-27T05:00:51.212Z", "publisher": "Linux", "title": "NTB: epf: Avoid calling pci_irq_vector() from hardirq context", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0049, "percentile": 0.39476 }, "nvd": { "published": "2026-07-25T10:17:27.203", "lastModified": "2026-07-27T05:16:49.260", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64430", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The NTB interrupt handler calls pci_irq_vector in hard-IRQ context even though the downstream path acquires a mutex and may sleep.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/33bba331a4a5fee8b6026fe72eca13cceeec1b7b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aff271b12a1eb8c8b3da19223ae1a6abe1e8168b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1dba8444ac0100133d72374634f6d7451fff1ccc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/174a97f21bf9c54fa37ec0f321692e862ea130a3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f71e8d9875069fa73e335f63f02ec6e52e3aaa51", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6350df503897d57c5634f71b0767d48c3b837583", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4dcddc1c794d1c65eda68f1f8dd04a0fecc0870f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1009, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64431", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:07.194Z", "date_updated": "2026-07-27T05:00:52.351Z", "publisher": "Linux", "title": "ntfs: avoid calling post_write_mst_fixup() for invalid index_block", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00123, "percentile": 0.02466 }, "nvd": { "published": "2026-07-25T10:17:27.327", "lastModified": "2026-07-27T05:16:49.397", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64431", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "After pre_write_mst_fixup rejects an invalid NTFS index block, the caller still invokes post_write_mst_fixup and accesses attacker-controlled offsets out of bounds.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e2018628301a6d9f54e34b0cb417f1688c66df1d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5b6eedd7cc2936f9238e852b553a1b326105bde8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2744, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64432", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:07.791Z", "date_updated": "2026-07-27T05:00:53.540Z", "publisher": "Linux", "title": "fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00135, "percentile": 0.0338 }, "nvd": { "published": "2026-07-25T10:17:27.437", "lastModified": "2026-07-27T05:16:49.527", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64432", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "NTFS journal replay copies attacker-counted LCN entries into a smaller Dirty Page Table array without validating capacity or VCN subtraction.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/964c3fae1dfc49dde5468eace940f199cda234e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3aa96956ca2200674e2a8f9c23ec6ecd45e5010f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/946046841013ebac8492ef49651c53638d7a9a6a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c6f9e804f73ef809529865fbc7256dd189ff8c33", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cf28fc1658463d768657cf1c27a83980d4ba7ef2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f433acc85b86f327d03ba8b03a33c105c51053de", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57382ec6ac63b63dce2789e835fded28b698ae79", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1224, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64433", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:08.432Z", "date_updated": "2026-07-25T08:51:08.432Z", "publisher": "Linux", "title": "Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 14, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06415 }, "nvd": { "published": "2026-07-25T10:17:27.567", "lastModified": "2026-07-25T10:17:27.567", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64433", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Bluetooth reads connection parameters without the device lock while a concurrent remove operation can delete and free the same object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/caed4a96d55757c139a899744657c032b6186665", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e4369e4e970f3fa4676b76be14c1d315c87f22b6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b346efa825b5e4386f19bc63f81141652d496ec4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9531014c60c804e16099885d4a98aedcf31bce8d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fa85d985f614bc3feb343000f14a1072e99b0df1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3998, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64434", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:09.066Z", "date_updated": "2026-07-27T05:00:54.711Z", "publisher": "Linux", "title": "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 23, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00247, "percentile": 0.15996 }, "nvd": { "published": "2026-07-25T10:17:27.717", "lastModified": "2026-07-27T05:16:49.667", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64434", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An asynchronous L2CAP channel timeout retains chan->conn without a reference, so connection teardown can free it before the timeout locks it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3998, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 23 } }, { "cve_id": "CVE-2026-64435", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:09.688Z", "date_updated": "2026-07-27T05:00:55.915Z", "publisher": "Linux", "title": "audit: Fix data races of skb_queue_len() readers on audit_queue", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00424, "percentile": 0.34935 }, "nvd": { "published": "2026-07-25T10:17:27.873", "lastModified": "2026-07-27T05:16:49.843", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64435", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Audit queue length readers access qlen without a lock or READ_ONCE while dequeue updates the same field concurrently.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/69f98fff30bdaa72b0cb0e7e078ab6456a0a59b0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b35597bdae1a5d8395da4b9baa993b9b71f74d68", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e575dabb805252e3113fdc3f56f6ecacfde422d0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7ff42312ccde549f8c698723822c7db35107a39b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a3d85dec60bb0622360fc176b2a51abdbe2ff0ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fe997a84a385f840b593ead92e575503a5046cee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c5186201fa7030289cc4fe23fae87a3fcb566856", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c9a71daaecb2fb1d8c704545cc0b1c920b9bf5d7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1726, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64436", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.787Z", "date_published": "2026-07-25T08:51:10.370Z", "date_updated": "2026-07-27T05:00:57.092Z", "publisher": "Linux", "title": "net: af_key: initialize alg_key_len for IPComp states", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00119, "percentile": 0.02109 }, "nvd": { "published": "2026-07-25T10:17:28.010", "lastModified": "2026-07-27T05:16:50.033", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64436", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "PF_KEY leaves the IPComp algorithm key length uninitialized and a later clone uses the garbage value to read past the allocation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/58e82fc3dedb57b1432292504415b224fd2d6acb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/01b9115b55018123ef2449ac4951f89147a8428e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3f63d1752d90c0e28be931a48ab5d89bc97d637d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/273c06b81d2e902b21acc801ae18c8276c8a9b69", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6de2a650917bedaaefd65b17cede83c5e2c1dedd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e8417353cbd078d10531ba3928e609c84ab09e6b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cea34abc94b0a81e3a8b5cfb41cf45af37c2c67e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d129c3177d7b1138fd5066fcc63a698b3ba415b0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3023, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64437", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:11.072Z", "date_updated": "2026-07-27T05:00:58.240Z", "publisher": "Linux", "title": "ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00435, "percentile": 0.35785 }, "nvd": { "published": "2026-07-25T10:17:28.160", "lastModified": "2026-07-27T05:16:50.213", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64437", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Cancellation guards only the CANCELLED state, so work already CLOSED can fire a freed cancellation target again.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a796ba4e61d5e14e07b79a359faac69f8f9b22a3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b8e274e69ab09222c7a552c7c0c1eef9ce627fc1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ddb9239828336b36d8a3ef5943fdffb2f55b6508", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/94083db751930b1540ddff2b54d4677549c57f81", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/12c36c99655f325befe50c26842f7deca414c381", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/10f293a07f9e10e988b0ae44e2e99c631f5a68e0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2202, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64438", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:11.740Z", "date_updated": "2026-07-27T05:00:59.389Z", "publisher": "Linux", "title": "crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00135, "percentile": 0.0337 }, "nvd": { "published": "2026-07-25T10:17:28.303", "lastModified": "2026-07-27T05:16:50.363", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64438", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SR-IOV teardown frees per-VF state before queued VF2PF workers and interrupts have stopped using its raw pointer.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1750, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64439", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:12.422Z", "date_updated": "2026-07-27T05:01:00.563Z", "publisher": "Linux", "title": "crypto: krb5 - filter out async aead implementations at alloc", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0043, "percentile": 0.35368 }, "nvd": { "published": "2026-07-25T10:17:28.447", "lastModified": "2026-07-27T05:16:50.527", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64439", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Synchronous Kerberos AEAD helpers accept an asynchronous implementation, treat EINPROGRESS as terminal, and free the buffer while the backend still uses it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ef6feb77e2d91761427c5b773edc9c97e1b706ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2b7bd6dccff14b8b632c5244f1fd506918077221", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c9dddeb582fde005360f4fe02c760d45ca05fb5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1093, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64440", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:13.138Z", "date_updated": "2026-07-27T05:01:01.733Z", "publisher": "Linux", "title": "staging: rtl8723bs: fix OOB write in HT_caps_handler()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00266, "percentile": 0.18331 }, "nvd": { "published": "2026-07-25T10:17:28.547", "lastModified": "2026-07-27T05:16:50.640", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64440", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "HT_caps_handler copies an untrusted 802.11 element length into a fixed 26-byte array without truncating the iteration count.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/37f642d47c3648a707df3ceb092eee1adffbfd28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8c872b47c7fc32e95e0da1db7512388794adcd69", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bb3b942da4123b55d1cacf19d1a7d5ba15dbf83a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/918537a0fbed85aab61fa28ad75e6279070610c9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6f91621fc45025ad3c0be796b70e6e4cee22fc69", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/225b6d3fc7e99ac3d20b6c861d1e47d24e7ea31d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f8001e1a516ba3b495728c65b61f799cbfad6bd0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 970, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64441", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:13.834Z", "date_updated": "2026-07-27T05:01:02.935Z", "publisher": "Linux", "title": "staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00256, "percentile": 0.17211 }, "nvd": { "published": "2026-07-25T10:17:28.670", "lastModified": "2026-07-27T05:16:50.777", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64441", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The rtl8723bs IE parsers read headers, OUIs, and attributes without first checking that the required bytes remain in the buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/efa27d487abcdec79669a60a6d94d5d6eceb7c1d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2ea1ce30ead61589214240e8d33d96310fd613e5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b27ecba3196f6c14e3809595ebd69c0c2392512a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4b51ee8a40fe47864197d73cc02b191de7a6b072", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/729c4e72563bda0f1725db1db9ea08df06f41d9b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1230, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64442", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:14.535Z", "date_updated": "2026-07-27T05:01:04.117Z", "publisher": "Linux", "title": "staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00286, "percentile": 0.20842 }, "nvd": { "published": "2026-07-25T10:17:28.793", "lastModified": "2026-07-27T05:16:50.923", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64442", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Two rtl8723bs information-element loops read the length byte before checking that a complete element header remains.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/bc881c9915c4468747d0ca5fd1abd7b313cfb0f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/605ebd94d0f469204f3c9f2f84acc71e43e2780f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a830bdc82461353bf7b1f8a2ad2689bf5d2de444", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4c21eec80cf502d9ea18e0b946246b2376452786", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ad2637c46ef8b8ae0894372a2d39fdfcdc420a1e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c38d16b1ffac385c9e4b38447cd5c46af1114b58", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/402f13ec95945f34a210b28df1f8740d3d4a58c5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ef61d628dfad38fead1fd2e08979ae9126d011d5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 913, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64443", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:15.234Z", "date_updated": "2026-07-27T05:01:05.323Z", "publisher": "Linux", "title": "staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0028, "percentile": 0.20184 }, "nvd": { "published": "2026-07-25T10:17:28.930", "lastModified": "2026-07-27T05:16:51.063", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64443", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "update_beacon_info reads the final information-element length byte and payload without confirming that the header and declared data remain inside the beacon buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6dd5e8c3011ebabf417257d7f07901a7c4311539", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9193c34f75fd9e1ea8a590d7cced464c3380dc29", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bd953d52d587d42365e399b96c52dbdb13032070", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/69f174a0673b6b7a29b851adb60bc450cdc0ecc4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b5cc2f999927f69723ca53f1f2a3aa37dbeda907", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ed51de4a86e173c3b0ef78e039c2e49e08b11f16", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 923, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64444", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:15.968Z", "date_updated": "2026-07-27T05:01:06.448Z", "publisher": "Linux", "title": "staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0028, "percentile": 0.20184 }, "nvd": { "published": "2026-07-25T10:17:29.053", "lastModified": "2026-07-27T05:16:51.200", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64444", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "OnAssocRsp reads an information-element length before ensuring the two-byte header and declared element body remain inside the received frame.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/889ca6000ac7fa73457b041848fcb08e0d51b809", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1a52a05471494546f955a58e8c170c0c796c52d5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0406d746574e875d8778552eb674fcfbf5330bfb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0970dd47726a57e52013594e9fbf667586eb3673", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/04f612dc03427e0b1ac80a2611b5ac0ba93ac446", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7e7741c8315e4160aead00a60cdd6f81ab880717", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f9654207e92283e0acac5d64fe5f8835383b5a23", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 834, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64445", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:16.670Z", "date_updated": "2026-07-27T05:01:07.584Z", "publisher": "Linux", "title": "staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00316, "percentile": 0.24016 }, "nvd": { "published": "2026-07-25T10:17:29.177", "lastModified": "2026-07-27T05:16:51.337", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64445", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A short WEP element underflows its length to size_t and then drives a fixed 128-byte comparison beyond the element.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/665e1ecb68b4e8419604e70a33f02d1c8b0222c6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/87cccc2a767f17dcab71e3b9fe5ae29b5516c5ce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c9000c93078e5c0a5a651b077c0ec92a4bc7d580", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1f6c9d255bdda41216b6e34c96aa2b1abee0bb84", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3e44a7665f3abd320a80d9c64ee4a93317041b8b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/64ec4192d9c10e96922245d4a6747304cc76b19d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d90b9f39f375c9826ef145605dfe97765d0ecb91", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a1fc19d61f661d47204f095b593de507884849f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1086, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64446", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:17.402Z", "date_updated": "2026-07-25T08:51:17.402Z", "publisher": "Linux", "title": "staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00195, "percentile": 0.09394 }, "nvd": { "published": "2026-07-25T10:17:29.310", "lastModified": "2026-07-25T10:17:29.310", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64446", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The Linux path computes or trusts a write extent that can exceed the destination buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a94a643a80a84ceb8139061c3d6bf988d75e45a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2131621986c62c86109ce4d84cf73a73757eb8a6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6f20d7b0ee47c470734a69379b0fc6647c519603", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5d7812360abf3143afcbf5efe4ef242448fa1f28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/46f66c16a95191d9aca07a72ae6b1252a244e26c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b9c4bf133c3c47e23baf4f5403b98a953bf58606", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/138cd190efd56ab36c9fdd8fef8749d06937f24b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5a752a616e756844388a1a45404db9fc29fec655", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 941, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64447", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:18.096Z", "date_updated": "2026-07-27T05:01:08.819Z", "publisher": "Linux", "title": "staging: media: ipu7: fix double-free and use-after-free in error paths", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00133, "percentile": 0.03219 }, "nvd": { "published": "2026-07-25T10:17:29.437", "lastModified": "2026-07-27T05:16:51.487", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64447", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An ipu7 error path frees the same object twice and leaves a stale reference available for later use.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b5ddc7257bee71f5b8cf9083e2b0ac0427e9fbb3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/837c1f9655421055f751ed34745e820a54a27642", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d3a9a8cf2d7fd61a2f63df61f6cbc0a9bb007cc0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1500, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64448", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:18.796Z", "date_updated": "2026-07-27T05:01:09.984Z", "publisher": "Linux", "title": "smb: client: restrict implied bcc[0] exemption to responses without data area", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00463, "percentile": 0.37799 }, "nvd": { "published": "2026-07-25T10:17:29.557", "lastModified": "2026-07-27T05:16:51.610", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64448", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "SMB accepts a response one byte shorter than its declared length even when it carries a data area, allowing subsequent decoders to read beyond the receive buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8d0bbc78046d264bbf6a574ea6f9072258a43e35", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b6a381c01e2ac98a48e32ac0f2a45bbadd9e26b0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/31c6312608c60b72a1feb99a5afb680645a3e8a3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/573e502d14714d2947e22e7eff40ec20a6a44a42", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/419ec1b604d7fb60c10aec2dc062371f9fcd4940", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ceb875a375dedbf51c9425c1d13a2d7a8435c08c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6e9d10f62773b99bd927940fd9cbdfe7207e23ff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/53b7c271f06be4dd5cfc8c6ef552a8355c891a7f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3998, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64449", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:19.537Z", "date_updated": "2026-07-27T05:01:11.154Z", "publisher": "Linux", "title": "staging: vme_user: bound slave read/write to the kern_buf size", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00139, "percentile": 0.03689 }, "nvd": { "published": "2026-07-25T10:17:29.727", "lastModified": "2026-07-27T05:16:51.783", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64449", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "VME slave reads and writes bound count to the VME window but not to the smaller fixed kern_buf allocation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/adc8b9c30d716c362646edb45662aa1c641a154a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8eff7cd4817e14dbe3b9952cce55ef52d1d38940", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e99f2df433c63c86c93de1e5f08f16e404388756", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1b495fa0d4927c88d88bf346bf311f2e26e860ed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9f32f38265014fac7f5dc9490fb01a638ce6e121", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1519, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64450", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:20.319Z", "date_updated": "2026-07-27T05:01:12.346Z", "publisher": "Linux", "title": "tipc: fix out-of-bounds read in broadcast Gap ACK blocks", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00537, "percentile": 0.42234 }, "nvd": { "published": "2026-07-25T10:17:29.850", "lastModified": "2026-07-27T05:16:51.920", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64450", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The broadcast TIPC path checks a Gap ACK record against its own count but not the containing message size, then kmemdup() reads the attacker-sized record beyond the skb.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/055663d21dc4336f67933ab26bef3c5934be6324", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/016f5995c37a5a2c45198308f830f244517d70b7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/74b45af86a767594ba52330cd440ea84e24d700d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9a51115fcdc78687c8852bf93a1db3951dbb223b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a21ed5064217cc33726da6c7ef1a520eba43aea1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2de42e268174766cb2e2b90721afdfdff70e0d8d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f333b6851bdf326fd2134133272dbbed0c94d921", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2b66974a1b6134a4bbc3bfed181f7418f688eb54", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2462, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64451", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:21.020Z", "date_updated": "2026-07-25T08:51:21.020Z", "publisher": "Linux", "title": "tracing: Fix NULL pointer dereference in func_set_flag()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00162, "percentile": 0.05903 }, "nvd": { "published": "2026-07-25T10:17:30.013", "lastModified": "2026-07-25T10:17:30.013", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64451", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "func_set_flag() dereferences current_trace_flags before checking that the current tracer is the function tracer, allowing a stale option file to trigger a null dereference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/69f17ac132a38974cf1defb480cef6b79d1ab768", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c3e94604675e3db186111b8942650d86577df9b0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2210, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64452", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.788Z", "date_published": "2026-07-25T08:51:21.754Z", "date_updated": "2026-07-27T05:01:13.528Z", "publisher": "Linux", "title": "6lowpan: fix NHC entry use-after-free on error path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00219, "percentile": 0.12446 }, "nvd": { "published": "2026-07-25T10:17:30.140", "lastModified": "2026-07-27T05:16:52.080", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64452", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The 6LoWPAN error path drops lowpan_nhc_lock before reading nhc->name, allowing concurrent unregister to free the descriptor first.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9c2f5c0829a8c8b904dae36be6d8056b719ac605", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/80b5c8779acee0550845394fb3e5176a398aa24c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cc27aea4d454abfb385ee2c9499c78b96db9b728", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a8e3a94711134e898c6021a6b77374efa91b3639", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0beccbcf50de125be5520d0ffc59af4bb8655482", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b713aa0cc344f10f7a9928a230b5f5e780d04078", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1720db928e5a58ca7d75ac1d514c3b73fd7061a7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1319, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64453", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.789Z", "date_published": "2026-07-25T08:51:22.478Z", "date_updated": "2026-07-25T08:51:22.478Z", "publisher": "Linux", "title": "usb: misc: usbio: fix disconnect UAF in client teardown", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.07001 }, "nvd": { "published": "2026-07-25T10:17:30.273", "lastModified": "2026-07-25T10:17:30.273", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64453", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Reverse USB client teardown advances its list iterator through the current client after uninitialization can release and free that client.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c40090f8d19b415e2925b22be964b5d1f695666f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1947b6411460d68b54b13c536961933166937d05", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0bfeec21984fedd32987f4e4c0cde34b445af404", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3797, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64454", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.789Z", "date_published": "2026-07-25T08:51:23.212Z", "date_updated": "2026-07-25T08:51:23.212Z", "publisher": "Linux", "title": "usb: dwc3: run gadget disconnect from sleepable suspend context", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0018, "percentile": 0.07823 }, "nvd": { "published": "2026-07-25T10:17:30.407", "lastModified": "2026-07-25T10:17:30.407", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64454", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The DWC3 suspend path invokes a sleepable disconnect callback while holding a spinlock with interrupts disabled.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b399be2958456efe1b64b19c55a54a24e9035769", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/48958478cb8dbc429a5b19f36e866b63d6297d1d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5e5798880eb1533a7de6fb68eb14b2d8202ebf76", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e0e4f15d4225fb7156cc0e3c21eb8953114f9b89", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c4e232bd07fe2b69a6e5c380db41dd36b95e0524", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/642e04f5c292d04070ae6e4374fbf14cc40a2465", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/010382937fb69892b3469ac4d30af072262f59e8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1086, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64455", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.789Z", "date_published": "2026-07-25T08:51:23.952Z", "date_updated": "2026-07-25T08:51:23.952Z", "publisher": "Linux", "title": "USB: chaoskey: Fix slab-use-after-free in chaoskey_release()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.08271 }, "nvd": { "published": "2026-07-25T10:17:30.537", "lastModified": "2026-07-25T10:17:30.537", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64455", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "chaoskey_release logs through a USB interface pointer after the final reference has freed that interface.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/fe7a0f4be283b40dd592540027279735120d0d6f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5ec61fbef9ec5635c492ae63dfb5d13f2bdf1023", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f3e409476ad0703c54c14f245e4e143c8124e1bd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c82f88bc7a8458d5c60f9b354c4d32d233f0cac", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3ad5fbcced4e9c2b0fee3c1b76289a147fc35b89", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2a52d55c86a429dac47886b8424e67f90b001e67", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8f50613bff228272577893aa10a346a2f3063e49", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/abf76d3239dee97b66e7241ad04811f1ce562e28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1791, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64456", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.789Z", "date_published": "2026-07-25T08:51:24.659Z", "date_updated": "2026-07-27T05:01:14.705Z", "publisher": "Linux", "title": "hwrng: virtio: clamp device-reported used.len at copy_data()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.7, "cvss_source_score_spread": 0, "epss": { "score": 0.00148, "percentile": 0.04507 }, "nvd": { "published": "2026-07-25T10:17:30.677", "lastModified": "2026-07-27T05:16:52.227", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64456", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The virtio-rng driver trusts a backend-reported used length larger than its inline buffer and copies bytes past the end of that buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/63335e7b638ae70028ae285bb95153874a8bc852", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2e788948ff2a13358a303af112497a63201c5739", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fde19b0d4eeabae042519313c843fe6f27d41e9d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/81dd21b5f0c299cc7b5bf84f04a61938559d20e6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/285e17c44e3873a73460f294acbd64018ff64385", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/92d5736a62040ec1cfff23ea57e6599301690ad5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e3046eeada299f917a8ad883af4434bfb86556b1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2844, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64457", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.789Z", "date_published": "2026-07-25T08:51:25.364Z", "date_updated": "2026-07-25T08:51:25.364Z", "publisher": "Linux", "title": "virtio_pci: fix vq info pointer lookup via wrong index", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00175, "percentile": 0.07258 }, "nvd": { "published": "2026-07-25T10:17:30.830", "lastModified": "2026-07-25T10:17:30.830", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64457", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A dense virtqueue index is used to look up a sparsely populated info array, selecting NULL when optional queues create holes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/41e6dc1a10036c9f47057033f19af7e52ec464b6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/075bc3c779e1ea7294afabdcb7e0a49536959b28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/64a4c0befa77bcc01076aec9f93863ffd4ed06b7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f7d380fb525c13bdd114369a1979c80c346e6abc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1913, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64458", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.789Z", "date_published": "2026-07-25T08:51:26.072Z", "date_updated": "2026-07-25T08:51:26.072Z", "publisher": "Linux", "title": "mm/damon/ops-common: handle extreme intervals in damon_hot_score()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0018, "percentile": 0.07822 }, "nvd": { "published": "2026-07-25T10:17:30.943", "lastModified": "2026-07-25T10:17:30.943", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64458", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Zero or extreme DAMON intervals drive divide-by-zero arithmetic or an out-of-range histogram index.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/58321b4e6e4f0f412069ab27ccdd56292757343a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/74fef68d521150281e36cdaa20e9e1ee3e3aa146", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ef2ae10a4582bc92b7e944181bbd2f87f3d30f3a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9c8f31eaae6140ecadec0c07320498a944556de2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/76e415ea88d20f022ed5cfcf78c50e156a267e91", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/35d4a3cf70a855b50e53189ac2f8463e20a02046", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1869, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64459", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.789Z", "date_published": "2026-07-25T08:51:26.879Z", "date_updated": "2026-07-27T05:01:15.877Z", "publisher": "Linux", "title": "tcp: restore RCU grace period in tcp_ao_destroy_sock", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00475, "percentile": 0.38555 }, "nvd": { "published": "2026-07-25T10:17:31.073", "lastModified": "2026-07-27T05:16:52.403", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64459", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "tcp_ao_destroy_sock frees authentication state synchronously while an RCU packet reader can still hold and traverse that pointer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/657646c08c94ef7b9dbe468fe7828032216f9841", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4caf12c778fed3dc3824cf36263be5e2c491fbd0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8bc4d43bccbd60efe85d0a44d5bf41762f2f0c30", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2881, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64460", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.789Z", "date_published": "2026-07-25T08:51:27.568Z", "date_updated": "2026-07-27T05:01:17.015Z", "publisher": "Linux", "title": "PCI/IOV: Skip VF Resizable BAR restore on read error", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H" } ], "max_cvss_observed_across_sources": 7, "cvss_source_score_spread": 0, "epss": { "score": 0.00118, "percentile": 0.01987 }, "nvd": { "published": "2026-07-25T10:17:31.193", "lastModified": "2026-07-27T05:16:52.540", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64460", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "VF Resizable BAR restore treats a failed configuration read as valid three-bit fields, producing bar index 7 for a six-entry array and reading outside that array.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b77524621250407386f44c6eea7e5e4619ada1ce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/55fd485e66d0ad5c762c23dba1461fe9c741cd96", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f34f1712229d71ce4286440fef12526fd4590b37", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1273, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64461", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.789Z", "date_published": "2026-07-25T08:51:28.309Z", "date_updated": "2026-07-25T08:51:28.309Z", "publisher": "Linux", "title": "PCI: mediatek: Fix IRQ domain leak when port fails to enable", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.0827 }, "nvd": { "published": "2026-07-25T10:17:31.293", "lastModified": "2026-07-25T10:17:31.293", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64461", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A failed MediaTek PCIe port enable frees the port structure without tearing down the IRQ domains allocated earlier in probe.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e23da72ef202654a7d5269885c4fa39a8404db76", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ec7c05eed47d8b15c45380aee7ca168a82e15035", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1fbe8972a39548a633d06d7b03a01b7b119a2c12", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fe8c701a53c2816cd82301f66c671d952003c1b0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ce52e494a7555bdae1d990a2654fd7547ef6d986", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6e6a529d6f779413379b4404c9ef6a36c0337225", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/df77314b3bedbd9ad5d6f0682f98b99e3c5f7e2e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f865a57896bd92d7662eb2818d8f48872e2cbbc7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 894, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64462", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.789Z", "date_published": "2026-07-25T08:51:29.013Z", "date_updated": "2026-07-25T08:51:29.013Z", "publisher": "Linux", "title": "PCI: altera: Fix resource leaks on probe failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.08269 }, "nvd": { "published": "2026-07-25T10:17:31.420", "lastModified": "2026-07-25T10:17:31.420", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64462", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A failed PCI probe leaves an enabled chained interrupt handler pointing to devm storage that is subsequently released.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/af7cf5d56d7d57c4fbfdb7b5b693790f331b07b7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9cf0cc481e1645ec65e61486ae41c486c59781cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/99fc088d6cc6890ae35fa2f29c50ebe027844c20", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a25bfa2a6665a1d77324d4a609e7513b87680227", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0db9aa9ec51be0a0ffdcdfd9af2b7bf3aeb7911a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/09c43b7b7d29c6fadb27f32cdf7f3bb6598befa9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6864c789b570e57f932847fa83f6b56917182d73", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7a94138caeb27f3c49c1dbd93bf422098925bb28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 828, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64463", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.789Z", "date_published": "2026-07-25T08:51:29.720Z", "date_updated": "2026-07-27T05:01:18.146Z", "publisher": "Linux", "title": "usb: typec: tcpci_rt1711h: unregister TCPCI port with devres", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 14, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00138, "percentile": 0.03623 }, "nvd": { "published": "2026-07-25T10:17:31.543", "lastModified": "2026-07-27T05:16:52.667", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64463", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The probe path registers a port and then exits on a later failure without unregistering it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ce2e36e8759dfbfe546723810c306f42f484866d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/94b1abf1af94aa5a355e9f03675e07bccfc41c4b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e5406c8fb71cd2f89a46300a746f6e7972e621e8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/569f18a83eed0b0be4615f0c7bed40fb5c50e2e6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e8da46d99d3710106e7c44db14566bf9b57386b5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 733, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64464", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.790Z", "date_published": "2026-07-25T08:51:30.443Z", "date_updated": "2026-07-25T08:51:30.443Z", "publisher": "Linux", "title": "xhci: sideband: fix ring sg table pages leak", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.07003 }, "nvd": { "published": "2026-07-25T10:17:31.660", "lastModified": "2026-07-25T10:17:31.660", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64464", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "xhci_ring_to_sgtable leaves its temporary page-pointer array allocated after successful scatterlist construction.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/99d00a9e35e311a91d258029d5bb584377296c34", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a3eaf82ff842d6ca95937ea584417e04828235a6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/49f6e3c3ef19f04f6657ed8dce550e36c763abb8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 631, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64465", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.790Z", "date_published": "2026-07-25T08:51:31.160Z", "date_updated": "2026-07-25T08:51:31.160Z", "publisher": "Linux", "title": "usb: xhci: Fix sleep in atomic context in xhci_free_streams()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.08269 }, "nvd": { "published": "2026-07-25T10:17:31.763", "lastModified": "2026-07-25T10:17:31.763", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64465", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "xhci_free_streams performs a sleeping operation while the disconnect cleanup path still holds an atomic spinlock.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e623e4a203f56d5c57519a9a3cb29600551534ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d107eb316144c5fb958486e7fe604cd7f1b35cda", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1e45aa722c4ce5663e987102aac18c8ad6a83fdd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/10666ac9c552990204e791af653abf8e9d9ff619", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f7b022ae07685e7526fc39f387ce65b5d309dd3b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f90586129cf9e1fbdb718ef602eea3f15dc1c31c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/93cd037da94fcb93183bfb2457e3a56d3eb4c8f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/42c37c4b75d38b51d84f31a8e29427f5e06a7c2a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1170, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64466", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.790Z", "date_published": "2026-07-25T08:51:31.887Z", "date_updated": "2026-07-25T08:51:31.887Z", "publisher": "Linux", "title": "rust_binder: clear freeze listener on node removal", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.07003 }, "nvd": { "published": "2026-07-25T10:17:31.893", "lastModified": "2026-07-25T10:17:31.893", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64466", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Rust Binder leaves a freeze listener linked after its node reference reaches zero, creating a reference cycle and memory leak.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/91b27f8172cdbf265240104772fd042a461a7767", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0644da3621ddd8e146280675a2a31d1e06634a1d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bc4a9828897871ff3e5a1f8a1d346decbf4ee95e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 599, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64467", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.790Z", "date_published": "2026-07-25T08:51:32.626Z", "date_updated": "2026-07-27T05:01:19.393Z", "publisher": "Linux", "title": "rust_binder: use a u64 stride when cleaning up the offsets array", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00137, "percentile": 0.03518 }, "nvd": { "published": "2026-07-25T10:17:32.003", "lastModified": "2026-07-27T05:16:52.793", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64467", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Allocation's Drop walks the offsets array (binder_size_t = u64 entries), cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry read.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/89b8cc948dce661af87527623b3a41cdd115e2f9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/74920b1b4e474ba7a4de4323c0458deec49d210b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/803c8a9502e9b97cd6ae937618ef4a8fd6274343", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1133, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64468", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.790Z", "date_published": "2026-07-25T08:51:33.364Z", "date_updated": "2026-07-27T05:01:22.679Z", "publisher": "Linux", "title": "binder: fix UAF in binder_free_transaction()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 24, "versionRangeCount": 20, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00135, "percentile": 0.03371 }, "nvd": { "published": "2026-07-25T10:17:32.103", "lastModified": "2026-07-27T05:16:52.920", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64468", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "binder_free_transaction() drops its transaction lock without pinning the target process, which can be freed before its inner lock is acquired.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5602a43f251c3d75312df91a422675fc00ca3dce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0be901ab1dcc4af59b88f2e324493bb283850167", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/48aeda9f8039e4a6971d1804578efde7f2c01eda", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/45df558c543bb5543bacc8065fd7c567740781e5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d45ef513eed1abebfec90c3cfb6ae50c2a4182db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/328ccf32acb87e8bbb1fe2b065068c574e4db2bf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0f15f0f6ca5df566275ce517f257af2559528b41", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f223d27a546c1e1f48d38fd67760e78f068fe8c4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1517, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 24 } }, { "cve_id": "CVE-2026-64469", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.790Z", "date_published": "2026-07-25T08:51:34.025Z", "date_updated": "2026-07-27T05:01:23.812Z", "publisher": "Linux", "title": "binder: fix UAF in binder_thread_release()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00135, "percentile": 0.03369 }, "nvd": { "published": "2026-07-25T10:17:32.247", "lastModified": "2026-07-27T05:16:53.463", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64469", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Binder releases transactions concurrently without reading to_proc under the transaction lock, allowing another path to free a transaction still being accessed.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/df1a17abba8d6fac5f965adcb8113ceace6e4949", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/38e1a71728e5795b670cc159c18e286a40aeebb4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/faa070c7ad8ba25dcd0b12d7cdbb419e336f5391", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e63032dc715026a96bcaa13d375a8e15c91caa84", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ea02df466df60ecd758eb3b4df3f0cadc5c886ce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ef5439ba5b9ac93349f5df12ef88b42a0ce26340", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/114a116aaa5f0295376cdf12da743c5bce3b20ce", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1879, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64470", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.790Z", "date_published": "2026-07-25T08:51:34.673Z", "date_updated": "2026-07-25T08:51:34.673Z", "publisher": "Linux", "title": "Bluetooth: btusb: fix use-after-free on marvell probe failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.0827 }, "nvd": { "published": "2026-07-25T10:17:32.390", "lastModified": "2026-07-25T10:17:32.390", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64470", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A Marvell Bluetooth probe failure leaves submitted transmit URBs active after their callback context is freed.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1edd524de5cc8143ece9c42c466346983dc5b5ed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0ccb1cb0a464dab78284c34196cd3e8e18bab4c4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/631de465aba7f8ae46478bf5f598111412e8eff8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6e1b10df890f4663cb38af9fc1c93d36747b75af", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/92c736866244340497a8a65afe2ac25354c2bf5e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a7e941a395711791c7e98d9870c6562c2c9e9ef2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/838c917a2f16eefe68def800ebf48a2af591149a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c5b600a3c05b1a7a110d558df935a8fc8a471c79", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 403, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64471", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.790Z", "date_published": "2026-07-25T08:51:35.245Z", "date_updated": "2026-07-25T08:51:35.245Z", "publisher": "Linux", "title": "Bluetooth: btusb: fix use-after-free on registration failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.08271 }, "nvd": { "published": "2026-07-25T10:17:32.510", "lastModified": "2026-07-25T10:17:32.510", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64471", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A Bluetooth registration-failure path leaves sibling interfaces referencing a freed controller until disconnect, enabling use-after-free and double-free.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e09ac7d0c6859a360bf36e7104aef03f88184e0b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/468fcdfaeb937163dd250773a9fed17ab1fa203c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1ce5012944afaddbda939ec6bae9800fce84abbc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e6313b800da61a26c2fdd5eba0105e197c0ab3bc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/14e02f1449ba425a44dedbec9a21efafb056e09f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8db0ce3de78367f61c2970c0f16d9adee8830a23", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/da7d7758fe884b256ddc9fef562e5ddef7952383", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eedc6867ebad73edbfaf9a0a65fbef7115cc4753", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 407, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64472", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.790Z", "date_published": "2026-07-25T08:51:35.978Z", "date_updated": "2026-07-25T08:51:35.978Z", "publisher": "Linux", "title": "vfio/mlx5: Fix racy bitfields and tighten struct layout", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00181, "percentile": 0.07871 }, "nvd": { "published": "2026-07-25T10:17:32.630", "lastModified": "2026-07-25T10:17:32.630", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64472", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Concurrently updated runtime flags share non-atomic bitfield storage, so read-modify-write operations can overwrite one another's state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1dd99b8f4e143592e12e5a77e7b538bc698116cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f1db80a67da928a92ba460ede1be52d8941f46be", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/399d806f998f7a25405fc1b97227e579aead24af", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7ed120b1a007bace57c461805519d70e1af44e59", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/39d163627b51886492bf31f66cb02c94613d2287", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f2365a63b02ddea32e7db78b742c2503ec7b81f1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1448, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64473", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.790Z", "date_published": "2026-07-25T08:51:36.702Z", "date_updated": "2026-07-25T08:51:36.702Z", "publisher": "Linux", "title": "vfio: Remove device debugfs before releasing devres", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00175, "percentile": 0.07257 }, "nvd": { "published": "2026-07-25T10:17:32.757", "lastModified": "2026-07-25T10:17:32.757", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64473", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Device-managed resources are freed before their debugfs entries are removed.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6cc60b41d61657dc469893d14e8e55d160056ff1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a53109ffb6b5148e11a27fb7670355b92db12dd3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a5df401dc84f091e20b045560569f0736758fea7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dc7fe87de492ea7f33a72b78d26650b75bf37f4f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 988, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64474", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.790Z", "date_published": "2026-07-25T08:51:37.405Z", "date_updated": "2026-07-25T08:51:37.405Z", "publisher": "Linux", "title": "vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00176, "percentile": 0.07315 }, "nvd": { "published": "2026-07-25T10:17:32.863", "lastModified": "2026-07-25T10:17:32.863", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64474", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The migration-state skip loop treats the ERROR sentinel as another unsupported state and repeats forever without changing state.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8e872c07e40d51a66dee7b280a23a460a2e1e3fa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ed7d5599e6c398da74845767cd1e6a8370a160fc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7f2d6b31089e48db4653df832c9a6afdde9a1c29", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a3a8afa2f6e7f0dc266d08f02be3f3054241ba47", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a26b499b757cfc8bbff1088bb1b844639e250893", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1045, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64475", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.791Z", "date_published": "2026-07-25T08:51:38.154Z", "date_updated": "2026-07-27T05:01:25.012Z", "publisher": "Linux", "title": "vfio/pci: Release the VGA arbiter client on register_device() failure", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 23, "versionRangeCount": 20, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00139, "percentile": 0.0369 }, "nvd": { "published": "2026-07-25T10:17:32.980", "lastModified": "2026-07-27T05:16:53.927", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64475", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A registration-failure reorder omits the VGA-arbiter unwind and can leave a callback registered with a freed vfio device cookie.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0f2a35a0c7ea7da347b814750eaa78adf3582381", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8d65decde9afd2bd78bcfffdc0df73b82a0b5509", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ef4c38d30b3744e89eb5048218904bb629ea8d47", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9e0a3f642e607848669235f5069f35640abbfc88", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/42d758a09d2c46c42357ecde9a5492f015bde2e5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/52adb2dff7ce3d8430e2bdc5988b618a430def85", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/278a5659c391fe5afe5f9ce1bad1fd24e90144f1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/daedde7f024ecf88bc8e832ed40cf2c795f0796a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 663, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 23 } }, { "cve_id": "CVE-2026-64476", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.791Z", "date_published": "2026-07-25T08:51:38.865Z", "date_updated": "2026-07-25T08:51:38.865Z", "publisher": "Linux", "title": "vfio/pci: Latch disable_idle_d3 per device", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0018, "percentile": 0.07824 }, "nvd": { "published": "2026-07-25T10:17:33.113", "lastModified": "2026-07-25T10:17:33.113", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64476", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A writable global idle-power flag can change while existing VFIO devices retain operations that require balanced per-device runtime-PM state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/332d785f9ae426eeeb92527872adf09d84101ba3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/654710ef3135c4546b20a903bc23a51b0c44d6c8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b98296816d31441b307ef9fa8670dcf5a55e5505", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f6c67cf0051f96ba61d186731d3d9409b9927db2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/062b820290bcb9778e43a73597df76e9bb08acfb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4575e9aac5336d1365138c0284773bf8da4b1fa3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1939, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64477", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.791Z", "date_published": "2026-07-25T08:51:39.558Z", "date_updated": "2026-07-25T08:51:39.558Z", "publisher": "Linux", "title": "x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00176, "percentile": 0.07315 }, "nvd": { "published": "2026-07-25T10:17:33.243", "lastModified": "2026-07-25T10:17:33.243", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64477", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The resctrl offlining path queries a NUMA node through nr_cpu_ids after the monitoring domain's CPU mask becomes empty, causing an out-of-bounds access.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ebc300b7ee0c669fa76a7a8858298ff32e296103", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be1567992417dc92133e74126de7a6066c825ac9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/58c5ec23b1a238eb75cb0aba6f69d8f9e68ef0b2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fc16126cc11d9f507130bf84ab137ee0938c900e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1469, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64478", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.791Z", "date_published": "2026-07-25T08:51:40.299Z", "date_updated": "2026-07-25T08:51:40.299Z", "publisher": "Linux", "title": "ALSA: usb-audio: avoid kobject path lookup in DualSense match", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 27, "versionRangeCount": 24, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.08268 }, "nvd": { "published": "2026-07-25T10:17:33.350", "lastModified": "2026-07-25T10:17:33.350", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64478", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "DualSense hotplug code walks kobject names while the USB device can concurrently disconnect and invalidate an ancestor name.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e4c66a149c408e44e60bfec3fabf08b6b7abbc60", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4566bf8ae9dbfe81bdc2ff1702d59db8a233b06e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/662a1d7b5affc424ea4f4bc20dd99be29e687886", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a47ecd904c51ae6a42957feb3cf2f4266adee2e5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c1da6d3f45036fa63672ee04ad97cb526b40b987", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a263eb12cbe2e208e6e637df0f9b0be9a484158e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4246dd043b7a4f8e3bc1d2896e81d11220610eda", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7693c0cc415f3a16a7a3355f245474a5e661be4e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1275, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 27 } }, { "cve_id": "CVE-2026-64479", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.791Z", "date_published": "2026-07-25T08:51:41.006Z", "date_updated": "2026-07-25T08:51:41.006Z", "publisher": "Linux", "title": "ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00181, "percentile": 0.0787 }, "nvd": { "published": "2026-07-25T10:17:33.493", "lastModified": "2026-07-25T10:17:33.493", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64479", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "snd_seq_event_dup compares a legacy event size against the smaller event member and leaves the UMP trailing word uninitialized before copying it to user space.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d7649aa11089a93ea2285c210397aa67e5800766", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a224c84e5d3d35708c082c84ad12d81d90762195", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ea672a9f6cc38f06fe69dd2c257ef8a3d4db179a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fb1aa5082847b98f44f9c6272aee9d0dca9244f0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/651ba82fe2a144bc7356d940bfd235c3810b0549", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6ded42615fa1f4949925afd0a8a9e1ab3bf96202", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1259, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64480", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.791Z", "date_published": "2026-07-25T08:51:41.691Z", "date_updated": "2026-07-25T08:51:41.691Z", "publisher": "Linux", "title": "ALSA: ice1712: check snd_ctl_new1() return value", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 17, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00181, "percentile": 0.07871 }, "nvd": { "published": "2026-07-25T10:17:33.617", "lastModified": "2026-07-25T10:17:33.617", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64480", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ice1712 driver dereferences the result of snd_ctl_new1 without checking whether allocation returned NULL.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/57d59be545b309d4bb54ac472b15d1e67f254d95", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/69bf1dfa3215524c4ae255bb9dce0770875abbeb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d34ad480b8896d2b486e2cf29ce1790326cad205", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/71b87108ad93d433cdb20704a8dc8852304cf2c2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/38a7cc46370a57122fb29c4bfe48a851c0c64459", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2b929b91b0f3bc6de8a844370049cd99ee8e31ff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 461, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 17 } }, { "cve_id": "CVE-2026-64481", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.791Z", "date_published": "2026-07-25T08:51:42.430Z", "date_updated": "2026-07-27T05:01:26.179Z", "publisher": "Linux", "title": "ALSA: hda/cs35l41: Fix firmware load work teardown", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00138, "percentile": 0.03679 }, "nvd": { "published": "2026-07-25T10:17:33.733", "lastModified": "2026-07-27T05:16:54.210", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64481", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A queued firmware worker survives device teardown and later accesses invalid driver state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8947215c0136c9d905e4a46d824824f8b48a2e5b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ce0a903d0591e3e2c790c5b628802b08d1b287cc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d6a40a4d083ef74d00c8f9516cb5ff07ac70720b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 987, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64482", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.791Z", "date_published": "2026-07-25T08:51:43.128Z", "date_updated": "2026-07-25T08:51:43.128Z", "publisher": "Linux", "title": "ALSA: gus: check snd_ctl_new1() return value", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 17, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00181, "percentile": 0.07871 }, "nvd": { "published": "2026-07-25T10:17:33.843", "lastModified": "2026-07-25T10:17:33.843", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64482", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "snd_gf1_pcm_volume_control dereferences the result of snd_ctl_new1 without checking for allocation failure.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/97f6bdf5d5ded2e37f358cacb5a95f1393356604", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eccf8e91266e39f6f15637702a04a1d344833fe2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fc5d4f27ca1293bc1379ef8fff691c30d9803ca2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5e74e5e8cb7cc25f7a89f59abaf3489bf0c6f4a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/465075c6835103821d725c13f8c545898e5f2636", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c7fa99d30c7a166a5e5db5a585ce7501ff68326b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 390, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 17 } }, { "cve_id": "CVE-2026-64483", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.791Z", "date_published": "2026-07-25T08:51:43.851Z", "date_updated": "2026-07-25T08:51:43.851Z", "publisher": "Linux", "title": "ALSA: firewire: isight: bound the sample count to the packet payload", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.08268 }, "nvd": { "published": "2026-07-25T10:17:33.957", "lastModified": "2026-07-25T10:17:33.957", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64483", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ALSA FireWire path trusts a sample count that exceeds the received payload and accesses bytes beyond it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/24423e0a9251d348c3f1fb0bb0e61b879e1e976c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ebbffacda6733dcbcef601b5b523460f8d8b671e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57e4d9043afc1eaddee8f50d11def6e65415d273", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3ed2fa1ed8cc65f910b8bbc0be3cc366b30f8478", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/31da82b9676c6b112e7c72c7529e6812b919742a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8e48a29813df8dd71503800b7acf69c12c035045", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/31a01b70bb90e3ef3147f308e2ea899e1d2485ca", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/29b9667982e4df2ed7744f86b1144f8bb58eb698", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1121, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64484", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.791Z", "date_published": "2026-07-25T08:51:44.591Z", "date_updated": "2026-07-25T08:51:44.591Z", "publisher": "Linux", "title": "ALSA: es1938: check snd_ctl_new1() return value", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00185, "percentile": 0.0833 }, "nvd": { "published": "2026-07-25T10:17:34.083", "lastModified": "2026-07-25T10:17:34.083", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64484", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The ES1938 mixer dereferences the result of snd_ctl_new1 without checking whether memory allocation returned NULL.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/96cad5bd7d0a176db3fdc06717a41271247336bd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c4efebaf73e217efbd08cdbda805758a7db3680", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/41759affbcfe3d51a32900da9547a1ffd744a85f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7531a37720c2545a480fd0fa464978569bf9d6a2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/af01c48e17a66fa038af210a5c49d6cdefd210bd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9e53e99b6fa3cd82992d963cbff58dbbd1df8651", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1949163dee39e0e4a1468f37dd7302962f6af45a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1edd1f02dddd20aeb6066ded41017615766ea42f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 380, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64485", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.791Z", "date_published": "2026-07-25T08:51:45.301Z", "date_updated": "2026-07-27T05:01:27.427Z", "publisher": "Linux", "title": "ALSA: compress: Fix task creation error unwind", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00137, "percentile": 0.03555 }, "nvd": { "published": "2026-07-25T10:17:34.203", "lastModified": "2026-07-27T05:16:54.570", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64485", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "ALSA task-creation cleanup omits the driver task_free callback and can also preserve a stale success return value.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b27a75d42044d9d4709095617730b91b1c4af423", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/426a9947a38d272d0e19c031658da68e31128667", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4a60127debb9e370d6c0e22a307326b624a141f3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 843, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64486", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.792Z", "date_published": "2026-07-25T08:51:45.982Z", "date_updated": "2026-07-25T08:51:45.982Z", "publisher": "Linux", "title": "ALSA: cmipci: check snd_ctl_new1() return value", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 17, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0018, "percentile": 0.07822 }, "nvd": { "published": "2026-07-25T10:17:34.310", "lastModified": "2026-07-25T10:17:34.310", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64486", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "snd_cmipci_spdif_controls() dereferences snd_ctl_new1() results without checking allocation failure for NULL.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b44888c33c4f11277d0e5e023338f2740232a4ed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8825a06bfa7932a7a74dec01669d405df0b47286", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4dd5b0b1a52a8d6e59a3f217204817228ce0238b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/af2b009b773bc42995546507963e5e78970dc3ed", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/67e9ea92cd598cba1783ff701553c776a6cedee9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c205bd1b28fb7e5f1061a4e78813fad7d315cb3e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 399, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 17 } }, { "cve_id": "CVE-2026-64487", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.792Z", "date_published": "2026-07-25T08:51:46.711Z", "date_updated": "2026-07-25T08:51:46.711Z", "publisher": "Linux", "title": "ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.08268 }, "nvd": { "published": "2026-07-25T10:17:34.423", "lastModified": "2026-07-25T10:17:34.423", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64487", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The caiaq S4 parser loops while any bytes remain, so a final block shorter than 16 bytes is read out of bounds and its unsigned length subtraction wraps to a huge value.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/de5f9edc705497b1b2c6b173b22f283486d2fd91", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/70d6d4cfa4ad09688aed2ec8a0cfa72c31f60334", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/884f575cc6acb136eb4a161d925147f85b59c27e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/05df59b9a61f7ca66548df079d306c41da23845d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3cad86197c7bf8b45bb1d8adc1099d0913e80469", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a5fd3122283bf75c04f6414bf610100beb0565b0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0680413f2f10aab43878dd3db711a6a9e45bab7c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1187, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64488", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.792Z", "date_published": "2026-07-25T08:51:47.436Z", "date_updated": "2026-07-25T08:51:47.436Z", "publisher": "Linux", "title": "ALSA: aoa: check snd_ctl_new1() return value", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00184, "percentile": 0.08268 }, "nvd": { "published": "2026-07-25T10:17:34.553", "lastModified": "2026-07-25T10:17:34.553", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64488", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ALSA AOA setup path dereferences snd_ctl_new1's result without checking whether allocation returned null.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b0154ebc6dc552c389a574b1e221d728e10346e7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d62624fe256b2d0d13454c78cbfc70ff5d954dc7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e5e8c4508d95af82f9b4d065f658e5476a8e9bc8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2ee9c46fd2dcd529cef18e37636ee12f5c3dbedd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d73067e2bbf3775a495d9f38e38d0a3cf53ee790", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fd786466889e4a6e6de0f4462bd0068edea63960", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e47f2a341adbac001b6f5d0211b0cd1c1668637b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8df560fefe6fed6a20b7e06720eeaeccec349ac0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 421, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64489", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.792Z", "date_published": "2026-07-25T08:51:48.161Z", "date_updated": "2026-07-25T08:51:48.161Z", "publisher": "Linux", "title": "ALSA: ymfpci: check snd_ctl_new1() return value", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 17, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0018, "percentile": 0.07822 }, "nvd": { "published": "2026-07-25T10:17:34.687", "lastModified": "2026-07-25T10:17:34.687", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64489", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SPDIF control setup dereferences snd_ctl_new1's result without checking whether allocation returned null.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/91095474eea29b95c9a8bceb9b501a2702b6c55f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/02f33c2062c75e28abc7ad58ce86451cf3140455", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f6538a318947b627710b08a268bc80a48c23bde7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/18ec7d7785be7a4ee8ea11e355122282caad4267", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e64d170346d00b580c0043de3e5ccb3e331c47d4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 406, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 17 } }, { "cve_id": "CVE-2026-64490", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.792Z", "date_published": "2026-07-25T08:51:48.877Z", "date_updated": "2026-07-27T05:01:28.678Z", "publisher": "Linux", "title": "ALSA: virtio: Validate control metadata from the device", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00153, "percentile": 0.04935 }, "nvd": { "published": "2026-07-25T10:17:34.807", "lastModified": "2026-07-27T05:16:54.790", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64490", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "virtio-snd trusts device-supplied control type and count values as array indices and copy lengths without validating their bounds.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3243563f99ef5d3949b934bd6390a5679405d0e1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5da9742de22db0dbaa8d414214ab5e1bedde00f9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/21584672fd699abe1768241d6c501b2de6139b6a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c77a6cbb36ff8cbc1f084d94f8dcda5250935271", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 751, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64491", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.792Z", "date_published": "2026-07-25T08:51:49.601Z", "date_updated": "2026-07-25T08:51:49.601Z", "publisher": "Linux", "title": "ALSA: usx2y: us144mkii: fix work UAF on disconnect", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00174, "percentile": 0.07065 }, "nvd": { "published": "2026-07-25T10:17:34.910", "lastModified": "2026-07-25T10:17:34.910", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64491", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The disconnect path cancels work before killing self-resubmitting URBs, allowing a completion to rearm the work after its only cancellation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c071df05bcda0e47aac581d4b564b2bebcb1ff60", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/27161c68d5e78807c9d897db222a775b298d05fd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/147996e7e7c9e8339c0e04f6fa7ccb3e4d448ff7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 728, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64492", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.792Z", "date_published": "2026-07-25T08:51:50.313Z", "date_updated": "2026-07-25T08:51:50.313Z", "publisher": "Linux", "title": "iio: temperature: tmp006: use devm_iio_trigger_register", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.07002 }, "nvd": { "published": "2026-07-25T10:17:35.017", "lastModified": "2026-07-25T10:17:35.017", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64492", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The tmp006 driver registers a devm-allocated trigger with a non-devm API, leaving a global-list pointer after module unload frees the trigger.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a4f8491da9563ba6eb77969ac26fc7052114c476", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d90f868f56a16e10eedc6552f48d99dff4d275b7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3c5eed894efd93d68d7f6a359a81ddef0e928774", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 524, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64493", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.792Z", "date_published": "2026-07-25T08:51:51.036Z", "date_updated": "2026-07-25T08:51:51.036Z", "publisher": "Linux", "title": "iio: pressure: mpl115: fix runtime PM leak on read error", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06418 }, "nvd": { "published": "2026-07-25T10:17:35.120", "lastModified": "2026-07-25T10:17:35.120", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64493", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The sensor read error path returns without dropping its runtime power-management reference, leaking one reference per failed read.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5022f4ed5aae974ec530e3cbf0bd223be13055f7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aab0fed636b14a5fd52fcae58b484f1cb96b841d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b3f1af4ba8e9cf33aa08c4cdcaa5a17b140521ec", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/46e69d3dd429b33e50e2731913239f6af4ea2705", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fbe67ff37a6fd855a6c097f84f3738bd13d0a898", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 546, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64494", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.792Z", "date_published": "2026-07-25T08:51:51.747Z", "date_updated": "2026-07-25T08:51:51.747Z", "publisher": "Linux", "title": "iio: light: gp2ap002: fix runtime PM leak on read error", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 18, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07408 }, "nvd": { "published": "2026-07-25T10:17:35.230", "lastModified": "2026-07-25T10:17:35.230", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64494", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "gp2ap002_read_raw returns on a sensor read error without releasing its runtime power-management reference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/62e0d74821a02f0e0c5c79b99ae64dc83a9a90f5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7110201c6b21455240c63388f30113f3baafacfc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2593f0c6ea37df168975694a3b17e7086f11453e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f350883989ced96d6da7f582f9a6f9c6ffc94e34", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/29137052c4485c74bc2d1b0717f69ca4de14274f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0c655d067ac69ee24e2e9d706c54179ea58a43db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2ebaea7f3089decb01a8294d89d7e0cf288146c4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/38b72267b7e22768a1f26d9935de4e1752a1dc85", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 524, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64495", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.792Z", "date_published": "2026-07-25T08:51:52.468Z", "date_updated": "2026-07-25T08:51:52.468Z", "publisher": "Linux", "title": "iio: gyro: bmg160: bail out when bandwidth/filter is not in table", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00195, "percentile": 0.09441 }, "nvd": { "published": "2026-07-25T10:17:35.360", "lastModified": "2026-07-25T10:17:35.360", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64495", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The gyro filter lookup reads one element past its table when no bandwidth or filter entry matches.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1dc3a833be11e5d503038e3c701745fd0e03903c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/77e56ebb1786f4296afd5fa46975a989b285ae65", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/029481cddb98697716f4bf3021d035eaf2ca0e1f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8d202515baea4e2e3be448d1590099af28f2346d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d85ee50f58dd83fe74f6d0bf8bd345c657b216e8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7bbf02b63961fc1768c9c654392c11f2077d4c59", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6c8675468862161d1c59130266852b66867d3861", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8320c77e67382d5d55d77043a5f60a867d408a2b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1126, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64496", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.792Z", "date_published": "2026-07-25T08:51:53.194Z", "date_updated": "2026-07-27T05:01:29.899Z", "publisher": "Linux", "title": "iio: event: Fix event FIFO reset race", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02689 }, "nvd": { "published": "2026-07-25T10:17:35.490", "lastModified": "2026-07-27T05:16:54.923", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64496", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "IIO installs the event file descriptor before resetting its FIFO, allowing another thread to queue an event that the post-publication reset then discards.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/9dc84ba4be5bbeb29ee49efe6cea2cb32c461424", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d16a702ca7d29c0b7a9b509339d1b044a1cadb32", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a13ef1adbc62085b21b546b07b0be7e2fbf52150", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0d4a646d7f87ea3625fafe387043fddc6a2f5e7f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/72c6aa8e0d74eab91b8694cde97dec088c248fee", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9edefd4c56bee3fe331e0355d1f10a533134999d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f187dc5a4c4846ffa07d9bda6e760837ed005574", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/af791d295737ea6b6ff2c8d8488462a49c14af01", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1641, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64497", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.792Z", "date_published": "2026-07-25T08:51:53.917Z", "date_updated": "2026-07-25T08:51:53.917Z", "publisher": "Linux", "title": "iio: chemical: scd30: Cleanup initializations and fix sign-extension bug", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07463 }, "nvd": { "published": "2026-07-25T10:17:35.623", "lastModified": "2026-07-25T10:17:35.623", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64497", "family": "OTHER_SPECIFIC", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SCD30 conversion clears the sign bit with an incorrectly widened mask and corrupts the floating-point exponent.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0ccff849bde90973e6c13a666f6ceab5c55b30d4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1821bcacd8ac5b214c53be16cbb8172bf193f0b6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/40bb0fdb37f441c9c9f52bf58bbd8a0ca3cc9598", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b131f0011dfef72350f4e3f11df94dc3e6b46065", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8d4a46e971cf846bda98b20d4cabfa21c1276e5f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/82accdd57404399eddf3d56fd9beda7c61307388", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d49ff54b2784aa56a7c97982de713604de89d23a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/60d877910a43c305b5165131b258a17b1d772d57", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 729, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64498", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.792Z", "date_published": "2026-07-25T08:51:54.625Z", "date_updated": "2026-07-25T08:51:54.625Z", "publisher": "Linux", "title": "iio: buffer: hw-consumer: free scan_mask on buffer release", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00155, "percentile": 0.05214 }, "nvd": { "published": "2026-07-25T10:17:35.753", "lastModified": "2026-07-25T10:17:35.753", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64498", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The IIO hardware-consumer release path frees the wrapper but omits the separately allocated scan-mask bitmap.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/fb8e18f8ca724bd4de4643cad5b7c7230b9a5a71", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6325d6e2204327965b849c0a16efb6ac9202e5a8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 648, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64499", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:51:55.336Z", "date_updated": "2026-07-25T08:51:55.336Z", "publisher": "Linux", "title": "iio: adc: ti-ads1119: fix PM reference leak in buffer preenable", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00157, "percentile": 0.05333 }, "nvd": { "published": "2026-07-25T10:17:35.860", "lastModified": "2026-07-25T10:17:35.860", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64499", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An I2C error during pre-enable returns without releasing the runtime power-management reference.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f40292fb19399a3c3f82de698023ba87c01e66cf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ffb2195921c3d629194b9807de589578df9f9cb8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6537f08100189d12bec4975000244e6ac4873c28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/adf4bc07f814da8329278d32600147f5a150938c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 639, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64500", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:51:56.053Z", "date_updated": "2026-07-25T08:51:56.053Z", "publisher": "Linux", "title": "iio: adc: lpc32xx: Initialize completion before requesting IRQ", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06138 }, "nvd": { "published": "2026-07-25T10:17:35.957", "lastModified": "2026-07-25T10:17:35.957", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64500", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The LPC32xx ADC driver registers an interrupt handler before initializing the completion object that the handler uses.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/7090c0d29708ee305022d0ea7b37612b33242fa2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0e33587967b356519aa6f220b5b43c6976320397", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1ddf7b6ffb8ebb22b92a184a9eaa76277ef0c7cd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/820c4f15353efe9a9429ae86ccceeaf4e0e4e585", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/48eccc6caed4e62c0f199ab3a3772fa969cd3b2d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9e2e8b8cdfd37ae7c7a8a5c96c59e98a768731c4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2f18c5551aa97ca7f39dbb151c67c9053ccadc17", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e561b35633f450ee607e87a6401d97f156a0cd54", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1400, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64501", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:51:56.768Z", "date_updated": "2026-07-27T05:01:31.056Z", "publisher": "Linux", "title": "iio: adc: ad_sigma_delta: fix CS held asserted and state leaks", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00116, "percentile": 0.01843 }, "nvd": { "published": "2026-07-25T10:17:36.090", "lastModified": "2026-07-27T05:16:55.100", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64501", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The sigma-delta ADC error path exits without returning the converter to idle and releasing chip select, leaking bus and device state into the next operation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c313bb7c38855e94ceef939d152dd75e5a904b5f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f1de829ee87a1198d3465493ce430d36c5fa029c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c72da0688575e5ef39c36bb44fed53aa18f8ae65", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1397, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64502", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:51:57.477Z", "date_updated": "2026-07-27T05:01:32.289Z", "publisher": "Linux", "title": "iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00119, "percentile": 0.02073 }, "nvd": { "published": "2026-07-25T10:17:36.200", "lastModified": "2026-07-27T05:16:55.223", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64502", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The sigma-delta driver enters a register-status drain path on a registerless device and can underflow a zero data length into a SIZE_MAX memset.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/3394e0b3328422431cadaf314fa58d3717ed4936", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3bceb26dfaf7ba805b459e41c1d0ba916862dade", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/91bc6767a4f55dc470d8a56b55b9f2ea09094efe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1921, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64503", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:51:58.186Z", "date_updated": "2026-07-25T08:51:58.186Z", "publisher": "Linux", "title": "iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07403 }, "nvd": { "published": "2026-07-25T10:17:36.317", "lastModified": "2026-07-25T10:17:36.317", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64503", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync() but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the matching pm_runtime_put_autosuspend().", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a93fd69c1ab0854ac4f5b8439c26dfadb25dfd20", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eeece4a85ece6f3837c75ef26a9b2bf5a1d0fcfc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/191fcfeb729ededd8dd2a999c6bf351ddfa0cec7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/36154171385a8a2444a4b3c6eaa0c5294cb02478", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/223703d6e8bed50b6a0b47e160877909518d94b9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6293211d142605bec435229ef0aa3668b8964164", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/13a91e8631cfeb68e5b7fd6687f194f5a86e83fe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/44a5fd874bb6873bdaec59f722c1d57832fbc9df", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 549, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64504", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:51:58.887Z", "date_updated": "2026-07-25T08:51:58.887Z", "publisher": "Linux", "title": "iio: accel: bmc150: clamp the device-reported FIFO frame count", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00165, "percentile": 0.06138 }, "nvd": { "published": "2026-07-25T10:17:36.443", "lastModified": "2026-07-25T10:17:36.443", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64504", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The accelerometer driver trusts a 0-to-127 device FIFO count when its stack buffer holds only 32 frames.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b5a9f521e0a49a0266200fd535b32a9668ecb33b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2fe0531dd73eff1de0f2584cb77716d645e548d5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/89f4a4ca0ac3a933c750569a771c079a290b0721", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3e766526827acd542bcd36c20c4d5f397e0f6521", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/35a3cd8fd65e15029eb90f1e510045b1bb071175", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ce0e1cae26096fe959a0da5563a6d6d5a801d5fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1532, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64505", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:51:59.618Z", "date_updated": "2026-07-27T04:37:44.365Z", "publisher": "Linux", "title": "usb: gadget: function: rndis: add length check for header", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0022, "percentile": 0.12543 }, "nvd": { "published": "2026-07-25T10:17:36.583", "lastModified": "2026-07-27T05:16:55.357", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64505", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The RNDIS parser accesses MessageType, MessageLength, DataOffset and DataLength before confirming that the received header contains those fields.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/200dd5092296ad4d5ae47f8445a2fb1edd1da973", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9ffd567d7bf269824dfac06f8ab9a32fef72699b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b73c0142e3acdc063b50c33afb7be19cdb2cd410", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d6ef5af7d0fe1ac31e5653a77e6d775dd36bc433", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ba2cc601e59fe68716646199a33303493513e2e3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7515a6d4a9e9e4838b833825882efa00e85f8901", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9facd79028a7807879eb441d12f0e00720980aa3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/21b5bf155435008e0fb0736795289788e63d426f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 299, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64506", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:52:00.322Z", "date_updated": "2026-07-25T08:52:00.322Z", "publisher": "Linux", "title": "wifi: rtw89: correct drop logic for malformed AMPDU frames", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00161, "percentile": 0.05789 }, "nvd": { "published": "2026-07-25T10:17:36.710", "lastModified": "2026-07-25T10:17:36.710", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64506", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The malformed-AMPDU drop state mishandles the first packet during pairwise rekey and resets state at the wrong point in the sequence.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/994994cfadaf1fd362dea9b8d9d633f85dc1b3c3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/63ccdfac8677387dfdbd9d4336089e9823280704", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 572, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64507", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:52:01.008Z", "date_updated": "2026-07-27T04:37:45.561Z", "publisher": "Linux", "title": "x86/bugs: Enable IBPB flush on BPF JIT allocation", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00157, "percentile": 0.05335 }, "nvd": { "published": "2026-07-25T10:17:36.810", "lastModified": "2026-07-27T05:16:55.487", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64507", "family": "HARDWARE_PHYSICAL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "BPF JIT memory reuse omits the IBPB flush needed to clear branch-predictor state when Spectre-v2 mitigations are active.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/cb27f3bf915cc0f20fc0c48da9059304e39ebd35", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9354248fc1c33a844ca1872761f6668b393e8c37", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/52440e15d9628f8f239373c0f2e5e8f92feea2df", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a3af84b0fa00ead01fcd0e28b5d773ff25990a0d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 490, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64508", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:52:01.732Z", "date_updated": "2026-07-27T04:37:46.726Z", "publisher": "Linux", "title": "bpf: Support for hardening against JIT spraying", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00157, "percentile": 0.05335 }, "nvd": { "published": "2026-07-25T10:17:36.920", "lastModified": "2026-07-27T05:16:55.600", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64508", "family": "HARDWARE_PHYSICAL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Reused executable BPF JIT memory retains indirect-branch predictor state from the previous program and enables cross-program speculative steering.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6e52c240c43a601b681e3a4e58fc5685114d4726", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/eed774da601268dae674e14d54a15e3624691f52", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8ff183ee4d8c452960df58175a094828c0513b2e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7a6c171c6a1ac6d1509752dac131d941a3de0b37", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/96cce16e26dd02a8678f1e87f88a4b5cdb63b995", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1151, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64509", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:52:02.486Z", "date_updated": "2026-07-25T08:52:02.486Z", "publisher": "Linux", "title": "rust: block: fix GenDisk cleanup paths", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00157, "percentile": 0.05332 }, "nvd": { "published": "2026-07-25T10:17:37.030", "lastModified": "2026-07-25T10:17:37.030", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64509", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Cleanup paths omit put_disk and leak the gendisk and queue resources.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d1dcaa5229a63a6b6df7e0f673fe576cf3d6e8cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e7636f26f77070a529c26d65afd217514ce85ce4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6822a2685b4da9a87efd1fce4b042678a31ff734", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2957771379fa335103a4b539db57bb2271e12142", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 862, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64510", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:52:03.208Z", "date_updated": "2026-07-27T05:01:33.494Z", "publisher": "Linux", "title": "ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7, "cvss_source_score_spread": 0, "epss": { "score": 0.00111, "percentile": 0.0152 }, "nvd": { "published": "2026-07-25T10:17:37.137", "lastModified": "2026-07-27T05:16:55.720", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64510", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "NFIT initialization failure frees acpi_desc without removing it from the global list, leaving later machine-check handling to dereference a dangling pointer.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ee82078e776ae31266cc70fdf62ac17c3c6f100a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6ff054cc02a763914773b026cacb429e5fbf64fa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c127dbd832bd4b9aef8a749d9f491b74042f9b47", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/df7c92216a1583a76cb0cbf2f21cd68870609b05", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7d69235bdc581a4346e9bcd6a8bea37d3e1abd25", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/38bf27511ef41bffebd157ec3eba41fc89ba59cd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1836, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64511", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:52:03.818Z", "date_updated": "2026-07-25T08:52:03.818Z", "publisher": "Linux", "title": "ACPI: NFIT: core: Fix possible NULL pointer dereference", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00156, "percentile": 0.05287 }, "nvd": { "published": "2026-07-25T10:17:37.273", "lastModified": "2026-07-25T10:17:37.273", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64511", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The NFIT notify handler can run after probe returns without allocating acpi_desc and then dereference the absent driver-data pointer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a44343fe230aa48c74ef09830f3c5c90848b257e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3c8f73b0fbdf956c98e2329d5aaea3ad09a9cfb6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/452945662fd8e9862a2d2043239c7ee1815d1ac4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/873576e585da5d0fc5debbab74eed565c0acea99", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/027e128abb82788189d6d45b68e3e8e7329b67be", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 753, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64512", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:52:04.423Z", "date_updated": "2026-07-25T08:52:04.423Z", "publisher": "Linux", "title": "ACPI: CPPC: Suppress UBSAN warning caused by field misuse", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 21, "versionRangeCount": 19, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00173, "percentile": 0.06966 }, "nvd": { "published": "2026-07-25T10:17:37.380", "lastModified": "2026-07-25T10:17:37.380", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64512", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ACPI CPPC path interprets access_width under the wrong address-space meaning and shifts a 32-bit value by an out-of-range count.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b54c4632946ae42f2b39ed38abd909bbf78cbcc2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e904596ba6dd108534ffa15e3e46b2fe245145e2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2fb80e962029000959f651665baa4838cc92eb99", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/37f28bf8f14672dfa395994e41fd778a63f0bf5c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f29dc6132d4968e39d8fa575d1a12e2c718ce57b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dc066bd13c860bb27d6ace511210e18b8064c1d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1050, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 21 } }, { "cve_id": "CVE-2026-64513", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:52:05.119Z", "date_updated": "2026-07-25T08:52:05.119Z", "publisher": "Linux", "title": "KVM: x86: Unconditionally recompute CR8 intercept on PPR update", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00171, "percentile": 0.06699 }, "nvd": { "published": "2026-07-25T10:17:37.510", "lastModified": "2026-07-25T10:17:37.510", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64513", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "KVM updates the guest PPR without always recomputing the CR8 intercept, leaving a stale TPR threshold that can make the next VM entry fail.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ff9c4c6428883182960cfe5c78928f0896d80ebc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8c8e8ac22ee17d52f9eb2bc814bca7fab90fb8df", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bb365a506b1e6fb050c0fceaad354fe395385ef0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2305, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64514", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T08:52:05.878Z", "date_updated": "2026-07-25T08:52:05.878Z", "publisher": "Linux", "title": "userfaultfd: gate must_wait writability check on pte_present()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00177, "percentile": 0.07462 }, "nvd": { "published": "2026-07-25T10:17:37.633", "lastModified": "2026-07-25T10:17:37.633", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64514", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "userfaultfd interprets write bits from non-present swap or migration entries, which can leave a fault waiting for a wake that never arrives.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/a5700a4c1c9099ac2ac73fe8a09cf059972e0d2f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d4026417e8184d13850a0bad4d96ceb6ed9f7152", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/29e6f952c5fb7dc1d6b90fe5b7f36063d44ddae0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/5f4dbdb0a87596214076b20b94f2b71b522170b3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a6e9a4939e359599701b1da351e84f72e021443a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/60d696a037eeeedfb57756dfe7ec08a1587c8631", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/710183888174639a15fcec16cd1af766b8480bb7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8e80af52db652fbc41320eee45a4f73bc029faf2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1157, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64515", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.793Z", "date_published": "2026-07-25T09:14:42.418Z", "date_updated": "2026-07-27T05:01:34.611Z", "publisher": "Linux", "title": "wifi: mac80211: fix MLE defragmentation", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H" } ], "max_cvss_observed_across_sources": 8.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00238, "percentile": 0.14898 }, "nvd": { "published": "2026-07-25T10:17:37.763", "lastModified": "2026-07-27T05:16:55.870", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64515", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The MLE defragmenter pairs a pointer to a defragmented copy with the original element container, making offsets refer to mismatched buffers and enabling an overread.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1f573e17bcb7275ddd1c8f47f46ae0faf0e902a4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/55c479aae99b120489a432db9c717484e523dfd6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/722b3f86df80644463d29fe5451e30a617f74500", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a74e893f30db64cdce0fc7a96d3baa417bcd55f5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 825, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64516", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:14:43.142Z", "date_updated": "2026-07-27T05:01:35.782Z", "publisher": "Linux", "title": "drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 6, "versionRangeCount": 5, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00112, "percentile": 0.01593 }, "nvd": { "published": "2026-07-25T10:17:37.870", "lastModified": "2026-07-27T05:16:55.983", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64516", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The amdgpu VCE1 buffer size omits the firmware offset, allowing firmware, stack, or data placement to extend beyond the reserved object.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 520, "referenceCount": 2, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64517", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:14:43.863Z", "date_updated": "2026-07-25T09:14:43.863Z", "publisher": "Linux", "title": "drm/xe/gsc: Fix double-free of managed BO in error path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06472 }, "nvd": { "published": "2026-07-25T10:17:37.973", "lastModified": "2026-07-25T10:17:37.973", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64517", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An explicit free is followed by device-managed unwind freeing the same allocation a second time.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/7cb975fcd4777e7bad688f66aa0c10c16dd8276b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2c890e71ae26fa32f5a96c3694b71a2c310940e7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/889f70de2b51a877339e1979aab95111b41bed75", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d3ded53fab90996e7d94a39049e11962dd066725", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 587, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64518", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:14:44.603Z", "date_updated": "2026-07-25T09:14:44.603Z", "publisher": "Linux", "title": "tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 11, "versionRangeCount": 10, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.064 }, "nvd": { "published": "2026-07-25T10:17:38.080", "lastModified": "2026-07-25T10:17:38.080", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64518", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "tcp_ao_established_key calls lockdep_sock_is_held on a shorter tcp_timewait_sock object and reads sk_lock beyond that object's layout.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/87bb3e719042f0030a6dad39118c6a6b2a491ad9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/510db031ba6eb40134f84c90ef963ea4b6dfb878", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/29cf64d128c94cf98d1c69d8b2962d39db5ff4c6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/03cb001ef87b3f8d859cf7f96329acf3d6235d29", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 638, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 11 } }, { "cve_id": "CVE-2026-64519", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:14:45.322Z", "date_updated": "2026-07-25T09:14:45.322Z", "publisher": "Linux", "title": "NFSD: Fix infinite loop in layout state revocation", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06473 }, "nvd": { "published": "2026-07-25T10:17:38.187", "lastModified": "2026-07-25T10:17:38.187", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64519", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "NFSD skips a failed revoke without marking progress, causing the same entry to be retried indefinitely.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d1fc00ec02e9deb3f8d2bd59caf938c554fbc576", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fe59ae27d7346245f5d8d97220f374e63efd28b5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/44e5e4eb3a07bf3e1d931dd9f96f3edcfa376605", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4f8ef58c10bfe5f86a643c7c8331b37e69e3dae1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 397, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64520", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:14:46.005Z", "date_updated": "2026-07-27T05:01:37.019Z", "publisher": "Linux", "title": "firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00131, "percentile": 0.03063 }, "nvd": { "published": "2026-07-25T10:17:38.290", "lastModified": "2026-07-27T05:16:56.093", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64520", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The FF-A register response uses firmware-provided indices to copy partition descriptors without validating count and index progression against the destination array.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f39bc7ebe75e2186b417a024a7f7e2fd4cc7eb95", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/79d95c02ae0a95e6e80e8e92b7ca74ecee02854f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3974ea1938406f9bfa7c1f48d4e43533f447bb08", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 437, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64521", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:14:46.709Z", "date_updated": "2026-07-25T09:14:46.709Z", "publisher": "Linux", "title": "pinctrl: meson: amlogic-a4: fix deadlock issue", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00166, "percentile": 0.06278 }, "nvd": { "published": "2026-07-25T10:17:38.393", "lastModified": "2026-07-25T10:17:38.393", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64521", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The pinconf-pins path reacquires the same mutex already held by its caller and deadlocks.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/e917713f013423069782ff554935c7a5d4266783", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/744ac926c0e55267a10b49b5b72582afef4ad49f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e72ce029810390eb987a036fb2c8a5da9a23b685", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 411, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64522", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:14:47.404Z", "date_updated": "2026-07-27T05:01:38.188Z", "publisher": "Linux", "title": "net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 8, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00347, "percentile": 0.27374 }, "nvd": { "published": "2026-07-25T10:17:38.497", "lastModified": "2026-07-27T05:16:56.213", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64522", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The temporary IPsec acquire-SA path decrements the eswitch mode-block counter even though that path never incremented it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b5bd4249e430f5963d559708ee96a671716d2400", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ecafd8284e527666e83261e6e57a7c7341d591cb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/abe003b33223ff33552f291644bf35d9c2f992fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 717, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64523", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:20:47.606Z", "date_updated": "2026-07-27T05:01:39.425Z", "publisher": "Linux", "title": "net/handshake: Take a long-lived file reference at submit", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00347, "percentile": 0.27389 }, "nvd": { "published": "2026-07-25T10:17:38.597", "lastModified": "2026-07-27T05:16:56.327", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64523", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The kernel handshake request stores a file pointer without taking the long-lived reference required for asynchronous use, allowing the file to be freed first.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/685b10dd0e32c7782cead16c8cf055c609678583", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/16eaba5aa89c04eea125905bb8f988c1897f4f29", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/09dba37eee70d0596e26645015f1aa95a9848e9d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1423, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64524", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:20:48.193Z", "date_updated": "2026-07-27T05:01:40.599Z", "publisher": "Linux", "title": "drm/hyperv: validate resolution_count and fix WIN8 fallback", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.7, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.7, "cvss_source_score_spread": 0, "epss": { "score": 0.00144, "percentile": 0.04128 }, "nvd": { "published": "2026-07-25T10:17:38.713", "lastModified": "2026-07-27T05:16:56.447", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64524", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Hyper-V display parser walks a fixed 64-entry resolution array using an unbounded device-supplied resolution_count.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/96f7de3172d4aa878b7f87173b2b3507c350fcd6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bc573752f3dac0d1ab8df7078c1851bc76717653", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1fb565b77b8f44afabb02de6310065f109d89e94", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a321c908f2eeea01539668eb270d074d9b88e490", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9c698b2c43c2667c34f5336bf46ad5786216ac2a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8a114b25b5521eae451b13bce98ae978624962e5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/13d33b9ef67066c77c84273fac5a1d3fde3533d1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 820, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64525", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:20:49.256Z", "date_updated": "2026-07-25T09:20:49.256Z", "publisher": "Linux", "title": "xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00156, "percentile": 0.05276 }, "nvd": { "published": "2026-07-25T10:17:38.830", "lastModified": "2026-07-25T10:17:38.830", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64525", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "xfrm teardown performs one blocking RCU grace period per network namespace instead of batching the synchronization, allowing cleanup queues and per-CPU memory to grow without an effective bound.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/bca6386dc08750fc7cdcbc7683473748ba3114b9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/91cc13978ab0bc6f669139f53e7e613a860d10e0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d14ae8ef88c2c6590e107db61b6adce148cec7b3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3e52417318473782012b236d0325bf7d2266a597", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1642, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64526", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:20:50.394Z", "date_updated": "2026-07-25T09:20:50.394Z", "publisher": "Linux", "title": "ethtool: tsconfig: fix missing ethnl_ops_complete()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 8, "versionRangeCount": 7, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00154, "percentile": 0.05121 }, "nvd": { "published": "2026-07-25T10:17:38.950", "lastModified": "2026-07-25T10:17:38.950", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64526", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The tsconfig error path returns after ethnl_ops_begin without calling the matching ethnl_ops_complete cleanup.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d02342d9bb4f0ab682f1846a4fbc15dd2955f7e6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d53fe379d1f9a92e8a1bb2556084c8c177ebf8fd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6386bd772de64e6760306eb91c7e86163af6c22f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 235, "referenceCount": 3, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-64527", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:20:51.078Z", "date_updated": "2026-07-25T09:20:51.078Z", "publisher": "Linux", "title": "drm/hyperv: validate VMBus packet size in receive callback", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00161, "percentile": 0.05695 }, "nvd": { "published": "2026-07-25T10:17:39.053", "lastModified": "2026-07-25T10:17:39.053", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64527", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Hyper-V graphics receive callback reads type fields and copies a packet without first proving that the host supplied the required bytes within the receive buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/57d5d697642e05d5dd2d40660817765943dd709f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f5251226551bfec98c4705641b6f94ff1f238d91", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/049a6b474823049fe60212f25f26e4b30f44ee8f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/588c84b461393ff1998ac7b97b04f953f642e0df", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/164dc7bf17609340233c6bf4f66bb7c7008a0511", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c8974d96b6a5496f33dc69a3ce28a7bf5078def4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7f87763f47a3c22fb50265a00619ef10f2394b18", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 2072, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64528", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:20:51.774Z", "date_updated": "2026-07-25T09:20:51.774Z", "publisher": "Linux", "title": "tty: serial: samsung: Remove redundant port lock acquisition in rx helpers", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06412 }, "nvd": { "published": "2026-07-25T10:17:39.187", "lastModified": "2026-07-25T10:17:39.187", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64528", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Serial callbacks invoked with port lock already held call receive helpers that acquire the same non-recursive spinlock again and deadlock.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ee9eb72be95490602c493db050c73d925c3a4d74", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/10014eb7eee351f7b587f8ac85830f0c9343cb9a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f4c3e63fa8639aedf96fb200d9939945a9eed51e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a9c22e0f93ba18322a6623ecdda2f0cd858ca350", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/14143ec10d69f42806b5d7b046f0fd1b835831ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9fd48937046efc9abb89379d63ee9cc5c661d711", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9c92b42207978559e32903c3098aaf5c5b5788b2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a3bb136bff5e6a5e48cdd813246c9c4686feaaa9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1145, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64529", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-25T09:24:18.750Z", "date_updated": "2026-07-27T05:01:41.855Z", "publisher": "Linux", "title": "crypto: qat - remove unused character device and IOCTLs", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 19, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00135, "percentile": 0.03379 }, "nvd": { "published": "2026-07-25T10:17:39.317", "lastModified": "2026-07-27T05:16:56.580", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64529", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "The record removes an unused ioctl surface and mentions unspecified bug reports but does not identify a concrete vulnerable operation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/071590a44cbc38483fceb1ab943363ec26868e1b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1de076f43e64bf65fbe7280a269c70e0e60518df", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6848a6e39cac44fdb7cb88f0f777df62172d1551", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b1ea97076bd0a5196290deba172034e480646727", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b8ebf008696de1ec08c90d51f94d7e40bd448be1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/de2cc38489b629927910b1aeff69bba7bd5c6f1b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3ae49dd04dbb11fb73f17f58a982dba128abe83a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d237230728c567297f2f98b425d63156ab2ed17f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1177, "referenceCount": 9, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64530", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-26T06:28:42.970Z", "date_updated": "2026-07-27T05:01:43.021Z", "publisher": "Linux", "title": "net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 21, "versionRangeCount": 19, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00509, "percentile": 0.40613 }, "nvd": { "published": "2026-07-26T07:16:41.680", "lastModified": "2026-07-27T05:16:56.730", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64530", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The qevent path continues using an skb after TC_ACT_CONSUMED transferred ownership to the defragmentation engine.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5ed3d6f85991656667059d3fa5a1d683ac58c447", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f42e8134a3a1074b834a574d404352f867ba994a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/447d493034a9cf7bf13a2abac86d0573d907ec2f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e1270e69dcf2c3512c453484178f2e9dc0db3f05", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2140c2f3f2e7b066e1ae616ede8856cafd8015e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e28aedab9488343924d227b5a896faed67ce84d5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a8a02897f2b479127db261de05cbf0c28b98d159", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1291, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 21 } }, { "cve_id": "CVE-2026-64531", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-27T06:32:32.596Z", "date_updated": "2026-08-01T06:50:00.893Z", "publisher": "Linux", "title": "net: openvswitch: reject oversized nested action attrs", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 22, "versionRangeCount": 20, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02936 }, "nvd": { "published": "2026-07-27T08:16:22.243", "lastModified": "2026-08-01T08:16:29.920", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64531", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An oversized nested Open vSwitch action truncates its 16-bit length, so later walkers reinterpret bytes outside the validated structure.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ab855641241387db062a5e41d9ad6b8561542572", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c66bd2626c2764f23764ff0f8277f44a9cfe8349", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d573250d228401f707f4dbc09d11227a6215ee5f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f1efff8858403191361a01269c6fe8dd7f55a385", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dbd14f736be02cfe73049bd801af89becd1a0749", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1b41cbe05b184f8861712f0806cc0c4f5d8c6dfe", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3f1f755366687d051174739fb99f7d560202f60b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/28/8", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/31/17", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/01/1", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/01/3", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1558, "referenceCount": 11, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 22 } }, { "cve_id": "CVE-2026-64532", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.794Z", "date_published": "2026-07-27T06:32:33.159Z", "date_updated": "2026-07-30T06:06:27.947Z", "publisher": "Linux", "title": "fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0013, "percentile": 0.03024 }, "nvd": { "published": "2026-07-27T08:16:22.383", "lastModified": "2026-07-30T06:25:57.087", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64532", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "NTFS3 uses the on-disk view.data_off as a memmove destination without checking view.data_off plus data length against the containing entry size, allowing an out-of-bounds write.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b20e5a709d8bd190d6e4645606763c7423e694c1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d41b382068ca4e64e421f736cdd700095464b6ac", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/429d653ca641d38a78609b8f62e81a0a5c780a2d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/315d3a9a48b49f889da3d858a9307e677cb9e1bd", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/be306b8d9143a9c076c804a7ca025d69caf9c448", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/36feda687afebae24c472202694448738809c411", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3e127829e57f5190f612412ece4541cb96d5ec7a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1273, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64533", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T06:32:33.740Z", "date_updated": "2026-07-30T06:06:29.019Z", "publisher": "Linux", "title": "fs/ntfs3: validate lcns_follow in log_replay conversion", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00137, "percentile": 0.03539 }, "nvd": { "published": "2026-07-27T08:16:22.510", "lastModified": "2026-07-30T06:25:57.223", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64533", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "NTFS3 derives a memmove length from an unconstrained on-disk lcns_follow count and accesses beyond the restart-table buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ca343a99806b4fc8e27c48f08be3445c5fcd1445", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ddfc8683e1a627dbf1b83bacf8961443dd654258", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57c071e2c4f30b9c6f5aacb6679aab1269fbae99", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/159f694d682e4215b3822ae31ed3a4631628fe55", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7adb38279812c9c06b0e3fa7382f4d7887f3fa2d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/32b9f8733feb241627fa5f564b1a99b5cae974c5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6a4c53a2e26a865565bd6a460961e8d6fcb32329", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1265, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64534", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T06:32:34.301Z", "date_updated": "2026-07-30T06:06:30.094Z", "publisher": "Linux", "title": "nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 20, "versionRangeCount": 20, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00384, "percentile": 0.31103 }, "nvd": { "published": "2026-07-27T08:16:22.643", "lastModified": "2026-07-30T06:25:57.350", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64534", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The digest-error path uninitializes a request whose initialization already failed, underflowing a reference count and leading to use-after-free behavior.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c7874dad84b20433c0fe3919f291a762d40de08b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d306da8833e75f669d93424fd84940236f3850bc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2ed3c9d955e8cd6361f130623baa664a75fb345f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4606467a75cfc16721937272ed29462a750b60c8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 792, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 20 } }, { "cve_id": "CVE-2026-64535", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T06:32:34.859Z", "date_updated": "2026-07-30T06:06:31.160Z", "publisher": "Linux", "title": "nvmet-tcp: Fix potential UAF when ddgst mismatch", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 14, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00473, "percentile": 0.38414 }, "nvd": { "published": "2026-07-27T08:16:22.773", "lastModified": "2026-07-30T06:25:57.470", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64535", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A digest mismatch uninitializes a command without marking it complete, so teardown later uninitializes the same command again.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/96fe2513df590e74b04253a45089cae75569570e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e091ff83d962f9ed00d9bd70443676de9fe98bdc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6f9442983a3e4227afd1c83a5251ddbca585ea21", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/088ee46c18d99baef453afd74181dd40ade044ad", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dbbd07d0a7020b80f6a7028e561908f7b83b3d5a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1000, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64536", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T06:36:04.736Z", "date_updated": "2026-07-30T06:06:32.237Z", "publisher": "Linux", "title": "staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00252, "percentile": 0.16708 }, "nvd": { "published": "2026-07-27T08:16:22.890", "lastModified": "2026-07-30T06:25:57.580", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64536", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "is_ap_in_tkip reads IE headers and vendor payload offsets without first checking the remaining buffer and element length.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ea3809f7e20bdff282b8cc1e94937d5fb9fb32c7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d2055332297e24c63fffda943ef7a5eefc0a6019", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6f26cc55affd9d7f88ae2f5d12db4ecf9072c209", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/204b22c8df115370037248859bf0fa62db73a396", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a6105ea8ca6ebbc04beaf3bcbf7dbb5985f5d395", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4380b3860d887a13555ff024a58dfc05b490dfd6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3bf39f711ff27c64be8680a8938bcc5001982e81", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 823, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64537", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T20:10:32.210Z", "date_updated": "2026-07-27T20:10:32.210Z", "publisher": "Linux", "title": "bridge: cfm: reject invalid CCM interval at configuration time", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00172, "percentile": 0.06879 }, "nvd": { "published": "2026-07-27T21:17:05.987", "lastModified": "2026-07-27T21:17:05.987", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64537", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The bridge CFM transmitter accepts a zero CCM interval and continuously requeues its work with no delay.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/2870056a78961e0fecd652362ee9d3fcfd24a8a6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f0f5eb59a97ece0d85de8cfa95dc18c609302a8b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/53788b134519e995699ea3721969c96a08d64575", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b42aeb58317f12024734759ff745856b53948873", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a090880c1f544589427e5b7050c40fb211ccecb4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/865643640b5b5c4579b32d7a55ac9ad648362eaa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f3e02edd8322b31b8e6517faa6ba053bf29d1e26", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 823, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64538", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T20:10:32.779Z", "date_updated": "2026-07-27T20:10:32.779Z", "publisher": "Linux", "title": "ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00176, "percentile": 0.07379 }, "nvd": { "published": "2026-07-27T21:17:06.130", "lastModified": "2026-07-27T21:17:06.130", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64538", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "fib6_nh_mtu_change re-fetches the IPv6 device state after interface teardown and dereferences the resulting NULL pointer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/d08d019f2f43a6f9a71e81868bbc326b3afaf37b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1451deca9896957159f0666520a792c1b861af4f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b2c70dd3326809429b709a9c7e9220d29923051a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/302d57ed7872838b40e56a868fb4c7da7da606e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/80600b5d0f3ecb9324120dc95b5e915130f516c5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b0d0eb13a0441a8ebf4f227843deaf494f1e2c33", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6428634f7a0b7878144b4925c37856bef3224967", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/46c3b8191aad3d032776bf3bebf03efdf5f4b905", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1116, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64539", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T20:10:33.363Z", "date_updated": "2026-07-30T06:06:33.307Z", "publisher": "Linux", "title": "Bluetooth: eir: Fix stack OOB write when prepending the Flags AD", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00122, "percentile": 0.02356 }, "nvd": { "published": "2026-07-27T21:17:06.277", "lastModified": "2026-07-30T06:25:57.697", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64539", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "It may prepend a 3-byte \"Flags\" AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data without checking that it still fits: memcpy(ptr, adv->adv_data, adv->adv_data_len); tlv_data_max_len() only reserves those 3 bytes when the user-supplied flags carry a managed-flags bit, so an instance added with flags == 0 is accepted with adv_data_len up to the full buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0f0b6232af56441d0a2dcb173cc4f8d8aab39014", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/09301f1fdf2aef8cce34d0c4650c30e7edb1ced9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f1b4df9c260c51726da2e86e19322825fddeefd0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/57077eeb586c42f124bc09e018449362223067b3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6f5fb689fdf80bdd143f22a502f9eb1f3c85e286", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1613, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64540", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T20:10:33.905Z", "date_updated": "2026-07-30T06:06:34.381Z", "publisher": "Linux", "title": "usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00277, "percentile": 0.19952 }, "nvd": { "published": "2026-07-27T21:17:06.407", "lastModified": "2026-07-30T06:25:57.817", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64540", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The GeneLink receive path trusts a device-supplied packet length without comparing it with the bytes actually received, copying beyond the receive buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/255d03551f94c7bdd86c7d9181a70b21917d829f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4359376e6238d89977a35086e47ca3b07f43e850", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8624e179fa3ce23c2fbd1a198ce30764b73f054a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/573418f7ea8f859a841417eb4b915594094fd967", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0575599e451aff3c5329922562374a2cab25fc51", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0a7d9c7c5f1f208c523abbb4db6aea7bc1fad3db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3ef79fa3860e644c8de7834fa7300e1c58f38862", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8ff7f2a6da4fccaa5cc9be7251a24e71e29fbd1a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1728, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64541", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T20:10:34.439Z", "date_updated": "2026-07-30T06:06:35.458Z", "publisher": "Linux", "title": "net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00521, "percentile": 0.41343 }, "nvd": { "published": "2026-07-27T21:17:06.570", "lastModified": "2026-07-30T06:25:57.950", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64541", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SMC receive handler drops conns_lock before taking a socket reference, allowing concurrent unregister and close to free the socket first.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ce5aa8084329351086894aa34d77e40301d5bd3d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1608, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64542", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T20:10:34.994Z", "date_updated": "2026-08-03T09:32:42.268Z", "publisher": "Linux", "title": "ipv6: ndisc: fix NULL deref in accept_untracked_na()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00168, "percentile": 0.06399 }, "nvd": { "published": "2026-07-27T21:17:06.730", "lastModified": "2026-08-03T10:16:32.820", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64542", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "accept_untracked_na re-fetches an IPv6 device pointer after a concurrent interface-down path can clear it, then dereferences the null result.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/160d3f0d7a556ceae505dcab521a37057b4ce28f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/62c719203cb521b64fab74da94a81bdde5c18808", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a6450f7cfae57b382cbaf66a577765c9a88b3c58", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/63d1c23764de2309cedbb779c75188d257a09d9b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d186e942365acece7c56d39da05dd63bf95b280a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1359, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64543", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T20:10:35.565Z", "date_updated": "2026-07-30T06:06:36.526Z", "publisher": "Linux", "title": "tipc: fix use-after-free of the discoverer in tipc_disc_rcv()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00125, "percentile": 0.02591 }, "nvd": { "published": "2026-07-27T21:17:06.850", "lastModified": "2026-07-30T06:25:58.083", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64543", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "UDP bearer teardown frees a TIPC discoverer without an RCU grace period while an RX softirq may still dereference it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/5e215bf1c47fdddf8203a0fe80a0ed594065f101", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ec7d54d8cc1723921d671e3272b427c96366506f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b65289e1c3f352a9f92c6e19713ddd647e033253", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1579342d71133da7f00daa02c75cebec7372097b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1693, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64544", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T20:10:36.101Z", "date_updated": "2026-07-27T20:10:36.101Z", "publisher": "Linux", "title": "crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00176, "percentile": 0.07378 }, "nvd": { "published": "2026-07-27T21:17:06.980", "lastModified": "2026-07-27T21:17:06.980", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64544", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Unsigned hash-length arithmetic underflows and produces a very large out-of-bounds read.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/89efd998470a93284b7ad5a20d4e0e3c6858ae8e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b798ada5a5d1cb4cc4cfa72074b1b463eca6c506", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/627938383761fb4334b41ebe7ef438d6b8b19d60", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e162bc386e71b5412425a38ee048e8d2185491b9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6acd2fbd00f9c72aebefce63fc2e73e8f3d79061", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/803591785d33cf13b6f73ce2796e8b9e6d5e6526", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f7dd32c5179d7755de18e21d5674b08f9e5cb180", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1217, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64545", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T20:10:36.659Z", "date_updated": "2026-07-30T06:06:37.589Z", "publisher": "Linux", "title": "net, bpf: check master for NULL in xdp_master_redirect()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00496, "percentile": 0.39845 }, "nvd": { "published": "2026-07-27T21:17:07.130", "lastModified": "2026-07-30T06:25:58.200", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64545", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Bond teardown removes the upper-master link before clearing the slave flag, so XDP can observe a slave state with a null master and dereference it.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c99ca049e910d61ddbd28cc2c47242f2bfbb4970", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e2a56441233131fe18a76001de347ecda217e40c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3876318ea54e83eb70982b8280a3c5e4e32269bf", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4edbcacca09f92b85d3951b6add11894b20a84bc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/03b743586a2469744e96e9c1015096d07240935d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/89c103d702b25ceb2d097faf854deb47b53b17ff", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e82d8cc4321c373dc46e741cd2dfdaa7921fddb7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1662, "referenceCount": 7, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64546", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T20:10:37.217Z", "date_updated": "2026-07-30T06:06:38.661Z", "publisher": "Linux", "title": "drm/edid: fix OOB read in drm_parse_tiled_block()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02632 }, "nvd": { "published": "2026-07-27T21:17:07.270", "lastModified": "2026-07-30T06:25:58.330", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64546", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "drm_parse_tiled_block reads the fixed tiled-display structure without first requiring the declared DisplayID payload to contain all 22 bytes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/157727131ce8a52d8d9bc676c372ef82db6436c4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4f5484d25f85ad6c989bad5f6a43450cecfcfd28", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9cc0f8e63e8c34cf43def35cbd305ba711181a1f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/faaa1e1155833e7d4ce7e3cfaf64c0d636b190db", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1421, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64547", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T20:10:37.786Z", "date_updated": "2026-07-30T06:06:39.748Z", "publisher": "Linux", "title": "net: usb: net1080: validate packet_len before pad-byte access in rx_fixup", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00277, "percentile": 0.19953 }, "nvd": { "published": "2026-07-27T21:17:07.427", "lastModified": "2026-07-30T06:25:58.463", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64547", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "net1080_rx_fixup reads a pad byte at a device-declared packet length before checking that the offset lies within the received socket buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f42217fa7d535e9ec4151f7971f06f6ea65e850a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c087749815379e9af2fdbeb08bfc33870b103958", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e4a87126c085b097d29e17e3b7647295bba8be7c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/685e92934f11d5e215dad58813e2f9955ac2f436", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4dc8484be3302d187274364820d3bef6c62bde32", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b153cfe84b1340c69a13d0957665a2bfcf21239c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ea866cab12db1a2100b400a8b03569e5bc0ee29a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/03f384bc0cb8d4a1301d4f5b0baef2d980258383", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 956, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64548", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T20:10:38.355Z", "date_updated": "2026-07-30T06:06:40.825Z", "publisher": "Linux", "title": "bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00144, "percentile": 0.04128 }, "nvd": { "published": "2026-07-27T21:17:07.570", "lastModified": "2026-07-30T06:25:58.590", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64548", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "bpf_msg_push_data adds two u32 lengths without an overflow check, allocates the wrapped size, and then copies beyond the allocation.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a12b1575f9feabd91695a9e9d004862f7195fa25", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/888706a76286c547bd035432602571e8024b5305", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/db77b6bb6e6edb79b10b4efcce346eec5582d588", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4e40056bb5c829f0423f0a6694a0477726d2147e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bd004716ba75fed6d185795c85cdc92540ebeaab", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/0c0a8ed85349dae298712d79cb276acfeb794d82", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1050, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64549", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.795Z", "date_published": "2026-07-27T20:10:38.894Z", "date_updated": "2026-07-27T20:10:38.894Z", "publisher": "Linux", "title": "Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.0018, "percentile": 0.07805 }, "nvd": { "published": "2026-07-27T21:17:07.720", "lastModified": "2026-07-27T21:17:07.720", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64549", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "bpa10x prints a device response as a null-terminated string without checking that bytes remain after the status byte or contain a terminator.", "basis": [ "CNA record" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/1813add71e386f77b3040e6c8dc9b7b3ff965a6c", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bd56c23f1f8681a2857ee924a8bd3abf87c8913b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7a64f39ebe1bacd9004a62eceadac0b122ec3cc2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f80b4afe893dffa9fabdbf80fb4d6782b24a6793", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4b4008dda1d0c6e598d7865631ad4eda63a560f0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bfc9e7be289df11e8e38c98cd78019d67fdd0bd5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a8e169d308775039200bb9c905c7ce420db6e8c5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dd068ef044128db655f48323a4acfd5907e04903", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1024, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64550", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.796Z", "date_published": "2026-07-27T20:10:39.459Z", "date_updated": "2026-07-30T06:06:41.902Z", "publisher": "Linux", "title": "net: qualcomm: rmnet: validate MAP frame length before ingress parsing", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H" } ], "max_cvss_observed_across_sources": 7.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02631 }, "nvd": { "published": "2026-07-27T21:17:07.867", "lastModified": "2026-07-30T06:25:58.720", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64550", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The non-deaggregation ingress path skips MAP frame-length validation and dereferences header and checksum fields beyond a short packet.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/ed25befc8c36f896b5878f9078faddb67fd7e2d0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a54d76d176e50d2fdbd39b7231efe256170339e4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/00f4c366dbca16a40772c3b7ec2d8cba839e9724", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/3868c3244369ab709a90c9aad7534d406009b824", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/14eb0c9491385d5361a292ea4974aec0e6887299", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1b12612c367e4be9b0814c0468e7e687835315b4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/231a8a4b76cb1b1827b3b19d7b3603642f5aaaef", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f0f1887a9e30712a1df03e152dce6fb91344b1f3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1500, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64551", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.796Z", "date_published": "2026-07-27T20:10:40.012Z", "date_updated": "2026-07-30T06:06:42.965Z", "publisher": "Linux", "title": "sctp: validate STALE_COOKIE cause length before reading staleness", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00521, "percentile": 0.41343 }, "nvd": { "published": "2026-07-27T21:17:08.020", "lastModified": "2026-07-30T06:25:58.853", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64551", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The SCTP stale-cookie handler reads a four-byte staleness value without first requiring that the selected cause contains those bytes.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/6022da37786701df1fc5dd946a6dcba59d5473b1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/861f884f5471632c731cbbd612a1c072e391a624", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/588706ebaf8cdb4a4161602949eba365514b1db1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a257b41ddfe9e327b26581ad2777f04b23ac73f5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/08a8f2d13f703924316e9aeac863a88ef50990c7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ebe0a55d954fa8da383b6192edb8f763dcb002d5", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/bbd6b2ea966cf57b6ae095cf5a8dbc993cd197a0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1cd23ca80784223fa2204e16203f754da4e821f8", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1304, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64552", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.796Z", "date_published": "2026-07-27T20:10:40.570Z", "date_updated": "2026-07-30T06:06:44.048Z", "publisher": "Linux", "title": "virtio-net: fix len check in receive_big()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 19, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00144, "percentile": 0.04128 }, "nvd": { "published": "2026-07-27T21:17:08.173", "lastModified": "2026-07-30T06:25:58.987", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64552", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A permissive length check lets page_to_skb advance one fragment past the end of the fragment array.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 882, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 19 } }, { "cve_id": "CVE-2026-64553", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.796Z", "date_published": "2026-07-27T20:10:41.159Z", "date_updated": "2026-07-27T20:10:41.159Z", "publisher": "Linux", "title": "net: psample: fix info leak in PSAMPLE_ATTR_DATA", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "epss": { "score": 0.00176, "percentile": 0.07379 }, "nvd": { "published": "2026-07-27T21:17:08.307", "lastModified": "2026-07-27T21:17:08.307", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64553", "family": "EXPOSURE_OUTPUT", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The psample implementation omits zeroing netlink alignment padding, disclosing up to three bytes of uninitialized kernel data.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0d3ea2ccddda442077fc44f11d873209c97ec50b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7fe7e6949964aa8ee6305f09db2dc9eede977bb3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e2fa322782a2d7d8078f7bb20817e0aa9f7c32e9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/befe1ebe7fc2c65c80074bc34ceeb0a721ed3cd2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/48930f6c59fd0056c2de46ce52bfe27d9c9e5eb6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a6cfb924ad74efce254e99c197d2e3863de70868", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/794a0d8bdbb39e083ed42caccb86d687a9b53570", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/aedd02af1f8b0bceb7f42f5a21c41634ca9ed390", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 359, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 0, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64554", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.796Z", "date_published": "2026-07-27T20:10:41.726Z", "date_updated": "2026-07-30T06:06:45.125Z", "publisher": "Linux", "title": "netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00258, "percentile": 0.17427 }, "nvd": { "published": "2026-07-27T21:17:08.437", "lastModified": "2026-07-30T06:25:59.110", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64554", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A checksum reallocation replaces the skb data area while code retains and later uses the previous header pointer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/8c10778ec674b67a07ea042fcba64270f3f38a5a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2731efa6364e47934c96eb69e01ea131e8af8030", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/00c06ef8c018493943891a7d0ca82b71b24f3180", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/c141f69d0a0fb16964dbc293650047e69bda8af7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/f2e6596d10783557aeb9668da2a3b4d19deb2001", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1c4f67c89fd27c4df4c70b135c2c59627698b3c0", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/4ac981a8b7ce7aec99a52d08f8a8953e8e120067", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1524, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64555", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.796Z", "date_published": "2026-07-27T20:10:42.259Z", "date_updated": "2026-07-30T06:06:46.197Z", "publisher": "Linux", "title": "KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00128, "percentile": 0.02893 }, "nvd": { "published": "2026-07-27T21:17:08.580", "lastModified": "2026-07-30T06:25:59.240", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64555", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Nested KVM writes a synthetic vCPU status value directly to SPSR_EL2 without translating it into hardware state during MOPS exception rewind.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/10a568010e827108d149779908850afaec898846", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/884b44256041ec6b2dcbe8e6a67384d26145cba1", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/dd3b237eb7780d65eae296d3d3a70012b6e7a02f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ff1022c3de46753eb7eba2f6efd990569e66ff95", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 718, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64556", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.796Z", "date_published": "2026-07-29T08:01:46.864Z", "date_updated": "2026-07-30T06:06:47.272Z", "publisher": "Linux", "title": "perf/core: Detach event groups during remove_on_exec", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 12, "versionRangeCount": 11, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02154 }, "nvd": { "published": "2026-07-29T09:16:30.153", "lastModified": "2026-07-30T06:25:59.350", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64556", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "remove_on_exec can delete a perf group leader without detaching surviving siblings from the stale group state.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/39358e856fb89e62e3c8d7389a2dc4ec33dbe90e", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/a2d5d3ee7b6e3953114726b1521e62123ab5b043", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/06ccef0434e98058ddae7bcebc901f93d22b7653", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/037a3c43edfb597665dd34457cd22b14692f2ba3", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1189, "referenceCount": 5, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 12 } }, { "cve_id": "CVE-2026-64557", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.796Z", "date_published": "2026-07-29T08:01:47.462Z", "date_updated": "2026-07-30T06:06:48.348Z", "publisher": "Linux", "title": "Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 14, "versionRangeCount": 13, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00236, "percentile": 0.14672 }, "nvd": { "published": "2026-07-29T09:16:30.280", "lastModified": "2026-07-30T06:25:59.477", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64557", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The L2CAP callback drops the parent lock before dereferencing a newly queued child that another thread can accept and free.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 1123, "referenceCount": 6, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 14 } }, { "cve_id": "CVE-2026-64558", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.796Z", "date_published": "2026-07-29T16:31:21.591Z", "date_updated": "2026-07-30T06:06:49.426Z", "publisher": "Linux", "title": "s390/pkey: Check length in pkey_pckmo handler implementation", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02132 }, "nvd": { "published": "2026-07-29T17:16:53.410", "lastModified": "2026-07-30T06:25:59.600", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64558", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A target handler trusts a caller-provided buffer length and can access beyond the supplied command buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/02028a24e26d85262ab9c8fc4344e1f3503007fc", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/433e5e70cdc1edf382d28d08a885b22e2b98b7da", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/614aa0491c7a190556c2345dddee0b6f5ed90989", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/1ac287e2af9a9112fe271427ef45eceb26bce8b4", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 361, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64559", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.796Z", "date_published": "2026-07-29T16:31:22.195Z", "date_updated": "2026-07-30T06:06:50.520Z", "publisher": "Linux", "title": "s390/pkey: Check length in PKEY_VERIFYPROTK ioctl", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 10, "versionRangeCount": 9, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02134 }, "nvd": { "published": "2026-07-29T17:16:53.523", "lastModified": "2026-07-30T06:25:59.707", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64559", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The PKEY_VERIFYPROTK ioctl trusts a userspace length that can exceed the fixed request buffer.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/0a9e34ccbe772b8f321388cdbdf4f22b94e513e7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/693bf91d4db134f9b1c2840c8e287eee3d993bac", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/7e7e03848c918aa0acad5ffd75d929e3afec1554", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 236, "referenceCount": 4, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 10 } }, { "cve_id": "CVE-2026-64560", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.796Z", "date_published": "2026-07-29T16:47:17.602Z", "date_updated": "2026-07-30T11:10:46.176Z", "publisher": "Linux", "title": "posix-cpu-timers: Prevent UAF caused by non-leader exec() race", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 18, "versionRangeCount": 17, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02172 }, "nvd": { "published": "2026-07-29T17:16:53.637", "lastModified": "2026-07-30T12:19:03.630", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64560", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A non-leader exec can replace and release the task leader while timer deletion still acts on the old task, leaving an armed timer node after its object is freed.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/67aa823e3e8c229c6d374df79c804f6721cb83b6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/d8bcb28abad857f1415da7656f19b2ada90af04f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/12a891c773aeb5823d63dbd0cb2ab931d6c21c9b", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e74443f5db0037c556ef436fa64b88bf4ea08f83", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/6a7ecc25abe6f0fecc6e62a05096987200edbd02", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/ad1cafa1bdaa71da85d71cac053838bbe97852b6", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/920f893f735e92ba3a1cd9256899a186b161928d", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 3998, "referenceCount": 8, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 18 } }, { "cve_id": "CVE-2026-64600", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-19T15:36:31.799Z", "date_published": "2026-07-23T05:46:56.149Z", "date_updated": "2026-08-03T20:31:20.507Z", "publisher": "Linux", "title": "xfs: resample the data fork mapping after cycling ILOCK", "affected": { "vendors": [ "Linux" ], "products": [ { "vendor": "Linux", "product": "Linux" } ], "affectedBlockCount": 2, "versionEntryCount": 16, "versionRangeCount": 15, "defaultStatuses": [ "affected", "unaffected" ] }, "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00507, "percentile": 0.40507 }, "nvd": { "published": "2026-07-23T06:16:50.493", "lastModified": "2026-08-03T21:16:41.060", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64600", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "XFS cycles its inode lock and then continues with a stale data-fork mapping even though concurrent work may have changed it.", "basis": [ "CNA" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://git.kernel.org/stable/c/dc11be133efca5fe3a2fb02b016dee825cc12f18", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/b8c9aa832b52680ee40d6cab0efb081f9a69df05", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/50f0012da1040f69a4e788cd9aed587c9a04983f", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/e705d81a7193dd19e69b8e2bad4696d78a4ea075", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/206c09b04dc5469c7ff14d8aceff2d47c88078d9", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/44f891bc088958399eec27f7604928694aa35581", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://git.kernel.org/stable/c/2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7", "host": "git.kernel.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt", "host": "cdn2.qualys.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/22/14", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/22/18", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/22/19", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/31/3", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/03/4", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/03/8", "host": "www.openwall.com", "sources": [ "adp:0", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 872, "referenceCount": 14, "cweCount": 0, "cnaCweCount": 0, "adpCweCount": 0, "nvdCweCount": 0, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 16 } }, { "cve_id": "CVE-2026-64606", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T08:21:55.786Z", "date_published": "2026-07-21T10:43:51.436Z", "date_updated": "2026-07-21T18:28:15.293Z", "publisher": "apache", "title": "Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface", "affected": { "vendors": [ "Apache Software Foundation" ], "products": [ { "vendor": "Apache Software Foundation", "product": "Apache Fory" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00634, "percentile": 0.46911 }, "nvd": { "published": "2026-07-21T11:16:27.973", "lastModified": "2026-07-27T13:47:41.580", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64606", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Java lambda deserialization auto-admits a SerializedLambda capture interface and thereby bypasses the class-registration boundary for untrusted serialized data.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://lists.apache.org/thread/py6fbvm9nk1gxdd85rbzbozwzfh0jrsc", "host": "lists.apache.org", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Vendor Advisory", "vendor-advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/21/4", "host": "www.openwall.com", "sources": [ "adp:1", "nvd" ], "tags": [ "Third Party Advisory" ] } ], "record_shape": { "descriptionChars": 305, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64607", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T08:23:45.493Z", "date_published": "2026-07-31T10:12:18.035Z", "date_updated": "2026-07-31T16:25:02.593Z", "publisher": "apache", "title": "Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS", "affected": { "vendors": [ "Apache Software Foundation" ], "products": [ { "vendor": "Apache Software Foundation", "product": "Apache HttpComponents Client" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00238, "percentile": 0.14889 }, "nvd": { "published": "2026-07-31T11:17:11.710", "lastModified": "2026-08-04T12:31:51.160", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64607", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Apache HttpComponents Client error path does not release a resource after use, so repeated requests exhaust the available pool.", "basis": [ "CNA", "CWE-772" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q", "host": "lists.apache.org", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 387, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64608", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T08:33:04.879Z", "date_published": "2026-07-21T09:34:12.817Z", "date_updated": "2026-07-21T18:28:16.365Z", "publisher": "apache", "title": "Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths", "affected": { "vendors": [ "Apache Software Foundation" ], "products": [ { "vendor": "Apache Software Foundation", "product": "Apache Fory" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type ('Type Confusion')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00372, "percentile": 0.29938 }, "nvd": { "published": "2026-07-21T10:16:24.923", "lastModified": "2026-07-21T19:17:13.040", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64608", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Fory's compatible deserializer skips fields without validating declared types and reaches type-confused out-of-bounds access.", "basis": [ "CNA", "CWE-502", "CWE-787", "CWE-843" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://lists.apache.org/thread/wl05slf57zzoq1s4pg4tk6nx6mjyjr4b", "host": "lists.apache.org", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/21/5", "host": "www.openwall.com", "sources": [ "adp:1", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 557, "referenceCount": 2, "cweCount": 3, "cnaCweCount": 3, "adpCweCount": 0, "nvdCweCount": 3, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64609", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T08:46:26.713Z", "date_published": "2026-07-21T09:34:57.010Z", "date_updated": "2026-07-21T18:28:17.440Z", "publisher": "apache", "title": "Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization", "affected": { "vendors": [ "Apache Software Foundation" ], "products": [ { "vendor": "Apache Software Foundation", "product": "Apache Fory" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-125", "name": "Out-of-bounds Read", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00476, "percentile": 0.38643 }, "nvd": { "published": "2026-07-21T10:16:25.057", "lastModified": "2026-07-27T13:47:44.540", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64609", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In Apache Fory, an attacker-controlled index or length permits a read beyond the valid memory region.", "basis": [ "CNA", "CWE-125" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://lists.apache.org/thread/rdv22ks3b0cxh0r52w3ghxgkxqso3f1b", "host": "lists.apache.org", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/21/6", "host": "www.openwall.com", "sources": [ "adp:1", "nvd" ], "tags": [ "Third Party Advisory" ] } ], "record_shape": { "descriptionChars": 539, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64611", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:15:34.675Z", "date_published": "2026-07-23T10:46:49.957Z", "date_updated": "2026-07-23T20:15:01.235Z", "publisher": "redhat", "title": "Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()", "affected": { "vendors": [ "Red Hat" ], "products": [ { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9" } ], "affectedBlockCount": 5, "versionEntryCount": 0, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:secalert@redhat.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00339, "percentile": 0.26486 }, "nvd": { "published": "2026-07-23T11:16:40.680", "lastModified": "2026-07-23T21:17:05.330", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64611", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Red Hat Enterprise Linux 10 can enter a loop whose exit condition is never reached for the crafted input or state, consuming CPU indefinitely.", "basis": [ "CNA", "NVD", "CWE-835" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2026-64611", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502799", "host": "bugzilla.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "x_refsource_REDHAT" ] }, { "url": "https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-rcq7-rv5g-j3r4", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 358, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 0 } }, { "cve_id": "CVE-2026-64612", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:15:34.675Z", "date_published": "2026-07-20T17:33:01.878Z", "date_updated": "2026-07-21T17:31:26.245Z", "publisher": "redhat", "title": "Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed png", "affected": { "vendors": [ "Red Hat" ], "products": [ { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9" } ], "affectedBlockCount": 5, "versionEntryCount": 0, "versionRangeCount": 0, "defaultStatuses": [ "affected", "unaffected", "unknown" ] }, "cwes": [ { "id": "CWE-248", "name": "Uncaught Exception", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:secalert@redhat.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0035, "percentile": 0.27628 }, "nvd": { "published": "2026-07-20T18:16:56.273", "lastModified": "2026-07-21T18:31:51.680", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64612", "family": "OTHER_SPECIFIC", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The PNG reader omits libpng's error-recovery handler, so a malformed print image aborts the active filter process.", "basis": [ "CNA", "NVD", "CWE-248" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2026-64612", "host": "access.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502801", "host": "bugzilla.redhat.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "x_refsource_REDHAT" ] }, { "url": "https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-7mxj-cfq5-84ch", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 391, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 0 } }, { "cve_id": "CVE-2026-64613", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:30:10.287Z", "date_published": "2026-07-21T19:05:49.579Z", "date_updated": "2026-07-23T12:25:36.375Z", "publisher": "CPANSec", "title": "Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::Buffer::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00147, "percentile": 0.04448 }, "nvd": { "published": "2026-07-21T20:17:03.967", "lastModified": "2026-07-23T13:16:29.300", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64613", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Data::Buffer::Shared creates shared backing files world-readable and follows a pre-existing symlink when attaching to a named segment.", "basis": [ "CNA", "NVD", "CWE-59", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-Buffer-Shared-0.05/diff/EGOR/Data-Buffer-Shared-0.04#buf_generic.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-Buffer-Shared-0.05/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 699, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64614", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:30:10.287Z", "date_published": "2026-07-21T19:06:15.526Z", "date_updated": "2026-07-23T12:40:40.462Z", "publisher": "CPANSec", "title": "Data::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::Deque::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 3.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00119, "percentile": 0.02074 }, "nvd": { "published": "2026-07-21T20:17:04.070", "lastModified": "2026-07-23T13:16:29.927", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64614", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The shared-memory path creates a world-writable file without exclusive creation or symlink refusal, so a preplanted path can redirect the object selected.", "basis": [ "CNA", "CWE-59", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-Deque-Shared-0.06/diff/EGOR/Data-Deque-Shared-0.05#deque.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-Deque-Shared-0.06/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 742, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64615", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:30:10.287Z", "date_published": "2026-07-21T19:06:32.520Z", "date_updated": "2026-07-23T12:32:41.256Z", "publisher": "CPANSec", "title": "Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::Graph::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 3.3, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 3.3, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 3.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00119, "percentile": 0.02074 }, "nvd": { "published": "2026-07-21T20:17:04.187", "lastModified": "2026-07-23T13:16:30.570", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64615", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Data Graph Shared creates its mmap file with world-readable permissions and without exclusive or no-follow protections in a shared namespace.", "basis": [ "CNA", "CWE-59", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-Graph-Shared-0.04/diff/EGOR/Data-Graph-Shared-0.03#graph.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-Graph-Shared-0.04/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 742, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64616", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:30:10.287Z", "date_published": "2026-07-21T19:06:50.604Z", "date_updated": "2026-07-30T16:53:56.277Z", "publisher": "CPANSec", "title": "Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::NDArray::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 3.3, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 3.3, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 3.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00117, "percentile": 0.01926 }, "nvd": { "published": "2026-07-21T20:17:04.290", "lastModified": "2026-07-30T19:18:35.227", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64616", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Data::NDArray::Shared creates a predictable world-readable backing path without O_EXCL or O_NOFOLLOW, allowing precreation or symlink substitution of the selected file.", "basis": [ "CNA", "CWE-59", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-NDArray-Shared-0.02/diff/EGOR/Data-NDArray-Shared-0.01#ndarray.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-NDArray-Shared-0.02/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 746, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64617", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:30:10.287Z", "date_published": "2026-07-21T19:07:06.617Z", "date_updated": "2026-07-23T12:46:23.202Z", "publisher": "CPANSec", "title": "Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::PubSub::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 3.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00117, "percentile": 0.01928 }, "nvd": { "published": "2026-07-21T20:17:04.403", "lastModified": "2026-07-23T13:16:31.193", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64617", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.", "basis": [ "CNA", "CWE-59", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-PubSub-Shared-0.07/diff/EGOR/Data-PubSub-Shared-0.06#pubsub.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-PubSub-Shared-0.07/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 744, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64619", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:58:54.523Z", "date_published": "2026-07-20T18:50:12.359Z", "date_updated": "2026-07-28T01:05:55.926Z", "publisher": "VulnCheck", "title": "FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers", "affected": { "vendors": [ "vastsa" ], "products": [ { "vendor": "vastsa", "product": "FileCodeBox" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-348", "name": "Use of Less Trusted Source", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 1.1999999999999993, "epss": { "score": 0.00202, "percentile": 0.10299 }, "nvd": { "published": "2026-07-20T19:17:30.373", "lastModified": "2026-07-23T15:23:01.470", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64619", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin.", "basis": [ "CNA", "CWE-348" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/vastsa/FileCodeBox/issues/479", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "technical-description" ] }, { "url": "https://github.com/vastsa/FileCodeBox/releases/tag/V2.4", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch", "release-notes" ] }, { "url": "https://github.com/vastsa/FileCodeBox/commit/1b6d8e7277d3cfa34dc7a85803731d927b2147da", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/filecodebox-anti-bruteforce-rate-limit-bypass-via-spoofed-headers", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 442, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64620", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:58:54.524Z", "date_published": "2026-07-20T12:04:53.105Z", "date_updated": "2026-07-21T11:08:25.119Z", "publisher": "VulnCheck", "title": "FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_common", "affected": { "vendors": [ "FreeRDP" ], "products": [ { "vendor": "FreeRDP", "product": "FreeRDP" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-122", "name": "Heap-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0.7000000000000011, "epss": { "score": 0.00851, "percentile": 0.54654 }, "nvd": { "published": "2026-07-20T12:19:46.760", "lastModified": "2026-07-28T15:38:19.810", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64620", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "crypto_rsa_common() writes the full RSA result into a caller buffer before comparing the result length with that buffer's capacity.", "basis": [ "CNA", "CWE-122" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjqx-v446-x7fc", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Exploit", "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://github.com/FreeRDP/FreeRDP/commit/1f7a716d39b5605bb8a83b0c3c97a6ce386609ef", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "patch" ] }, { "url": "https://www.vulncheck.com/advisories/freerdp-before-heap-buffer-overflow-via-crypto-rsa-common", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 797, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 5, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64621", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:58:54.524Z", "date_published": "2026-07-20T12:04:53.788Z", "date_updated": "2026-07-23T18:52:59.996Z", "publisher": "VulnCheck", "title": "FreeRDP before 3.28.0 Double-Free via selectedmonitors", "affected": { "vendors": [ "FreeRDP" ], "products": [ { "vendor": "FreeRDP", "product": "FreeRDP" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-415", "name": "Double Free", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 2.000000000000001, "epss": { "score": 0.00304, "percentile": 0.22709 }, "nvd": { "published": "2026-07-20T12:19:46.910", "lastModified": "2026-07-28T15:34:52.930", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64621", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The selectedmonitors error path frees a non-owning settings pointer without clearing the owner, so teardown frees the same allocation a second time.", "basis": [ "CNA", "CWE-415" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f27x-frr8-j9hc", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "Exploit", "Mitigation", "Vendor Advisory", "exploit", "vendor-advisory" ] }, { "url": "https://github.com/FreeRDP/FreeRDP/commit/1f7a716d39b5605bb8a83b0c3c97a6ce386609ef", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "patch" ] }, { "url": "https://www.vulncheck.com/advisories/freerdp-before-double-free-via-selectedmonitors", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 707, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64622", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:58:54.524Z", "date_published": "2026-07-20T12:04:54.541Z", "date_updated": "2026-07-21T11:08:26.395Z", "publisher": "VulnCheck", "title": "Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox", "affected": { "vendors": [ "Jovancoding" ], "products": [ { "vendor": "Jovancoding", "product": "Network-AI" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 1.8000000000000007, "epss": { "score": 0.00408, "percentile": 0.33584 }, "nvd": { "published": "2026-07-20T12:19:47.057", "lastModified": "2026-07-23T15:23:01.470", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64622", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The affected action runs without the capability or object-level authorization check required for that caller.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-m4jg-6w3q-gm86", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/network-ai-through-missing-authorization-via-approvalinbox", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 711, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64623", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:58:54.524Z", "date_published": "2026-07-20T12:04:55.262Z", "date_updated": "2026-07-20T13:49:02.553Z", "publisher": "VulnCheck", "title": "Network-AI before 5.13.4 Cryptographic Signature Verification Bypass", "affected": { "vendors": [ "Jovancoding" ], "products": [ { "vendor": "Jovancoding", "product": "Network-AI" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-347", "name": "Improper Verification of Cryptographic Signature", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.8, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.8, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.20000000000000107, "epss": { "score": 0.002, "percentile": 0.09987 }, "nvd": { "published": "2026-07-20T12:19:47.200", "lastModified": "2026-07-23T15:23:01.470", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64623", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Network-AI accepts signed material without completing the cryptographic signature verification required for authenticity.", "basis": [ "CNA", "CWE-347" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-3jf7-33vc-hgf4", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/network-ai-before-cryptographic-signature-verification-bypass", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 393, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64624", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:58:54.524Z", "date_published": "2026-07-20T21:50:53.693Z", "date_updated": "2026-07-24T20:17:15.015Z", "publisher": "VulnCheck", "title": "FreeRDP RDP File Parser Remote Code Execution via CLI Options", "affected": { "vendors": [ "FreeRDP" ], "products": [ { "vendor": "FreeRDP", "product": "FreeRDP" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-88", "name": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 0.7000000000000002, "epss": { "score": 0.0018, "percentile": 0.07835 }, "nvd": { "published": "2026-07-20T22:17:18.600", "lastModified": "2026-07-29T15:21:10.700", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64624", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The RDP file parser treats slash-prefixed file lines as raw command-line options and exposes privileged CLI behaviors to untrusted documents.", "basis": [ "CNA", "CWE-88" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rq8f-9xjh-pr3m", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/freerdp-rdp-file-parser-remote-code-execution-via-cli-options", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 367, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64625", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:58:54.524Z", "date_published": "2026-07-20T21:50:54.340Z", "date_updated": "2026-07-23T14:35:06.225Z", "publisher": "VulnCheck", "title": "AVideo before 29.0 OS Command Injection via execAsync", "affected": { "vendors": [ "WWBN" ], "products": [ { "vendor": "WWBN", "product": "AVideo" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00351, "percentile": 0.27831 }, "nvd": { "published": "2026-07-20T22:17:18.740", "lastModified": "2026-07-23T15:23:01.470", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64625", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Rewrapping a command through sh -c preserves command-substitution syntax despite escapeshellarg.", "basis": [ "CNA", "CWE-78" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-rc5x-vh5v-473f", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/avideo-before-os-command-injection-via-execasync", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 313, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64626", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:58:54.524Z", "date_published": "2026-07-20T21:50:54.991Z", "date_updated": "2026-07-22T14:17:17.491Z", "publisher": "VulnCheck", "title": "AVideo Encoder downloadURL SSRF via unpinned retry fallback", "affected": { "vendors": [ "WWBN" ], "products": [ { "vendor": "WWBN", "product": "AVideo" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.4, "cvss_source_score_spread": 1.1000000000000005, "epss": { "score": 0.00186, "percentile": 0.08437 }, "nvd": { "published": "2026-07-20T22:17:18.873", "lastModified": "2026-07-23T15:23:01.470", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64626", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The encoder's retry path follows redirects without preserving the DNS-pinned destination validation.", "basis": [ "CNA record", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-fr98-mjq9-7jmj", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://github.com/WWBN/AVideo/commit/0dbadbcaaa1b415c7db078a72dc4b26d9fac0485", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "related" ] }, { "url": "https://www.vulncheck.com/advisories/avideo-encoder-downloadurl-ssrf-via-unpinned-retry-fallback", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 409, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64627", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:58:54.524Z", "date_published": "2026-07-21T11:39:55.087Z", "date_updated": "2026-07-28T01:05:56.657Z", "publisher": "VulnCheck", "title": "Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion", "affected": { "vendors": [ "parse-community" ], "products": [ { "vendor": "parse-community", "product": "parse-server" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-209", "name": "Generation of Error Message Containing Sensitive Information", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 6.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00279, "percentile": 0.2011 }, "nvd": { "published": "2026-07-21T12:19:00.450", "lastModified": "2026-07-23T15:24:59.880", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64627", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "parse-server returns internal error details to an observer who should not receive them.", "basis": [ "CNA", "CWE-209" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-9g8f-h8f3-hjcm", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/parse-server-schema-disclosure-via-graphql-variable-coercion", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 879, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-64628", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T11:58:54.524Z", "date_published": "2026-07-21T11:39:55.742Z", "date_updated": "2026-07-23T18:22:05.939Z", "publisher": "VulnCheck", "title": "Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers", "affected": { "vendors": [ "getgrav" ], "products": [ { "vendor": "getgrav", "product": "grav" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0.3000000000000007, "epss": { "score": 0.0015, "percentile": 0.04687 }, "nvd": { "published": "2026-07-21T12:19:00.633", "lastModified": "2026-07-23T19:17:03.740", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64628", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Grav's shortcode scan looks only for literal angle brackets, allowing executable shortcode attributes to reach rendered HTML.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/grav-stored-cross-site-scripting-via-shortcode-attribute-handlers", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 445, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64635", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T15:00:00.696Z", "date_published": "2026-07-30T06:02:49.984Z", "date_updated": "2026-07-30T12:44:36.592Z", "publisher": "hackerone", "title": "Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link.", "affected": { "vendors": [ "Veeam" ], "products": [ { "vendor": "Veeam", "product": "Service Provider Console" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-640", "name": "Weak Password Recovery Mechanism for Forgotten Password", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:support@hackerone.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.0019, "percentile": 0.08922 }, "nvd": { "published": "2026-07-30T06:25:59.930", "lastModified": "2026-07-30T13:16:54.110", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64635", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The forgot-password flow accepts an attacker-controlled returnUrl domain and places the reset code in a link sent to the victim.", "basis": [ "CNA", "CWE-640" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.veeam.com/kb4853", "host": "www.veeam.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 374, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64641", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T17:11:30.895Z", "date_published": "2026-07-27T17:40:01.137Z", "date_updated": "2026-07-27T18:54:59.134Z", "publisher": "GitHub_M", "title": "Next.js: Denial of Service in App Router using Server Actions", "affected": { "vendors": [ "vercel" ], "products": [ { "vendor": "vercel", "product": "next.js" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-834", "name": "Excessive Iteration", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0.6999999999999993, "epss": { "score": 0.00599, "percentile": 0.45313 }, "nvd": { "published": "2026-07-27T18:16:58.850", "lastModified": "2026-07-29T14:36:32.130", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64641", "family": "RESOURCE_CONTROL", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The record ties crafted Next.js App Router Server Action requests to excessive CPU in one process but does not disclose the repeated operation or missing work bound.", "basis": [ "CNA record", "NVD", "CWE-834" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "x_refsource_CONFIRM" ] }, { "url": "https://github.com/vercel/next.js/pull/96013", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v15.5.21", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v16.2.11", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 382, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64642", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T17:11:30.895Z", "date_published": "2026-07-27T17:45:40.761Z", "date_updated": "2026-07-28T15:20:33.639Z", "publisher": "GitHub_M", "title": "Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale", "affected": { "vendors": [ "vercel" ], "products": [ { "vendor": "vercel", "product": "next.js" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-285", "name": "Improper Authorization", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "4.0", "score": 8.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" } ], "max_cvss_observed_across_sources": 8.3, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00948, "percentile": 0.57745 }, "nvd": { "published": "2026-07-27T18:16:59.010", "lastModified": "2026-07-29T14:36:59.730", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64642", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Crafted requests can bypass middleware authentication in a specific App Router, Turbopack, and single-locale configuration, but the causal routing mismatch is not public.", "basis": [ "CNA", "NVD", "CWE-285" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "x_refsource_CONFIRM" ] }, { "url": "https://github.com/vercel/next.js/pull/96014", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v16.2.11", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 330, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64643", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T17:11:30.895Z", "date_published": "2026-07-27T17:48:17.575Z", "date_updated": "2026-07-27T18:21:55.549Z", "publisher": "GitHub_M", "title": "Next.js: Unauthenticated Disclosure of Internal Server Function endpoints", "affected": { "vendors": [ "vercel" ], "products": [ { "vendor": "vercel", "product": "next.js" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-201", "name": "Insertion of Sensitive Information Into Sent Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 1, "epss": { "score": 0.00516, "percentile": 0.41102 }, "nvd": { "published": "2026-07-27T18:16:59.160", "lastModified": "2026-07-29T14:37:25.703", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64643", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Next.js publishes Server Action identifiers in public client artifacts even when the corresponding pages require authentication, enabling unauthenticated action enumeration.", "basis": [ "CNA", "CWE-201" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "x_refsource_CONFIRM" ] }, { "url": "https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v15.5.21", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v16.2.11", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 744, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64644", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T17:11:30.895Z", "date_published": "2026-07-27T17:54:52.530Z", "date_updated": "2026-07-27T18:35:41.443Z", "publisher": "GitHub_M", "title": "Next.js: Denial of Service in the Image Optimization API using SVGs", "affected": { "vendors": [ "vercel" ], "products": [ { "vendor": "vercel", "product": "next.js" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-407", "name": "Inefficient Algorithmic Complexity", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 1, "epss": { "score": 0.00675, "percentile": 0.48687 }, "nvd": { "published": "2026-07-27T18:16:59.307", "lastModified": "2026-07-29T14:39:23.520", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64644", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A crafted remote SVG triggers computation with no effective complexity bound and can exhaust CPU.", "basis": [ "CNA", "CWE-407" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "x_refsource_CONFIRM" ] }, { "url": "https://github.com/vercel/next.js/pull/96006", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v15.5.21", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v16.2.11", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 637, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64645", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T17:11:30.895Z", "date_published": "2026-07-27T17:37:07.695Z", "date_updated": "2026-07-28T14:02:21.877Z", "publisher": "GitHub_M", "title": "Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname", "affected": { "vendors": [ "vercel" ], "products": [ { "vendor": "vercel", "product": "next.js" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-601", "name": "URL Redirection to Untrusted Site ('Open Redirect')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "4.0", "score": 8.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 8.3, "cvss_source_score_spread": 2.200000000000001, "epss": { "score": 0.00782, "percentile": 0.52447 }, "nvd": { "published": "2026-07-27T18:16:59.453", "lastModified": "2026-07-29T14:39:12.173", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64645", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The next.js request path accepts an attacker-controlled destination or redirect without constraining the resolved server-side network target.", "basis": [ "CNA", "CWE-601", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "x_refsource_CONFIRM" ] }, { "url": "https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v15.5.21", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v16.2.11", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 620, "referenceCount": 5, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64646", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T17:11:30.895Z", "date_published": "2026-07-27T18:54:59.466Z", "date_updated": "2026-07-27T20:22:18.086Z", "publisher": "GitHub_M", "title": "Next.js: Unbounded Server Action payload in Edge runtime", "affected": { "vendors": [ "vercel" ], "products": [ { "vendor": "vercel", "product": "next.js" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 1, "epss": { "score": 0.00531, "percentile": 0.41875 }, "nvd": { "published": "2026-07-27T19:17:21.477", "lastModified": "2026-07-29T14:39:00.200", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64646", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Next.js App Router permits Edge-runtime Server Action requests to consume memory without an effective request bound.", "basis": [ "CNA", "CWE-770" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "x_refsource_CONFIRM" ] }, { "url": "https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v15.5.21", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v16.2.11", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 368, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64647", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T17:11:30.895Z", "date_published": "2026-07-27T19:11:28.477Z", "date_updated": "2026-07-27T19:27:13.932Z", "publisher": "GitHub_M", "title": "Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies", "affected": { "vendors": [ "vercel" ], "products": [ { "vendor": "vercel", "product": "next.js" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-116", "name": "Improper Encoding or Escaping of Output", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 0.8999999999999995, "epss": { "score": 0.00339, "percentile": 0.2644 }, "nvd": { "published": "2026-07-27T19:17:21.627", "lastModified": "2026-07-29T14:38:45.417", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64647", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Next.js derives the server-fetch cache key from request bodies through a lossy charset conversion, allowing different non-UTF-8 bodies to share one cached response.", "basis": [ "CNA", "CWE-116" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "x_refsource_CONFIRM" ] }, { "url": "https://github.com/vercel/next.js/pull/96008", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v15.5.21", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v16.2.11", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 661, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64648", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T17:11:30.895Z", "date_published": "2026-07-27T19:20:42.623Z", "date_updated": "2026-07-28T14:14:16.051Z", "publisher": "GitHub_M", "title": "Next.js: Response Body Cache Confusion for Requests Containing Bodies", "affected": { "vendors": [ "vercel" ], "products": [ { "vendor": "vercel", "product": "next.js" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-524", "name": "Use of Cache Containing Sensitive Information", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "4.0", "score": 6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00336, "percentile": 0.26185 }, "nvd": { "published": "2026-07-27T20:16:40.563", "lastModified": "2026-07-29T14:38:20.310", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64648", "family": "STATE_SEQUENCE", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Next.js keys a server-side response-body cache without including a differing request body, allowing one request to receive another response.", "basis": [ "CNA", "CWE-524" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "x_refsource_CONFIRM" ] }, { "url": "https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v15.5.21", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v16.2.11", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 694, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64649", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T17:11:30.895Z", "date_published": "2026-07-27T19:27:58.865Z", "date_updated": "2026-07-28T14:12:06.654Z", "publisher": "GitHub_M", "title": "Next.js: Server-Side Request Forgery in Server Actions on Custom Servers", "affected": { "vendors": [ "vercel" ], "products": [ { "vendor": "vercel", "product": "next.js" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "4.0", "score": 8.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 8.3, "cvss_source_score_spread": 1.8000000000000007, "epss": { "score": 0.00448, "percentile": 0.36817 }, "nvd": { "published": "2026-07-27T20:16:40.703", "lastModified": "2026-07-29T14:38:03.600", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64649", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Next.js derives a Server Action forwarding destination from attacker-controlled Host-associated headers instead of a pinned trusted host.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "x_refsource_CONFIRM" ] }, { "url": "https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v15.5.21", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] }, { "url": "https://github.com/vercel/next.js/releases/tag/v16.2.11", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Product", "Release Notes", "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 888, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64650", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T17:11:30.895Z", "date_published": "2026-07-20T20:27:41.349Z", "date_updated": "2026-07-20T21:45:44.027Z", "publisher": "GitHub_M", "title": "AI SDK Codex Harness Tool Relay Authorization Bypass", "affected": { "vendors": [ "vercel" ], "products": [ { "vendor": "vercel", "product": "@ai-sdk/harness-codex" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00113, "percentile": 0.01638 }, "nvd": { "published": "2026-07-20T21:16:50.520", "lastModified": "2026-07-23T18:14:09.843", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64650", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The harness falls back from a verified executable identity to a caller-controlled process path, allowing an untrusted binary to satisfy the authorization rule.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/vercel/ai/security/advisories/GHSA-qw9h-448j-6rph", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_CONFIRM" ] }, { "url": "https://github.com/vercel/ai/pull/17105", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 1260, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64651", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T17:11:30.896Z", "date_published": "2026-07-20T20:26:07.497Z", "date_updated": "2026-07-21T12:49:47.977Z", "publisher": "GitHub_M", "title": "AI SDK OpenCode Harness Tool Relay Authorization Bypass", "affected": { "vendors": [ "vercel" ], "products": [ { "vendor": "vercel", "product": "@ai-sdk/harness-opencode" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00113, "percentile": 0.01638 }, "nvd": { "published": "2026-07-20T21:16:50.677", "lastModified": "2026-07-23T18:14:09.843", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64651", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The relay treats any process whose command line merely contains an allowed helper path as authorized to call host tools, without a matching model-approved event.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/vercel/ai/security/advisories/GHSA-g48p-5rr5-8rgq", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_CONFIRM" ] }, { "url": "https://github.com/vercel/ai/pull/17105", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 1224, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64685", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T17:12:12.892Z", "date_published": "2026-07-29T23:47:21.587Z", "date_updated": "2026-07-30T15:17:50.345Z", "publisher": "GitHub_M", "title": "ImageMagick: Heap Buffer Over-Read in BGR decoder due to mising end-of-file check", "affected": { "vendors": [ "ImageMagick" ], "products": [ { "vendor": "ImageMagick", "product": "ImageMagick" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-125", "name": "Out-of-bounds Read", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00197, "percentile": 0.09733 }, "nvd": { "published": "2026-07-30T00:16:25.490", "lastModified": "2026-08-03T15:20:03.863", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64685", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "ImageMagick reads beyond a valid memory object because an input length or pointer is not validated against the available buffer.", "basis": [ "CNA", "CWE-125" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rgw-xg25-prjm", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "x_refsource_CONFIRM" ] } ], "record_shape": { "descriptionChars": 301, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64691", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:01.158Z", "date_published": "2026-07-27T20:14:52.091Z", "date_updated": "2026-07-28T14:54:23.822Z", "publisher": "apple", "title": "A buffer overflow was addressed with improved size validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00343, "percentile": 0.26894 }, "nvd": { "published": "2026-07-27T21:17:08.797", "lastModified": "2026-07-28T20:01:00.563", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64691", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An app-controlled operation copies more data than a fixed destination buffer can hold.", "basis": [ "CNA", "CWE-120" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 162, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64692", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:01.158Z", "date_published": "2026-07-27T20:12:13.066Z", "date_updated": "2026-07-28T16:31:00.192Z", "publisher": "apple", "title": "An out-of-bounds read was addressed with improved bounds checking.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-125", "name": "Out-of-bounds Read", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0013, "percentile": 0.02996 }, "nvd": { "published": "2026-07-27T21:17:08.893", "lastModified": "2026-07-29T19:56:01.607", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64692", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An Apple system component reads beyond the valid bounds of a memory buffer.", "basis": [ "CNA", "CWE-125" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 265, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64693", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:01.158Z", "date_published": "2026-07-27T20:12:28.075Z", "date_updated": "2026-07-28T14:28:45.679Z", "publisher": "apple", "title": "A type confusion issue was addressed with improved checks.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type ('Type Confusion')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02707 }, "nvd": { "published": "2026-07-27T21:17:08.993", "lastModified": "2026-07-28T20:00:42.897", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64693", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Image processing accesses a resource through an incompatible runtime type, allowing crafted input to drive invalid object interpretation.", "basis": [ "CNA", "NVD", "CWE-843" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 280, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64694", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:01.158Z", "date_published": "2026-07-27T20:12:51.061Z", "date_updated": "2026-07-28T14:41:45.630Z", "publisher": "apple", "title": "An integer overflow was addressed with improved input validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-190", "name": "Integer Overflow or Wraparound", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00417, "percentile": 0.34298 }, "nvd": { "published": "2026-07-27T21:17:09.097", "lastModified": "2026-07-28T17:58:33.637", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64694", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A crafted Disk Images input can overflow an integer used during processing and terminate the affected component.", "basis": [ "CNA", "CWE-190", "Apple security notes 128067/128071/128072" ], "deepDive": true, "notes": "Inspected https://support.apple.com/en-us/128067, https://support.apple.com/en-us/128071, and https://support.apple.com/en-us/128072. Apple identifies the Disk Images component and an integer overflow fixed by input validation, but publishes no calculation, input field, or patch diff." }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 208, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64695", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:01.158Z", "date_published": "2026-07-27T20:13:30.416Z", "date_updated": "2026-07-28T15:59:00.087Z", "publisher": "apple", "title": "The issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00513, "percentile": 0.40895 }, "nvd": { "published": "2026-07-27T21:17:09.193", "lastModified": "2026-07-28T17:58:26.340", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64695", "family": "MEMORY_LIFETIME", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Apple reports remotely triggerable APFS memory corruption but does not disclose the allocation, bounds, or lifetime error.", "basis": [ "CNA", "CWE-119", "Apple macOS Tahoe 26.6 security content" ], "deepDive": true, "notes": "Inspected https://support.apple.com/en-us/128067; Apple identifies APFS, remote kernel-memory corruption, and improved memory handling but does not publish the allocation, bounds, or lifetime error." }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 229, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64696", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:01.158Z", "date_published": "2026-07-27T20:13:41.994Z", "date_updated": "2026-07-28T15:58:50.760Z", "publisher": "apple", "title": "The issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00513, "percentile": 0.40895 }, "nvd": { "published": "2026-07-27T21:17:09.290", "lastModified": "2026-07-28T17:58:18.120", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64696", "family": "MEMORY_LIFETIME", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The SMB component mishandles memory reachable by a remote user, but Apple does not disclose the allocation, bound, pointer, or lifetime transition involved.", "basis": [ "CNA", "CWE-119", "Apple Security Releases" ], "deepDive": true, "notes": "https://support.apple.com/en-us/128067 ; https://support.apple.com/en-us/128071 - Apple's Tahoe and Sequoia notices identify SMB and remote kernel-memory corruption but disclose no allocation, bound, pointer, or lifetime transition." }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 229, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64697", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:01.158Z", "date_published": "2026-07-27T20:14:13.203Z", "date_updated": "2026-07-28T13:33:35.932Z", "publisher": "apple", "title": "The issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00417, "percentile": 0.34298 }, "nvd": { "published": "2026-07-27T21:17:09.393", "lastModified": "2026-07-28T17:58:07.833", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64697", "family": "MEMORY_LIFETIME", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The HFS implementation mishandles kernel memory while processing app-reachable filesystem input, allowing an app to terminate the system or corrupt kernel memory.", "basis": [ "CNA", "ADP", "NVD", "CWE-119", "Apple security release" ], "deepDive": true, "notes": "Inspected Apple security release https://support.apple.com/en-us/128067; the HFS entry confirms improved memory handling and the fixed macOS releases, but it does not identify the buffer, index, object lifetime, triggering filesystem structure, or source patch." }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 222, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64698", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:01.158Z", "date_published": "2026-07-27T20:13:04.254Z", "date_updated": "2026-07-28T16:11:25.974Z", "publisher": "apple", "title": "The issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00417, "percentile": 0.34299 }, "nvd": { "published": "2026-07-27T21:17:09.490", "lastModified": "2026-07-30T14:35:12.950", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64698", "family": "MEMORY_LIFETIME", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The macOS cd9660 component mishandles memory and can expose kernel bytes or terminate the system, while Apple does not publish the memory operation.", "basis": [ "CNA", "NVD", "CWE-119", "Vendor advisory" ], "deepDive": true, "notes": "Inspected Apple's macOS Tahoe 26.6 security page at https://support.apple.com/en-us/128067; it identifies cd9660 and improved memory handling but does not publish the failing memory operation or patch." }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 219, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64699", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:01.158Z", "date_published": "2026-07-27T20:13:15.783Z", "date_updated": "2026-07-28T14:26:22.858Z", "publisher": "apple", "title": "A memory initialization issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-457", "name": "Use of Uninitialized Variable", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00138, "percentile": 0.03674 }, "nvd": { "published": "2026-07-27T21:17:09.587", "lastModified": "2026-07-28T20:00:14.287", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64699", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "macOS reads memory before initializing it, allowing stale process data or an invalid value to influence execution.", "basis": [ "CNA", "ADP", "NVD", "CWE-457" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 204, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64700", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:01.158Z", "date_published": "2026-07-27T20:14:27.460Z", "date_updated": "2026-07-28T15:45:12.712Z", "publisher": "apple", "title": "A use after free issue was addressed with improved memory management.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-416", "name": "Use After Free", "abstraction": "Variant", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0046, "percentile": 0.37592 }, "nvd": { "published": "2026-07-27T21:17:09.680", "lastModified": "2026-07-28T19:59:29.443", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64700", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected Apple component reuses an object after its lifetime has ended.", "basis": [ "CNA", "CWE-416" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 278, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64702", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:24.049Z", "date_published": "2026-07-27T20:12:17.318Z", "date_updated": "2026-07-28T18:40:13.829Z", "publisher": "apple", "title": "An access issue was addressed with additional sandbox restrictions.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00385, "percentile": 0.313 }, "nvd": { "published": "2026-07-27T21:17:09.780", "lastModified": "2026-07-30T14:35:03.203", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64702", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The macOS Audio sandbox grants an app access outside its sandbox, but Apple's advisory does not disclose the missing sandbox rule or object binding.", "basis": [ "CNA", "CWE-284", "Apple advisory" ], "deepDive": true, "notes": "Read https://support.apple.com/en-us/128067; Apple identifies the Audio component and additional sandbox restrictions but does not disclose the vulnerable rule, call path, or patch." }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 199, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64703", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:24.049Z", "date_published": "2026-07-27T20:12:23.223Z", "date_updated": "2026-07-28T14:12:37.724Z", "publisher": "apple", "title": "A use after free issue was addressed with improved memory management.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-416", "name": "Use After Free", "abstraction": "Variant", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00405, "percentile": 0.33292 }, "nvd": { "published": "2026-07-27T21:17:09.877", "lastModified": "2026-07-28T17:58:02.000", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64703", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An Apple application path uses an object after its storage has been freed.", "basis": [ "CNA", "CWE-416" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 202, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64704", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:24.049Z", "date_published": "2026-07-27T20:12:56.133Z", "date_updated": "2026-07-28T14:35:07.515Z", "publisher": "apple", "title": "A type confusion issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type ('Type Confusion')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00443, "percentile": 0.364 }, "nvd": { "published": "2026-07-27T21:17:09.977", "lastModified": "2026-07-28T17:57:55.483", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64704", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A type confusion issue was addressed with improved memory handling.", "basis": [ "CNA", "CWE-843" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 210, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64707", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:24.049Z", "date_published": "2026-07-27T20:14:16.526Z", "date_updated": "2026-07-28T15:58:16.874Z", "publisher": "apple", "title": "A permissions issue was addressed with improved validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "visionOS" } ], "affectedBlockCount": 3, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0012, "percentile": 0.02115 }, "nvd": { "published": "2026-07-27T21:17:10.073", "lastModified": "2026-07-28T19:57:32.517", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64707", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Apple reports a permissions-validation failure that lets an app delete files outside its authority but does not disclose the checked object or rule.", "basis": [ "CNA", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 258, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64708", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:24.049Z", "date_published": "2026-07-27T20:13:09.235Z", "date_updated": "2026-07-28T14:31:07.991Z", "publisher": "apple", "title": "A file quarantine bypass was addressed with additional checks.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-693", "name": "Protection Mechanism Failure", "abstraction": "Pillar", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00128, "percentile": 0.02868 }, "nvd": { "published": "2026-07-27T21:17:10.170", "lastModified": "2026-07-28T17:57:48.773", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64708", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "Apple reports a Gatekeeper quarantine bypass fixed with additional checks but does not identify the trusted metadata or omitted validation.", "basis": [ "CNA", "CWE-693" ], "deepDive": false, "notes": "The public record does not expose enough implementation detail to classify the enabling cause." }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 183, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64709", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:24.049Z", "date_published": "2026-07-27T20:13:11.581Z", "date_updated": "2026-07-28T14:29:18.017Z", "publisher": "apple", "title": "The issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02988 }, "nvd": { "published": "2026-07-27T21:17:10.267", "lastModified": "2026-07-28T19:56:28.267", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64709", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The affected interface returns, embeds or leaves protected information visible to an observer who is not entitled to receive it.", "basis": [ "CNA", "CWE-200" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 250, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64710", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:24.049Z", "date_published": "2026-07-27T20:13:37.914Z", "date_updated": "2026-07-28T14:09:14.924Z", "publisher": "apple", "title": "A privacy issue was addressed by removing sensitive data.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0013, "percentile": 0.0304 }, "nvd": { "published": "2026-07-27T21:17:10.370", "lastModified": "2026-07-28T18:06:00.097", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64710", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A macOS application can leak sensitive user information, but Apple's public record does not identify the data or output path.", "basis": [ "CNA", "CWE-200" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 196, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64711", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:35.083Z", "date_published": "2026-07-27T20:14:15.730Z", "date_updated": "2026-07-28T15:56:53.311Z", "publisher": "apple", "title": "This issue was addressed with additional entitlement checks.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 4, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-285", "name": "Improper Authorization", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00122, "percentile": 0.02362 }, "nvd": { "published": "2026-07-27T21:17:10.467", "lastModified": "2026-07-28T19:55:57.883", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64711", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "An application can cross an Apple entitlement boundary and expose user data, but Apple does not disclose the entitlement or protected data path.", "basis": [ "CNA", "CWE-285" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 225, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-64713", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:35.084Z", "date_published": "2026-07-27T20:13:27.168Z", "date_updated": "2026-07-28T19:11:08.015Z", "publisher": "apple", "title": "This issue was addressed with improved checks.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "Safari" }, { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 6, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-203", "name": "Observable Discrepancy", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00328, "percentile": 0.25272 }, "nvd": { "published": "2026-07-27T21:17:10.560", "lastModified": "2026-07-30T14:34:30.697", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64713", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A website can distinguish whether a link is in the user's visited history through an observable browser response.", "basis": [ "CNA", "CWE-203" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128073", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 222, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 6, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64716", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:35.084Z", "date_published": "2026-07-27T20:14:29.040Z", "date_updated": "2026-07-28T15:07:20.794Z", "publisher": "apple", "title": "The issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00133, "percentile": 0.03256 }, "nvd": { "published": "2026-07-27T21:17:10.657", "lastModified": "2026-07-28T19:55:35.817", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64716", "family": "MEMORY_LIFETIME", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A crafted image corrupts memory, but the public record does not identify the bounds, type, ownership, or lifetime failure.", "basis": [ "CNA", "CWE-119" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 271, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64718", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:35.084Z", "date_published": "2026-07-27T20:12:07.210Z", "date_updated": "2026-07-28T18:40:21.814Z", "publisher": "apple", "title": "A use-after-free issue was addressed with improved memory management.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "Safari" }, { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 6, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-416", "name": "Use After Free", "abstraction": "Variant", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00107, "percentile": 0.01323 }, "nvd": { "published": "2026-07-27T21:17:10.753", "lastModified": "2026-07-29T19:55:37.530", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64718", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Malicious web content causes Safari to dereference an object after its lifetime has ended.", "basis": [ "CNA record", "CWE-416" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128073", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 272, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 6, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64719", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:35.084Z", "date_published": "2026-07-27T20:12:33.758Z", "date_updated": "2026-07-28T14:42:03.068Z", "publisher": "apple", "title": "An out-of-bounds access issue was addressed with improved bounds checking.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "Safari" }, { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 6, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-125", "name": "Out-of-bounds Read", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00285, "percentile": 0.20719 }, "nvd": { "published": "2026-07-27T21:17:10.853", "lastModified": "2026-07-28T19:54:39.373", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64719", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Safari reads beyond an allocated buffer because the input length or boundary is not enforced.", "basis": [ "CNA", "CWE-125" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128073", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 277, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 6, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64720", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:35.084Z", "date_published": "2026-07-27T20:14:25.797Z", "date_updated": "2026-07-28T15:49:11.712Z", "publisher": "apple", "title": "A race condition was addressed with improved state handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 4, "versionEntryCount": 4, "versionRangeCount": 4, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00333, "percentile": 0.25823 }, "nvd": { "published": "2026-07-27T21:17:10.950", "lastModified": "2026-07-28T19:53:51.337", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64720", "family": "STATE_SEQUENCE", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A race in the Apple kernel permits an application-triggered invalid state, but the competing operations and invariant are not public.", "basis": [ "CNA", "CWE-362", "Apple security advisories 128066 and 128067" ], "deepDive": true, "notes": "Primary-source deep dive: https://support.apple.com/en-us/128066 and https://support.apple.com/en-us/128067 ; Apple identifies the Kernel component and a race addressed by state handling, but not the competing operations or invariant." }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 211, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-64721", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:47.192Z", "date_published": "2026-07-27T20:14:56.204Z", "date_updated": "2026-07-28T14:20:45.002Z", "publisher": "apple", "title": "This issue was addressed through improved state management.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-664", "name": "Improper Control of a Resource Through its Lifetime", "abstraction": "Pillar", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.0294 }, "nvd": { "published": "2026-07-27T21:17:11.053", "lastModified": "2026-07-28T19:53:13.287", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64721", "family": "STATE_SEQUENCE", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Apple reports that stale or incorrect resource state lets an app access sensitive user data, but does not disclose the resource or lifecycle transition.", "basis": [ "CNA", "CWE-664" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 259, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64722", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:47.192Z", "date_published": "2026-07-27T20:11:57.933Z", "date_updated": "2026-07-28T16:32:06.031Z", "publisher": "apple", "title": "A buffer overflow issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 2, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00147, "percentile": 0.04424 }, "nvd": { "published": "2026-07-27T21:17:11.153", "lastModified": "2026-07-30T14:34:12.643", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64722", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A copy into a fixed memory region proceeds without a sufficient input-size check, allowing the destination bounds to be exceeded.", "basis": [ "CNA record", "ADP", "NVD", "CWE-120" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 223, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64723", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:47.192Z", "date_published": "2026-07-27T20:12:41.997Z", "date_updated": "2026-07-28T15:03:27.881Z", "publisher": "apple", "title": "A logic issue was addressed with improved checks.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00124, "percentile": 0.02494 }, "nvd": { "published": "2026-07-27T21:17:11.253", "lastModified": "2026-07-28T18:05:49.877", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64723", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A macOS application can read protected user data because of an undisclosed access-control logic error.", "basis": [ "CNA", "NVD", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 183, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64724", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:47.192Z", "date_published": "2026-07-27T20:12:58.667Z", "date_updated": "2026-07-28T14:33:16.085Z", "publisher": "apple", "title": "The issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-400", "name": "Uncontrolled Resource Consumption", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02707 }, "nvd": { "published": "2026-07-27T21:17:11.350", "lastModified": "2026-07-28T19:52:06.387", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64724", "family": "MEMORY_LIFETIME", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "An Apple network-reachable path mishandles memory and can cause denial of service, while the public record does not disclose the allocation, bounds, or lifetime operation.", "basis": [ "CNA", "CWE-400" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 279, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64725", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:47.192Z", "date_published": "2026-07-27T20:13:23.660Z", "date_updated": "2026-07-28T19:08:25.360Z", "publisher": "apple", "title": "An out-of-bounds write issue was addressed with improved bounds checking.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0013, "percentile": 0.03016 }, "nvd": { "published": "2026-07-27T21:17:11.447", "lastModified": "2026-07-29T19:54:56.290", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64725", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A crafted input permits a write beyond the end of an allocated memory region.", "basis": [ "CNA", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 272, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64726", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:47.192Z", "date_published": "2026-07-27T20:13:56.070Z", "date_updated": "2026-07-28T13:51:33.889Z", "publisher": "apple", "title": "The issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00431, "percentile": 0.35439 }, "nvd": { "published": "2026-07-27T21:17:11.543", "lastModified": "2026-07-28T19:51:24.220", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64726", "family": "MEMORY_LIFETIME", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The iOS and iPadOS path processes attacker-controlled data without a sufficient memory-boundary check.", "basis": [ "CNA", "CWE-119", "Apple security notices" ], "deepDive": true, "notes": "Read Apple security notices https://support.apple.com/en-us/128066 and https://support.apple.com/en-us/128067; they identify the Wi-Fi component and physical-proximity memory corruption but do not disclose the memory operation or failing bounds/lifetime rule." }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 234, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64727", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:47.192Z", "date_published": "2026-07-27T20:13:58.610Z", "date_updated": "2026-07-28T18:50:21.318Z", "publisher": "apple", "title": "A type confusion issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type ('Type Confusion')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00358, "percentile": 0.28464 }, "nvd": { "published": "2026-07-27T21:17:11.640", "lastModified": "2026-07-29T19:54:12.453", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64727", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Apple code accesses a resource through an incompatible runtime type and corrupts memory.", "basis": [ "CNA", "CWE-843" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 178, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64728", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:47.192Z", "date_published": "2026-07-27T20:12:44.436Z", "date_updated": "2026-07-28T15:10:57.316Z", "publisher": "apple", "title": "A permissions issue was addressed with improved validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "Safari" }, { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 6, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-693", "name": "Protection Mechanism Failure", "abstraction": "Pillar", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00262, "percentile": 0.17845 }, "nvd": { "published": "2026-07-27T21:17:11.737", "lastModified": "2026-07-28T18:55:20.553", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64728", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A WebKit permission check permits crafted web content to act outside an iframe sandbox, while Apple does not identify the sandbox flag or validation branch.", "basis": [ "CNA", "CWE-693" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128073", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 249, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 6, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64729", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:47.193Z", "date_published": "2026-07-27T20:13:36.159Z", "date_updated": "2026-07-28T14:10:17.009Z", "publisher": "apple", "title": "A use after free issue was addressed with improved memory management.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-416", "name": "Use After Free", "abstraction": "Variant", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00419, "percentile": 0.34478 }, "nvd": { "published": "2026-07-27T21:17:11.837", "lastModified": "2026-07-28T18:54:39.683", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64729", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Apple component accesses an object after it has been freed.", "basis": [ "CNA", "CWE-416" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 235, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64730", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:47.193Z", "date_published": "2026-07-27T20:13:50.343Z", "date_updated": "2026-07-28T14:04:05.762Z", "publisher": "apple", "title": "The issue was addressed with improved UI.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "Safari" }, { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 6, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-451", "name": "User Interface (UI) Misrepresentation of Critical Information", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0034, "percentile": 0.26653 }, "nvd": { "published": "2026-07-27T21:17:11.930", "lastModified": "2026-07-28T18:48:50.317", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64730", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The affected component trusts attacker-controlled request, origin, redirect, or channel metadata without validating the final security boundary.", "basis": [ "CNA", "CWE-451" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128073", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 235, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 6, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64731", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:54.848Z", "date_published": "2026-07-27T20:14:03.683Z", "date_updated": "2026-07-28T13:46:13.871Z", "publisher": "apple", "title": "A path handling issue was addressed with improved validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00467, "percentile": 0.38034 }, "nvd": { "published": "2026-07-27T21:17:12.030", "lastModified": "2026-07-28T18:48:20.080", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64731", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled path or object-name data is resolved without proving that the final target remains inside the intended namespace.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 181, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64732", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:54.848Z", "date_published": "2026-07-27T20:13:03.490Z", "date_updated": "2026-07-28T16:08:12.326Z", "publisher": "apple", "title": "This issue was addressed through improved state management.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 4.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.6, "cvss_source_score_spread": 0, "epss": { "score": 0.0015, "percentile": 0.04702 }, "nvd": { "published": "2026-07-27T21:17:12.130", "lastModified": "2026-07-28T18:47:51.380", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64732", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "iPhone Mirroring permits physical access to protected data through an undisclosed state-bound authorization failure.", "basis": [ "CNA", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 208, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64733", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:54.848Z", "date_published": "2026-07-27T20:13:15.015Z", "date_updated": "2026-07-28T14:27:21.282Z", "publisher": "apple", "title": "This issue was addressed with improved data protection.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00462, "percentile": 0.37741 }, "nvd": { "published": "2026-07-27T21:17:12.223", "lastModified": "2026-07-28T18:47:32.557", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64733", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Accounts Framework exposes a user-fingerprinting signal to an application, but Apple does not identify the data source or observable oracle.", "basis": [ "CNA", "CWE-200", "Apple security advisory" ], "deepDive": true, "notes": "Inspected https://support.apple.com/en-us/128066 and the linked Apple platform advisories; Apple identifies Accounts Framework, fingerprinting impact, and improved data protection but does not disclose the exposed signal or the causal data-flow check. That official impact statement is materially narrower than the embedded shard's 9.8 score." }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 206, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64734", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:54.848Z", "date_published": "2026-07-27T20:12:04.763Z", "date_updated": "2026-07-28T16:31:23.757Z", "publisher": "apple", "title": "The issue was addressed with improved checks.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 4, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00135, "percentile": 0.03361 }, "nvd": { "published": "2026-07-27T21:17:12.327", "lastModified": "2026-07-29T19:53:42.203", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64734", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "low", "mechanism": "Processing a crafted contact can disclose sensitive data, but the public record does not identify the missing bounds, access, or output check.", "basis": [ "CNA", "CWE-200" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 250, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64735", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:54.848Z", "date_published": "2026-07-27T20:12:36.312Z", "date_updated": "2026-07-28T14:48:32.125Z", "publisher": "apple", "title": "An inconsistent user interface issue was addressed with improved state management.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-451", "name": "User Interface (UI) Misrepresentation of Critical Information", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00392, "percentile": 0.31919 }, "nvd": { "published": "2026-07-27T21:17:12.463", "lastModified": "2026-07-28T18:47:06.750", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64735", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Apple's UI state can become inconsistent with the active network-filter state, allowing a remote peer to bypass the displayed or expected filter policy.", "basis": [ "CNA", "CWE-451" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 289, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64737", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:54.848Z", "date_published": "2026-07-27T20:15:00.930Z", "date_updated": "2026-07-28T14:16:38.168Z", "publisher": "apple", "title": "An authorization issue was addressed with improved state management.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00115, "percentile": 0.01838 }, "nvd": { "published": "2026-07-27T21:17:12.573", "lastModified": "2026-07-28T18:00:10.010", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64737", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A malicious application can escape its macOS sandbox because an authorization state is managed incorrectly, but the state transition and check are not public.", "basis": [ "CNA", "NVD", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 209, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64738", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:54.848Z", "date_published": "2026-07-27T20:12:13.838Z", "date_updated": "2026-07-28T16:30:54.198Z", "publisher": "apple", "title": "A permissions issue was addressed with additional restrictions.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00385, "percentile": 0.313 }, "nvd": { "published": "2026-07-27T21:17:12.677", "lastModified": "2026-07-30T14:33:37.440", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64738", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The Maps component grants a sandboxed app permissions beyond its sandbox boundary, but the exact permission check is not public.", "basis": [ "CNA", "CWE-284", "Apple security notes 128067/128071/128072" ], "deepDive": true, "notes": "Inspected https://support.apple.com/en-us/128067, https://support.apple.com/en-us/128071, and https://support.apple.com/en-us/128072. Apple identifies the Maps component and additional permission restrictions, but publishes no permission, object, call path, or patch diff." }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 204, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64739", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:54.848Z", "date_published": "2026-07-27T20:12:28.898Z", "date_updated": "2026-07-28T14:34:02.115Z", "publisher": "apple", "title": "An out-of-bounds write issue was addressed with improved bounds checking.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00364, "percentile": 0.29155 }, "nvd": { "published": "2026-07-27T21:17:12.777", "lastModified": "2026-07-28T18:46:34.450", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64739", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An Apple component writes beyond an allocated buffer because the vulnerable path lacks sufficient bounds checking.", "basis": [ "CNA", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 284, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64740", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:09:54.848Z", "date_published": "2026-07-27T20:14:53.836Z", "date_updated": "2026-07-28T16:12:52.208Z", "publisher": "apple", "title": "A parsing issue in the handling of directory paths was addressed with improved path validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" } ], "affectedBlockCount": 3, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00165, "percentile": 0.06174 }, "nvd": { "published": "2026-07-27T21:17:12.877", "lastModified": "2026-07-28T18:45:58.623", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64740", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The file operation in iOS and iPadOS uses an attacker-controlled path without confining the resolved object to the intended namespace.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 273, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64741", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:18.985Z", "date_published": "2026-07-27T20:14:29.891Z", "date_updated": "2026-07-28T15:29:01.656Z", "publisher": "apple", "title": "A permissions issue was addressed with additional restrictions.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 4, "versionEntryCount": 4, "versionRangeCount": 4, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02988 }, "nvd": { "published": "2026-07-27T21:17:12.980", "lastModified": "2026-07-28T18:45:38.337", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64741", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The affected Apple permission check allows an app to read a persistent device identifier that should be restricted to a narrower authority scope.", "basis": [ "CNA", "ADP", "NVD", "CWE-200" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 211, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-64742", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:18.985Z", "date_published": "2026-07-27T20:12:26.427Z", "date_updated": "2026-07-28T14:22:18.182Z", "publisher": "apple", "title": "This issue was addressed by using HTTPS when sending information over the network.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 4, "versionEntryCount": 4, "versionRangeCount": 4, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-319", "name": "Cleartext Transmission of Sensitive Information", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00196, "percentile": 0.0954 }, "nvd": { "published": "2026-07-27T21:17:13.080", "lastModified": "2026-07-28T19:50:44.020", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64742", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected Apple path sends sensitive information over plaintext HTTP instead of an authenticated and encrypted HTTPS channel.", "basis": [ "CNA", "NVD", "CWE-319" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 221, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-64743", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:18.985Z", "date_published": "2026-07-27T20:12:14.717Z", "date_updated": "2026-07-28T16:30:48.141Z", "publisher": "apple", "title": "An authorization issue was addressed with improved state management.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-285", "name": "Improper Authorization", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00285, "percentile": 0.20757 }, "nvd": { "published": "2026-07-27T21:17:13.187", "lastModified": "2026-07-29T19:52:00.697", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64743", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record identifies an authentication or authorization bypass in iOS and iPadOS, but does not disclose the operation or failing identity, role, or object-scope check.", "basis": [ "CNA", "ADP", "NVD", "CWE-285" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 225, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64744", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:18.985Z", "date_published": "2026-07-27T20:13:28.734Z", "date_updated": "2026-07-28T16:02:33.051Z", "publisher": "apple", "title": "An information leakage was addressed with additional validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00131, "percentile": 0.03084 }, "nvd": { "published": "2026-07-27T21:17:13.283", "lastModified": "2026-07-28T18:00:02.887", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64744", "family": "UNDETERMINED", "precision": "UNDETERMINED", "confidence": "low", "mechanism": "Apple states that additional validation prevents disclosure of kernel memory but does not identify the invalid input, boundary, or lifetime error.", "basis": [ "CNA", "CWE-200" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 194, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64745", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:18.985Z", "date_published": "2026-07-27T20:12:54.533Z", "date_updated": "2026-07-28T14:37:05.070Z", "publisher": "apple", "title": "This issue was addressed with additional restrictions on the lock screen.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-287", "name": "Improper Authentication", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 2.4, "severity": "LOW", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 2.4, "severity": "LOW", "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 2.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00136, "percentile": 0.03462 }, "nvd": { "published": "2026-07-27T21:17:13.377", "lastModified": "2026-07-28T18:44:46.630", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64745", "family": "HARDWARE_PHYSICAL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The lock-screen interface permits a person with physical device access to reach contacts and photos despite the locked state.", "basis": [ "CNA", "CWE-287" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 228, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64746", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:18.985Z", "date_published": "2026-07-27T20:14:14.856Z", "date_updated": "2026-07-28T15:55:13.450Z", "publisher": "apple", "title": "An authorization issue was addressed with improved validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 4, "versionEntryCount": 4, "versionRangeCount": 4, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00398, "percentile": 0.32605 }, "nvd": { "published": "2026-07-27T21:17:13.487", "lastModified": "2026-07-28T18:43:51.407", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64746", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "An Apple application can add contacts without user authorization, while the public advisory does not disclose the permission or consent validation that fails.", "basis": [ "CNA", "CWE-862", "Apple security content 128066" ], "deepDive": true, "notes": "Inspected https://support.apple.com/en-us/128066; Apple identifies the Contacts component and says improved validation fixed unauthorized contact creation, but the permission check and call path are not public." }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 221, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-64747", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:18.985Z", "date_published": "2026-07-27T20:13:38.693Z", "date_updated": "2026-07-29T03:55:30.754Z", "publisher": "apple", "title": "A buffer overflow was addressed with improved size validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00142, "percentile": 0.0398 }, "nvd": { "published": "2026-07-27T21:17:13.613", "lastModified": "2026-07-29T05:17:03.413", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64747", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "A buffer overflow was addressed with improved size validation.", "basis": [ "CNA", "CWE-120" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 281, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64749", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:18.985Z", "date_published": "2026-07-27T20:13:06.794Z", "date_updated": "2026-07-28T17:55:31.873Z", "publisher": "apple", "title": "The issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "visionOS" } ], "affectedBlockCount": 3, "versionEntryCount": 4, "versionRangeCount": 4, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00124, "percentile": 0.02566 }, "nvd": { "published": "2026-07-27T21:17:13.727", "lastModified": "2026-07-29T19:51:14.167", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64749", "family": "MEMORY_LIFETIME", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Apple reports memory corruption or termination from deficient memory handling but does not disclose the bound, object, or lifetime error.", "basis": [ "CNA", "CWE-119" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 242, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 3, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-64751", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:30.632Z", "date_published": "2026-07-27T20:13:37.035Z", "date_updated": "2026-07-28T14:12:15.384Z", "publisher": "apple", "title": "A use after free issue was addressed with improved memory management.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-416", "name": "Use After Free", "abstraction": "Variant", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00329, "percentile": 0.25397 }, "nvd": { "published": "2026-07-27T21:17:13.823", "lastModified": "2026-07-28T18:42:37.177", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64751", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected path continues using an object after its lifetime has ended.", "basis": [ "CNA", "CWE-416" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 258, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64754", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:30.632Z", "date_published": "2026-07-27T20:12:20.455Z", "date_updated": "2026-07-28T18:39:53.073Z", "publisher": "apple", "title": "An out-of-bounds write issue was addressed with improved bounds checking.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00118, "percentile": 0.01996 }, "nvd": { "published": "2026-07-27T21:17:13.920", "lastModified": "2026-07-29T19:50:43.773", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64754", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "iOS and iPadOS can write beyond the valid bounds of an allocation while processing attacker-influenced data.", "basis": [ "CNA", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 294, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64755", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:30.632Z", "date_published": "2026-07-27T20:12:19.342Z", "date_updated": "2026-07-28T17:56:01.516Z", "publisher": "apple", "title": "An authorization issue was addressed with improved state management.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00121, "percentile": 0.02275 }, "nvd": { "published": "2026-07-27T21:17:14.020", "lastModified": "2026-07-29T19:50:20.133", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64755", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "An iOS application can cross an undisclosed state-dependent authorization boundary and access sensitive user data.", "basis": [ "CNA", "CWE-200" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 167, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64757", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:30.633Z", "date_published": "2026-07-27T20:14:26.672Z", "date_updated": "2026-07-28T15:48:04.441Z", "publisher": "apple", "title": "A memory corruption issue was addressed with improved state management.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "Safari" }, { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00214, "percentile": 0.11864 }, "nvd": { "published": "2026-07-27T21:17:14.120", "lastModified": "2026-07-28T18:42:01.177", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64757", "family": "MEMORY_LIFETIME", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Apple reports web-triggered memory corruption and a Safari crash but does not disclose the invalid bound, pointer, or lifetime transition.", "basis": [ "CNA", "CWE-119" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128073", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 263, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64758", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:30.633Z", "date_published": "2026-07-27T20:12:32.193Z", "date_updated": "2026-07-28T14:40:02.145Z", "publisher": "apple", "title": "The issue was addressed with improved bounds checks.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00124, "percentile": 0.02566 }, "nvd": { "published": "2026-07-27T21:17:14.220", "lastModified": "2026-07-28T18:40:51.680", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64758", "family": "MEMORY_LIFETIME", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Processing a crafted file crosses a memory bound and terminates the app, but the public record does not identify the affected buffer or operation.", "basis": [ "CNA", "CWE-119" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 237, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64762", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:43.924Z", "date_published": "2026-07-27T20:12:37.967Z", "date_updated": "2026-07-28T14:52:08.582Z", "publisher": "apple", "title": "An out-of-bounds read was addressed with improved bounds checking.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-125", "name": "Out-of-bounds Read", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00327, "percentile": 0.25226 }, "nvd": { "published": "2026-07-27T21:17:14.317", "lastModified": "2026-07-28T17:59:53.360", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64762", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Crafted input can cause a read beyond the bounds of a valid buffer.", "basis": [ "CNA", "CWE-125" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 209, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64763", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:43.924Z", "date_published": "2026-07-27T20:12:01.967Z", "date_updated": "2026-07-29T03:55:26.731Z", "publisher": "apple", "title": "An out-of-bounds write issue was addressed by removing the vulnerable code.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02916 }, "nvd": { "published": "2026-07-27T21:17:14.427", "lastModified": "2026-07-29T19:50:10.873", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64763", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A crafted file drives a write beyond the bounds of a memory object.", "basis": [ "CNA record", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 331, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64764", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:43.924Z", "date_published": "2026-07-27T20:13:17.354Z", "date_updated": "2026-07-29T03:55:29.922Z", "publisher": "apple", "title": "An out-of-bounds write issue was addressed with improved bounds checking.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02917 }, "nvd": { "published": "2026-07-27T21:17:14.523", "lastModified": "2026-07-29T05:17:04.350", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64764", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "iOS and iPadOS lets attacker-controlled input reach an out-of-bounds write.", "basis": [ "CNA", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 329, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64765", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:43.924Z", "date_published": "2026-07-27T20:13:01.023Z", "date_updated": "2026-07-29T03:55:29.152Z", "publisher": "apple", "title": "An integer overflow was addressed with improved input validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-190", "name": "Integer Overflow or Wraparound", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02917 }, "nvd": { "published": "2026-07-27T21:17:14.623", "lastModified": "2026-07-29T19:49:33.180", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64765", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "SceneKit performs overflowing integer arithmetic while sizing or indexing data from a crafted file.", "basis": [ "CNA", "CWE-190" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 321, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64766", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:43.924Z", "date_published": "2026-07-27T20:14:02.814Z", "date_updated": "2026-07-29T03:55:33.822Z", "publisher": "apple", "title": "An integer overflow was addressed with improved input validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-190", "name": "Integer Overflow or Wraparound", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00129, "percentile": 0.02917 }, "nvd": { "published": "2026-07-27T21:17:14.727", "lastModified": "2026-07-29T05:17:05.237", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64766", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In iOS and iPadOS, unchecked integer arithmetic wraps before its result controls a memory size, offset, or copy.", "basis": [ "CNA", "CWE-190" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 321, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64767", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:43.924Z", "date_published": "2026-07-27T20:13:51.882Z", "date_updated": "2026-07-28T14:02:09.025Z", "publisher": "apple", "title": "A buffer overflow was addressed with improved bounds checking.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00445, "percentile": 0.36568 }, "nvd": { "published": "2026-07-27T21:17:14.823", "lastModified": "2026-07-28T17:59:45.307", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64767", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A copy into a fixed memory region proceeds without a sufficient input-size check, allowing the destination bounds to be exceeded.", "basis": [ "CNA record", "ADP", "NVD", "CWE-120" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 241, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64768", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:43.924Z", "date_published": "2026-07-27T20:13:32.837Z", "date_updated": "2026-07-28T14:13:21.871Z", "publisher": "apple", "title": "An out-of-bounds read issue was addressed with improved input validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" } ], "affectedBlockCount": 4, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-125", "name": "Out-of-bounds Read", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00317, "percentile": 0.24123 }, "nvd": { "published": "2026-07-27T21:17:14.920", "lastModified": "2026-07-28T18:40:04.430", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64768", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An Apple media or input-processing path reads beyond a valid buffer boundary while handling network-controlled data.", "basis": [ "CNA", "NVD", "CWE-125" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 268, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64769", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:43.924Z", "date_published": "2026-07-27T20:12:46.870Z", "date_updated": "2026-07-28T15:14:55.234Z", "publisher": "apple", "title": "An out-of-bounds write issue was addressed with improved bounds checking.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" } ], "affectedBlockCount": 4, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00432, "percentile": 0.35584 }, "nvd": { "published": "2026-07-27T21:17:15.020", "lastModified": "2026-07-28T18:39:55.780", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64769", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The iOS and iPadOS path writes attacker-influenced data beyond the capacity of its destination buffer.", "basis": [ "CNA", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 303, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64770", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:43.924Z", "date_published": "2026-07-27T20:14:00.344Z", "date_updated": "2026-07-28T13:49:40.111Z", "publisher": "apple", "title": "An out-of-bounds write issue was addressed with improved bounds checking.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" } ], "affectedBlockCount": 4, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00432, "percentile": 0.35584 }, "nvd": { "published": "2026-07-27T21:17:15.117", "lastModified": "2026-07-28T18:39:45.327", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64770", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A crafted input permits an out-of-bounds heap write in the affected Apple component.", "basis": [ "CNA", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 303, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64771", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:53.025Z", "date_published": "2026-07-27T20:13:54.442Z", "date_updated": "2026-07-28T14:00:16.924Z", "publisher": "apple", "title": "A buffer overflow was addressed with improved bounds checking.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" } ], "affectedBlockCount": 4, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0045, "percentile": 0.36927 }, "nvd": { "published": "2026-07-27T21:17:15.213", "lastModified": "2026-07-28T18:39:12.377", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64771", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The iOS and iPadOS path processes attacker-controlled data without a sufficient memory-boundary check.", "basis": [ "CNA", "CWE-119", "Apple security notices" ], "deepDive": true, "notes": "Read Apple security notices https://support.apple.com/en-us/128066 and https://support.apple.com/en-us/128067; they identify a Model I/O buffer overflow fixed by bounds checking but publish no input field or source path." }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 271, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64772", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:53.025Z", "date_published": "2026-07-27T20:13:20.490Z", "date_updated": "2026-07-28T17:55:19.538Z", "publisher": "apple", "title": "An out-of-bounds write issue was addressed with improved input validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" } ], "affectedBlockCount": 4, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00407, "percentile": 0.33518 }, "nvd": { "published": "2026-07-27T21:17:15.317", "lastModified": "2026-07-29T19:49:04.220", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64772", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Apple code writes beyond an allocated buffer while processing remote input.", "basis": [ "CNA", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 283, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64774", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:53.025Z", "date_published": "2026-07-27T20:12:40.417Z", "date_updated": "2026-07-28T14:58:31.732Z", "publisher": "apple", "title": "An integer overflow was addressed with improved input validation.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" } ], "affectedBlockCount": 4, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-190", "name": "Integer Overflow or Wraparound", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00432, "percentile": 0.35584 }, "nvd": { "published": "2026-07-27T21:17:15.420", "lastModified": "2026-07-28T18:37:14.757", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64774", "family": "MEMORY_LIFETIME", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Apple identifies an integer overflow while Model I/O processes remote content, but its security notice does not identify the arithmetic operation, field, or allocation affected.", "basis": [ "CNA", "CWE-190", "Apple iOS and iPadOS 26.6 security content" ], "deepDive": true, "notes": "Inspected https://support.apple.com/en-us/128066 and the linked parallel 26.6 platform notices. Apple places the issue in Model I/O and says an integer overflow was fixed through improved input validation, but publishes no parsed field, arithmetic operation, or allocation. Apple supplies no CVSS score on that page; the shard maximum 9.8 is attributed to an ADP source." }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 295, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 4, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-64775", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:53.025Z", "date_published": "2026-07-27T20:11:58.713Z", "date_updated": "2026-07-28T16:31:59.267Z", "publisher": "apple", "title": "A memory initialization issue was addressed with improved memory handling.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "tvOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 7, "versionRangeCount": 7, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-665", "name": "Improper Initialization", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00367, "percentile": 0.29418 }, "nvd": { "published": "2026-07-27T21:17:15.517", "lastModified": "2026-07-29T19:48:46.097", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64775", "family": "MEMORY_LIFETIME", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Apple identifies uninitialized Kernel memory that can terminate the system but does not disclose the object or initialization path.", "basis": [ "CNA", "CWE-665", "Apple July 2026 security notes" ], "deepDive": true, "notes": "Apple security notes https://support.apple.com/en-us/128066 through https://support.apple.com/en-us/128071 were inspected; they identify the Kernel and a memory-initialization issue but do not disclose the object or initialization path." }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128069", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 283, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64776", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:10:53.025Z", "date_published": "2026-07-27T20:14:57.773Z", "date_updated": "2026-07-28T15:52:25.405Z", "publisher": "apple", "title": "The issue was addressed with improved bounds checks.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "macOS" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-125", "name": "Out-of-bounds Read", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00122, "percentile": 0.023 }, "nvd": { "published": "2026-07-27T21:17:15.620", "lastModified": "2026-07-28T17:59:37.613", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64776", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The public record identifies a memory-safety failure but does not disclose the exact buffer, lifetime transition, or invalid access.", "basis": [ "CNA", "CWE-125" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128071", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128072", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 182, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-64783", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:11:03.397Z", "date_published": "2026-07-27T20:14:39.670Z", "date_updated": "2026-07-28T15:00:38.071Z", "publisher": "apple", "title": "A use-after-free issue was addressed with improved memory management.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "Safari" }, { "vendor": "Apple", "product": "iOS and iPadOS" }, { "vendor": "Apple", "product": "macOS" }, { "vendor": "Apple", "product": "visionOS" }, { "vendor": "Apple", "product": "watchOS" } ], "affectedBlockCount": 5, "versionEntryCount": 5, "versionRangeCount": 5, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-416", "name": "Use After Free", "abstraction": "Variant", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00208, "percentile": 0.11068 }, "nvd": { "published": "2026-07-27T21:17:15.720", "lastModified": "2026-07-28T18:35:42.410", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64783", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Safari can dereference an object after the allocation backing that object has been freed.", "basis": [ "CNA", "CWE-416" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://support.apple.com/en-us/128066", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128067", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128068", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128070", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://support.apple.com/en-us/128073", "host": "support.apple.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 261, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64785", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:11:03.398Z", "date_published": "2026-07-23T18:50:40.468Z", "date_updated": "2026-07-24T20:06:58.518Z", "publisher": "apple", "title": "SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.", "affected": { "vendors": [ "Apple" ], "products": [ { "vendor": "Apple", "product": "swift-nio-http2" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "adp", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00181, "percentile": 0.07847 }, "nvd": { "published": "2026-07-23T20:17:21.440", "lastModified": "2026-07-24T21:16:45.877", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64785", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The HTTP/2-to-HTTP/1 codec forwards control characters that HTTP/1 treats as message delimiters, creating a cross-protocol request-boundary ambiguity.", "basis": [ "CNA", "CWE-444" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/apple/swift-nio-http2/security/advisories/GHSA-q3g2-m552-3r9c", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 309, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 0, "adpCweCount": 1, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64791", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:16:31.592Z", "date_published": "2026-07-22T20:40:15.641Z", "date_updated": "2026-07-28T05:30:57.646Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Regular Labs Extension Manager extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.02779 }, "nvd": { "published": "2026-07-22T21:18:10.230", "lastModified": "2026-07-27T18:16:59.620", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64791", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Extension-management routes inconsistently enforce both CSRF tokens and installation permissions before install, update, or uninstall actions.", "basis": [ "CNA", "CWE-284", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 351, "referenceCount": 1, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64792", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:16:31.592Z", "date_published": "2026-07-22T20:40:58.877Z", "date_updated": "2026-07-28T05:31:54.131Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Articles Anywhere extension for Joomla" }, { "vendor": "regularlabs.com", "product": "Conditional Content extension for Joomla" }, { "vendor": "regularlabs.com", "product": "Modules Anywhere extension for Joomla" }, { "vendor": "regularlabs.com", "product": "ReReplacer extension for Joomla" }, { "vendor": "regularlabs.com", "product": "Sourcerer extension for Joomla" }, { "vendor": "regularlabs.com", "product": "Tabs & Accordions Pro extension for Joomla" }, { "vendor": "regularlabs.com", "product": "Snippets Pro extension for Joomla" } ], "affectedBlockCount": 7, "versionEntryCount": 7, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-524", "name": "Use of Cache Containing Sensitive Information", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00249, "percentile": 0.16319 }, "nvd": { "published": "2026-07-22T21:18:10.337", "lastModified": "2026-07-27T18:16:59.767", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64792", "family": "EXPOSURE_OUTPUT", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Smart Search renders content under the indexing administrator's identity and stores restricted output in a public search index.", "basis": [ "CNA", "CWE-524" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 371, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 7, "affectedVersionEntryCount": 7 } }, { "cve_id": "CVE-2026-64793", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:16:31.592Z", "date_published": "2026-07-22T20:45:25.099Z", "date_updated": "2026-07-27T13:34:13.847Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Articles Anywhere extension for Joomla" }, { "vendor": "regularlabs.com", "product": "Modules Anywhere extension for Joomla" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00246, "percentile": 0.15966 }, "nvd": { "published": "2026-07-22T21:18:10.447", "lastModified": "2026-07-27T14:16:59.510", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64793", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Content tags can set ignore flags or property overrides that render articles or modules outside the visitor's publication and access permissions.", "basis": [ "CNA", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 334, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64794", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:16:31.592Z", "date_published": "2026-07-22T20:45:24.135Z", "date_updated": "2026-07-27T13:34:11.997Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Articles Anywhere extension for Joomla" }, { "vendor": "regularlabs.com", "product": "Users Anywhere extension for Joomla" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00244, "percentile": 0.15649 }, "nvd": { "published": "2026-07-22T21:18:10.553", "lastModified": "2026-07-27T15:17:08.047", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64794", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "User tags, filters, and conditions read authentication data, raw parameters, or restricted contacts without enforcing the field-level access policy.", "basis": [ "CNA", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 319, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64795", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:16:31.592Z", "date_published": "2026-07-22T20:41:19.007Z", "date_updated": "2026-07-27T13:29:26.815Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Modals extension for Joomla" }, { "vendor": "regularlabs.com", "product": "Tooltips extension for Joomla" }, { "vendor": "regularlabs.com", "product": "Articles Anywhere Pro extension for Joomla" }, { "vendor": "regularlabs.com", "product": "Users Anywhere Pro extension for Joomla" }, { "vendor": "regularlabs.com", "product": "Modules Anywhere Pro extension for Joomla" } ], "affectedBlockCount": 5, "versionEntryCount": 5, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00133, "percentile": 0.03231 }, "nvd": { "published": "2026-07-22T21:18:10.660", "lastModified": "2026-07-27T14:16:59.660", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64795", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Modals extension for Joomla page renders attacker-controlled data as HTML or JavaScript without context-appropriate escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 303, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 5, "affectedVersionEntryCount": 5 } }, { "cve_id": "CVE-2026-64796", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:16:31.593Z", "date_published": "2026-07-22T20:42:49.934Z", "date_updated": "2026-07-28T05:34:08.793Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Sourcerer extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00285, "percentile": 0.20712 }, "nvd": { "published": "2026-07-22T21:18:10.763", "lastModified": "2026-07-27T19:17:21.777", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64796", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Sourcerer executes article code without consistently requiring the configured creator, modifier, and language permissions.", "basis": [ "CNA", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 473, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64797", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:16:31.593Z", "date_published": "2026-07-22T20:44:08.843Z", "date_updated": "2026-07-29T05:39:44.152Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "IP Login extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-290", "name": "Authentication Bypass by Spoofing", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00202, "percentile": 0.10277 }, "nvd": { "published": "2026-07-22T21:18:10.870", "lastModified": "2026-07-28T16:20:04.800", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64797", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The login extension trusts forwarded client-IP headers without requiring that they came from a configured proxy.", "basis": [ "CNA", "CWE-290" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 276, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64798", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:16:31.593Z", "date_published": "2026-07-22T20:41:53.448Z", "date_updated": "2026-07-28T05:33:04.140Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "IP Login extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-338", "name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00245, "percentile": 0.15773 }, "nvd": { "published": "2026-07-22T21:18:10.970", "lastModified": "2026-07-27T18:16:59.920", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64798", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "IP Login extension for Joomla derives an authentication token or login key from a non-cryptographic generator with too little entropy to resist guessing.", "basis": [ "CNA", "NVD", "CWE-338" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 200, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64799", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:16:31.593Z", "date_published": "2026-07-23T09:11:12.311Z", "date_updated": "2026-07-28T05:32:38.511Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Articles Anywhere Pro extension for Joomla" }, { "vendor": "regularlabs.com", "product": "Users Anywhere Pro extension for Joomla" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00313, "percentile": 0.23677 }, "nvd": { "published": "2026-07-23T10:16:51.867", "lastModified": "2026-07-27T17:16:39.207", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64799", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The extensions fetch content-controlled image URLs without rejecting reserved networks or unsafe redirects and save responses without image validation.", "basis": [ "CNA", "NVD", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 403, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64800", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:19:58.408Z", "date_published": "2026-07-23T11:36:55.317Z", "date_updated": "2026-07-23T13:18:50.674Z", "publisher": "JetBrains", "title": "In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "GoLand" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 3.5, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 3.5, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.7, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.7, "cvss_source_score_spread": 2.2, "epss": { "score": 0.00491, "percentile": 0.39537 }, "nvd": { "published": "2026-07-23T12:18:35.527", "lastModified": "2026-07-28T17:05:43.917", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64800", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "GoLand writes credentials or other protected configuration values into a log readable beyond their intended audience.", "basis": [ "CNA", "NVD", "CWE-532" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 96, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64802", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:27.708Z", "date_published": "2026-07-23T11:36:55.809Z", "date_updated": "2026-07-24T03:56:13.219Z", "publisher": "JetBrains", "title": "In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "GoLand" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00143, "percentile": 0.04084 }, "nvd": { "published": "2026-07-23T12:18:35.647", "lastModified": "2026-07-28T17:05:55.643", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64802", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Go Modules integration executes project-controlled behavior before the user grants trust to the project.", "basis": [ "CNA", "CWE-94" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 131, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64803", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:28.058Z", "date_published": "2026-07-23T11:36:56.235Z", "date_updated": "2026-07-24T03:56:14.836Z", "publisher": "JetBrains", "title": "In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "GoLand" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00143, "percentile": 0.04085 }, "nvd": { "published": "2026-07-23T12:18:35.753", "lastModified": "2026-07-28T17:06:09.587", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64803", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "GoLand executes the configured Go SDK from an untrusted project before the user grants project trust.", "basis": [ "CNA", "CWE-94" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 127, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64804", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:28.432Z", "date_published": "2026-07-23T11:36:56.637Z", "date_updated": "2026-07-24T03:56:21.618Z", "publisher": "JetBrains", "title": "In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "WebStorm" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.0014, "percentile": 0.03794 }, "nvd": { "published": "2026-07-23T12:18:35.880", "lastModified": "2026-07-28T17:06:18.890", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64804", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "WebStorm executes project-local linter tooling before the user grants trust to the project.", "basis": [ "CNA", "CWE-829" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 136, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64805", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:28.785Z", "date_published": "2026-07-23T11:36:56.997Z", "date_updated": "2026-07-24T03:56:22.762Z", "publisher": "JetBrains", "title": "In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "WebStorm" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.0014, "percentile": 0.03794 }, "nvd": { "published": "2026-07-23T12:18:35.993", "lastModified": "2026-07-28T17:06:27.437", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64805", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "WebStorm executes project-local package-manager tooling before the user has granted trust to the project.", "basis": [ "CNA", "CWE-829" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 145, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64806", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:29.006Z", "date_published": "2026-07-23T11:36:57.338Z", "date_updated": "2026-07-24T03:56:23.574Z", "publisher": "JetBrains", "title": "In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "WebStorm" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.0014, "percentile": 0.03793 }, "nvd": { "published": "2026-07-23T12:18:36.103", "lastModified": "2026-07-28T17:06:35.740", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64806", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter.", "basis": [ "CNA", "CWE-829" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 142, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64807", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:29.287Z", "date_published": "2026-07-23T11:36:57.740Z", "date_updated": "2026-07-24T03:56:24.355Z", "publisher": "JetBrains", "title": "In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "WebStorm" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.0266 }, "nvd": { "published": "2026-07-23T12:18:36.217", "lastModified": "2026-07-28T17:08:25.513", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64807", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "WebStorm loads a project-supplied linter configuration as executable tooling configuration without an adequate trust boundary.", "basis": [ "CNA", "CWE-829" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 117, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64808", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:29.509Z", "date_published": "2026-07-23T11:36:58.090Z", "date_updated": "2026-07-24T03:56:25.146Z", "publisher": "JetBrains", "title": "In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "PhpStorm" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.0014, "percentile": 0.03793 }, "nvd": { "published": "2026-07-23T12:18:36.323", "lastModified": "2026-07-28T17:08:41.140", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64808", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "PhpStorm project tooling can execute project-controlled code before the user has granted that project trust.", "basis": [ "CNA", "CWE-829" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 123, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64809", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:29.741Z", "date_published": "2026-07-23T11:36:58.428Z", "date_updated": "2026-07-24T03:56:25.961Z", "publisher": "JetBrains", "title": "In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "PhpStorm" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 0, "epss": { "score": 0.0014, "percentile": 0.03793 }, "nvd": { "published": "2026-07-23T12:18:36.437", "lastModified": "2026-07-28T17:09:00.080", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64809", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "PhpStorm invokes a configured interpreter before the project-trust decision has authorized project-controlled execution.", "basis": [ "CNA", "CWE-829" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 134, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64810", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:29.976Z", "date_published": "2026-07-23T11:36:58.739Z", "date_updated": "2026-07-23T13:20:00.344Z", "publisher": "JetBrains", "title": "In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "IntelliJ IDEA" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 1.7999999999999998, "epss": { "score": 0.00149, "percentile": 0.04582 }, "nvd": { "published": "2026-07-23T12:18:36.553", "lastModified": "2026-07-28T17:09:16.960", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64810", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "User-controlled content reaches IntelliJ IDEA page output without context-appropriate sanitization or escaping, so the browser interprets it as script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 131, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64811", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:30.270Z", "date_published": "2026-07-23T11:36:59.173Z", "date_updated": "2026-07-24T03:56:15.755Z", "publisher": "JetBrains", "title": "In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "IntelliJ IDEA" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00126, "percentile": 0.02661 }, "nvd": { "published": "2026-07-23T12:18:36.663", "lastModified": "2026-07-28T17:09:51.890", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64811", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "IntelliJ executes development-container configuration from an untrusted project before the user grants project trust.", "basis": [ "CNA", "CWE-829" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 148, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64812", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:30.497Z", "date_published": "2026-07-23T11:36:59.500Z", "date_updated": "2026-07-24T03:56:16.546Z", "publisher": "JetBrains", "title": "In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "IntelliJ IDEA" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 10, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 10, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 10, "cvss_source_score_spread": 0, "epss": { "score": 0.00363, "percentile": 0.29065 }, "nvd": { "published": "2026-07-23T12:18:36.783", "lastModified": "2026-07-28T17:10:06.610", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64812", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Remote Development input action is exposed without authenticating the caller.", "basis": [ "CNA", "CWE-306" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 114, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64813", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:30.707Z", "date_published": "2026-07-23T11:36:59.917Z", "date_updated": "2026-07-24T03:56:17.355Z", "publisher": "JetBrains", "title": "In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "IntelliJ IDEA" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-602", "name": "Client-Side Enforcement of Server-Side Security", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 10, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 10, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 10, "cvss_source_score_spread": 0, "epss": { "score": 0.00393, "percentile": 0.3204 }, "nvd": { "published": "2026-07-23T12:18:36.897", "lastModified": "2026-07-28T17:10:41.343", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64813", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A Remote Development session relies on client-side enforcement for a settings authorization boundary, but the exact setting and server-side check are not public.", "basis": [ "CNA record", "CWE-602", "JetBrains fixed-issues data" ], "deepDive": true, "notes": "Inspected https://www.jetbrains.com/privacy-security/issues-fixed/ and its official data source https://resources.jetbrains.com/storage/issues-fixed/data.json; the entry confirms IJPL-245849, Critical severity, and resolution in 2026.2 but adds no implementation detail." }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 120, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64814", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:30.920Z", "date_published": "2026-07-23T11:37:00.248Z", "date_updated": "2026-07-23T13:21:25.814Z", "publisher": "JetBrains", "title": "In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "IntelliJ IDEA" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 8.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00315, "percentile": 0.23889 }, "nvd": { "published": "2026-07-23T12:18:37.010", "lastModified": "2026-07-28T17:10:52.127", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64814", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record shows that IntelliJ IDEA permits an unauthorized operation but does not identify the endpoint, protected object, or failing identity or privilege check.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 110, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64815", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:20:31.114Z", "date_published": "2026-07-23T11:37:00.625Z", "date_updated": "2026-07-24T03:56:18.148Z", "publisher": "JetBrains", "title": "In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files", "affected": { "vendors": [ "JetBrains" ], "products": [ { "vendor": "JetBrains", "product": "IntelliJ IDEA" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:cve@jetbrains.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 1.700000000000001, "epss": { "score": 0.0033, "percentile": 0.25548 }, "nvd": { "published": "2026-07-23T12:18:37.120", "lastModified": "2026-07-28T17:11:02.603", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64815", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "IntelliJ IDEA interprets attacker-controlled UI Designer form content in a way that permits arbitrary code injection.", "basis": [ "CNA", "CWE-94" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "host": "www.jetbrains.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory" ] } ], "record_shape": { "descriptionChars": 105, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64816", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.160Z", "date_published": "2026-07-30T21:32:27.105Z", "date_updated": "2026-07-31T11:10:30.940Z", "publisher": "VulnCheck", "title": "RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath", "affected": { "vendors": [ "CyberTimon" ], "products": [ { "vendor": "CyberTimon", "product": "RapidRAW" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-73", "name": "External Control of File Name or Path", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00266, "percentile": 0.18616 }, "nvd": { "published": "2026-07-30T22:16:55.920", "lastModified": "2026-07-31T11:17:11.830", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64816", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "RapidRAW passes an unvalidated preset lutPath to File.open, allowing a Windows UNC path to select an attacker-controlled SMB server.", "basis": [ "CNA", "CWE-73" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/CyberTimon/RapidRAW/releases/tag/v1.6.0", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] }, { "url": "https://github.com/CyberTimon/RapidRAW/commit/83852f36ba4a260be", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/rapidraw-ntlmv2-credential-leak-via-unc-path-in-lutpath", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 773, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64821", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.160Z", "date_published": "2026-07-21T20:31:35.885Z", "date_updated": "2026-07-22T14:49:56.056Z", "publisher": "VulnCheck", "title": "djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views", "affected": { "vendors": [ "thiagopena" ], "products": [ { "vendor": "thiagopena", "product": "djangoSIGE" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 1, "epss": { "score": 0.00149, "percentile": 0.04636 }, "nvd": { "published": "2026-07-21T21:16:53.497", "lastModified": "2026-07-23T15:24:59.880", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64821", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The four order-cancellation views perform state changes from HTTP GET handlers, so cross-origin image requests bypass Django's unsafe-method CSRF checks while carrying the victim's session.", "basis": [ "CNA record", "NVD", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/americooo/pentest-writeups/tree/main/djangoSIGE-CVE-2026-64821-64822", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://github.com/thiagopena/djangoSIGE/pull/163", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://www.vulncheck.com/advisories/djangosige-csrf-via-get-based-order-cancellation-views", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 721, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64822", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.160Z", "date_published": "2026-07-21T20:28:03.702Z", "date_updated": "2026-07-22T14:30:16.973Z", "publisher": "VulnCheck", "title": "djangoSIGE 1.10 User Enumeration via ForgotPasswordView", "affected": { "vendors": [ "thiagopena" ], "products": [ { "vendor": "thiagopena", "product": "djangoSIGE" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-203", "name": "Observable Discrepancy", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.9, "cvss_source_score_spread": 1.6000000000000005, "epss": { "score": 0.00247, "percentile": 0.16022 }, "nvd": { "published": "2026-07-21T21:16:53.640", "lastModified": "2026-07-23T15:24:59.880", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64822", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "ForgotPasswordView returns distinguishable responses for existing and nonexistent usernames, creating an account-existence oracle.", "basis": [ "CNA", "NVD", "CWE-203" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/americooo/pentest-writeups/tree/main/djangoSIGE-CVE-2026-64821-64822", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://github.com/thiagopena/djangoSIGE/pull/163", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://www.vulncheck.com/advisories/djangosige-user-enumeration-via-forgotpasswordview", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 507, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64823", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.160Z", "date_published": "2026-07-21T15:16:03.790Z", "date_updated": "2026-07-22T14:12:16.922Z", "publisher": "VulnCheck", "title": "Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI", "affected": { "vendors": [ "home-assistant" ], "products": [ { "vendor": "home-assistant", "product": "Home Assistant Core" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 2.1, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "source": "cna", "version": "3.1", "score": 4.7, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 2.1, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 4.7, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.7, "cvss_source_score_spread": 2.6, "epss": { "score": 0.00183, "percentile": 0.08059 }, "nvd": { "published": "2026-07-21T16:17:21.230", "lastModified": "2026-07-22T15:17:21.770", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64823", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Home Assistant Core rendering path places attacker-controlled data into executable browser markup without context-appropriate neutralization.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/home-assistant/core/releases/tag/2026.5.4", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] }, { "url": "https://github.com/home-assistant/core/pull/171585", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://github.com/home-assistant/core/commit/894a68acb678afc382fe5ea9002e61ab7f862011", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/home-assistant-core-xss-via-shelly-media-player-py-thumb-uri", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 641, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64824", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.160Z", "date_published": "2026-07-21T15:39:52.162Z", "date_updated": "2026-07-28T01:05:57.907Z", "publisher": "VulnCheck", "title": "Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore", "affected": { "vendors": [ "home-assistant" ], "products": [ { "vendor": "home-assistant", "product": "Home Assistant Core" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0.9000000000000004, "epss": { "score": 0.00576, "percentile": 0.44258 }, "nvd": { "published": "2026-07-21T16:17:21.433", "lastModified": "2026-07-21T20:28:41.683", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64824", "family": "FILE_OBJECT_SELECTION", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "A SYMTYPE archive entry supplies an absolute link target that a following regular file uses to write outside the extraction root.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/home-assistant/core/releases/tag/2026.7.0", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] }, { "url": "https://github.com/home-assistant/core/pull/172252", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://github.com/home-assistant/core/commit/1e457600f1093c15e1325742d03e2b76498c79c1", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/home-assistant-core-symlink-path-traversal-rce-via-backup-restore", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] }, { "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-78r8-wwqv-r299", "host": "github.com", "sources": [ "adp:0", "nvd" ], "tags": [ "exploit" ] } ], "record_shape": { "descriptionChars": 660, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64825", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.160Z", "date_published": "2026-07-21T15:40:18.756Z", "date_updated": "2026-07-28T01:06:00.415Z", "publisher": "VulnCheck", "title": "Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload", "affected": { "vendors": [ "home-assistant" ], "products": [ { "vendor": "home-assistant", "product": "Home Assistant Core" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L" }, { "source": "cna", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0.3000000000000007, "epss": { "score": 0.00482, "percentile": 0.39022 }, "nvd": { "published": "2026-07-21T16:17:21.633", "lastModified": "2026-07-21T20:28:41.683", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64825", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Backup restore uses the backup.json name in a path join, so an absolute value discards the configured backup directory and selects an arbitrary write target.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/home-assistant/core/releases/tag/2026.6.0", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] }, { "url": "https://github.com/home-assistant/core/pull/172368", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://github.com/home-assistant/core/commit/567fe858289876b68b8162a77bd46e1e1af79752", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/home-assistant-core-path-traversal-file-write-via-backup-upload", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 570, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64828", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.161Z", "date_published": "2026-07-22T15:39:34.424Z", "date_updated": "2026-07-22T16:30:19.557Z", "publisher": "VulnCheck", "title": "Froiden TableTrack 1.3.10 Stored XSS via Order Notes Field", "affected": { "vendors": [ "Froiden" ], "products": [ { "vendor": "Froiden", "product": "TableTrack" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 0.7999999999999998, "epss": { "score": 0.00204, "percentile": 0.10545 }, "nvd": { "published": "2026-07-22T16:18:50.487", "lastModified": "2026-07-23T15:23:01.470", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64828", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "TableTrack stores order notes and renders them in the administrator view without sanitizing executable HTML or JavaScript.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-64828", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://codecanyon.net/item/tabletrack-the-complete-saas-restaurant-management-solution/55116396", "host": "codecanyon.net", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://www.vulncheck.com/advisories/froiden-tabletrack-stored-xss-via-order-notes-field", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 424, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64829", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.161Z", "date_published": "2026-07-22T19:57:29.754Z", "date_updated": "2026-07-28T01:06:01.111Z", "publisher": "VulnCheck", "title": "Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow", "affected": { "vendors": [ "q2a" ], "products": [ { "vendor": "q2a", "product": "question2answer" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-613", "name": "Insufficient Session Expiration", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 1.6999999999999993, "epss": { "score": 0.00268, "percentile": 0.18777 }, "nvd": { "published": "2026-07-22T20:17:08.423", "lastModified": "2026-07-23T16:17:49.240", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64829", "family": "CRYPTO_SECRET", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php.", "basis": [ "CNA", "CWE-613" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/q2a/question2answer/pull/1017", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "patch" ] }, { "url": "https://www.vulncheck.com/advisories/question2answer-session-fixation-via-forgot-password-flow", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 647, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64830", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.161Z", "date_published": "2026-07-22T16:33:05.724Z", "date_updated": "2026-07-28T01:06:01.869Z", "publisher": "VulnCheck", "title": "FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer", "affected": { "vendors": [ "FFmpeg" ], "products": [ { "vendor": "FFmpeg", "product": "FFmpeg" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-122", "name": "Heap-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00347, "percentile": 0.27384 }, "nvd": { "published": "2026-07-22T17:16:58.557", "lastModified": "2026-07-28T17:00:32.043", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64830", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The VobSub demuxer writes more distinct stream IDs into the fixed vobsub->q array than that array can hold.", "basis": [ "CNA", "CWE-122" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Patch", "issue-tracking" ] }, { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 571, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64831", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.161Z", "date_published": "2026-07-22T16:35:43.775Z", "date_updated": "2026-07-28T01:06:02.677Z", "publisher": "VulnCheck", "title": "FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder", "affected": { "vendors": [ "FFmpeg" ], "products": [ { "vendor": "FFmpeg", "product": "FFmpeg" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-121", "name": "Stack-based Buffer Overflow", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00457, "percentile": 0.37439 }, "nvd": { "published": "2026-07-22T17:16:58.697", "lastModified": "2026-07-28T17:00:51.803", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64831", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "vk_hevc_end_frame() trusts vps_num_hrd_parameters above HEVC_MAX_SUB_LAYERS and overwrites fixed stack arrays while decoding HEVC.", "basis": [ "CNA", "CWE-121" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Patch", "issue-tracking" ] }, { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 489, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64832", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.161Z", "date_published": "2026-07-22T17:01:16.181Z", "date_updated": "2026-07-28T01:06:03.370Z", "publisher": "VulnCheck", "title": "FFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.c", "affected": { "vendors": [ "FFmpeg" ], "products": [ { "vendor": "FFmpeg", "product": "FFmpeg" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-415", "name": "Double Free", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00332, "percentile": 0.25781 }, "nvd": { "published": "2026-07-22T18:17:05.483", "lastModified": "2026-07-28T17:01:21.170", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64832", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "FFmpeg can release the same allocation twice along one error and teardown path.", "basis": [ "CNA", "CWE-415" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Patch", "issue-tracking" ] }, { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 544, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64833", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.161Z", "date_published": "2026-07-22T17:03:20.875Z", "date_updated": "2026-07-28T01:06:04.055Z", "publisher": "VulnCheck", "title": "FFmpeg 0.7.1 - 8.1.2 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c", "affected": { "vendors": [ "FFmpeg" ], "products": [ { "vendor": "FFmpeg", "product": "FFmpeg" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-125", "name": "Out-of-bounds Read", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00214, "percentile": 0.11845 }, "nvd": { "published": "2026-07-22T18:17:05.627", "lastModified": "2026-07-28T17:01:39.307", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64833", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A length, offset, or termination error makes the program read beyond the end of an allocated buffer.", "basis": [ "CNA", "CWE-125" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Patch", "issue-tracking" ] }, { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 471, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64834", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.161Z", "date_published": "2026-07-22T17:06:07.659Z", "date_updated": "2026-07-28T01:06:04.724Z", "publisher": "VulnCheck", "title": "FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer", "affected": { "vendors": [ "FFmpeg" ], "products": [ { "vendor": "FFmpeg", "product": "FFmpeg" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 1.1999999999999993, "epss": { "score": 0.00503, "percentile": 0.40236 }, "nvd": { "published": "2026-07-22T18:17:05.780", "lastModified": "2026-07-28T17:01:56.720", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64834", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The RTP/ASF demuxer accepts an object chunksize below the 24-byte header minimum, so its loop cursor does not advance.", "basis": [ "CNA", "CWE-835" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Patch", "issue-tracking" ] }, { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 513, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64835", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:27:48.161Z", "date_published": "2026-07-22T17:24:05.477Z", "date_updated": "2026-07-28T01:06:05.429Z", "publisher": "VulnCheck", "title": "FFmpeg 4.4 - 8.1.2 Out-of-Bounds Memory Access in ADX Audio Decoder", "affected": { "vendors": [ "FFmpeg" ], "products": [ { "vendor": "FFmpeg", "product": "FFmpeg" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00332, "percentile": 0.2578 }, "nvd": { "published": "2026-07-22T18:17:05.917", "lastModified": "2026-07-28T17:02:06.783", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-64835", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "ADX header re-parsing accepts a mid-stream channel change but leaves the internal channel count stale before indexing the prev array.", "basis": [ "CNA", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "Issue Tracking", "Patch", "issue-tracking" ] }, { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "Patch", "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 565, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-64863", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:31:39.291Z", "date_published": "2026-07-28T22:02:15.887Z", "date_updated": "2026-07-29T12:48:07.346Z", "publisher": "GitHub_M", "title": "goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite", "affected": { "vendors": [ "goshs-labs" ], "products": [ { "vendor": "goshs-labs", "product": "goshs" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00337, "percentile": 0.26229 }, "nvd": { "published": "2026-07-28T23:17:10.213", "lastModified": "2026-07-30T19:19:45.637", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64863", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The WebDAV guard classifies MOVE only as a write and therefore skips the no-delete policy before a move deletes or overwrites a destination.", "basis": [ "CNA", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "x_refsource_CONFIRM" ] }, { "url": "https://github.com/goshs-labs/goshs/commit/0444ac6b1a8176ddae70d940adf7a26b2e5a6c29", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_MISC" ] }, { "url": "https://github.com/goshs-labs/goshs/releases/tag/v2.1.4", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 325, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64870", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:31:39.292Z", "date_published": "2026-07-30T17:01:18.102Z", "date_updated": "2026-07-30T17:42:51.968Z", "publisher": "GitHub_M", "title": "MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation", "affected": { "vendors": [ "1Panel-dev" ], "products": [ { "vendor": "1Panel-dev", "product": "MaxKB" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00215, "percentile": 0.11999 }, "nvd": { "published": "2026-07-30T19:18:35.397", "lastModified": "2026-07-30T19:29:19.027", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64870", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "UpdateStoreTool sends requests to caller-supplied download and callback URLs without trusted-host, redirect, or internal-address validation.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-7xxm-gqxv-ph3v", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "x_refsource_CONFIRM" ] }, { "url": "https://github.com/1Panel-dev/MaxKB/commit/a96a4fc17051d80e5b90a632ad8ec851d7d24b58", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 472, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64871", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:35:16.486Z", "date_published": "2026-07-23T09:14:27.579Z", "date_updated": "2026-07-25T05:34:34.817Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Cache Cleaner extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00093, "percentile": 0.007 }, "nvd": { "published": "2026-07-23T10:16:51.980", "lastModified": "2026-07-24T20:18:19.543", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64871", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Cache-purge URLs are accepted without consistently requiring a valid CSRF token or the cache-management permission.", "basis": [ "CNA", "CWE-284", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 216, "referenceCount": 1, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64872", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:35:16.486Z", "date_published": "2026-07-23T09:12:05.620Z", "date_updated": "2026-07-25T05:32:14.906Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Cache Cleaner Pro extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00224, "percentile": 0.13079 }, "nvd": { "published": "2026-07-23T10:16:52.087", "lastModified": "2026-07-24T20:18:19.690", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64872", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Cache Cleaner Pro accepts purge and log paths that can traverse outside the Joomla site webroot.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 152, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64873", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:35:16.486Z", "date_published": "2026-07-23T09:14:50.435Z", "date_updated": "2026-07-25T05:34:58.799Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Cache Cleaner Pro extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00268, "percentile": 0.18803 }, "nvd": { "published": "2026-07-23T10:16:52.193", "lastModified": "2026-07-24T20:18:19.837", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64873", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The URL validation in Cache Cleaner Pro extension for Joomla permits an attacker-selected destination to reach private, loopback, metadata, or otherwise restricted services.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 144, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64874", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:35:16.486Z", "date_published": "2026-07-23T09:11:18.832Z", "date_updated": "2026-07-27T13:29:53.752Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Cache Cleaner Pro extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0029, "percentile": 0.21236 }, "nvd": { "published": "2026-07-23T10:16:52.297", "lastModified": "2026-07-27T14:16:59.813", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64874", "family": "EXPOSURE_OUTPUT", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Cache Cleaner Pro places CDN credentials in administrator request URLs, exposing the secrets through the URL channel and its observers.", "basis": [ "CNA", "NVD", "CWE-200" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 149, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64875", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:46:40.119Z", "date_published": "2026-07-23T09:13:55.404Z", "date_updated": "2026-07-27T13:32:38.703Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "GeoIP extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-290", "name": "Authentication Bypass by Spoofing", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00214, "percentile": 0.11922 }, "nvd": { "published": "2026-07-23T10:16:52.400", "lastModified": "2026-07-27T14:16:59.970", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64875", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "GeoIP trusts spoofable forwarded client-IP headers as the request's network identity and applies location policy to the forged address.", "basis": [ "CNA", "NVD", "CWE-290" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 180, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64876", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T18:46:40.119Z", "date_published": "2026-07-23T09:12:50.726Z", "date_updated": "2026-07-29T05:38:42.253Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "GeoIP extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00127, "percentile": 0.02779 }, "nvd": { "published": "2026-07-23T10:16:52.510", "lastModified": "2026-07-28T16:20:05.543", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64876", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "GeoIP database-update requests inconsistently enforce both CSRF tokens and the Super User capability, permitting unauthorized updates.", "basis": [ "CNA", "NVD", "CWE-284", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 219, "referenceCount": 1, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64877", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T19:19:24.798Z", "date_published": "2026-07-21T18:06:22.276Z", "date_updated": "2026-07-24T03:55:53.208Z", "publisher": "tenable", "title": "An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.", "affected": { "vendors": [ "Tenable, Inc." ], "products": [ { "vendor": "Tenable, Inc.", "product": "Security Center" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-20", "name": "Improper Input Validation", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N" }, { "source": "cna", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "NVD:vulnreport@tenable.com", "type": "Secondary", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:vulnreport@tenable.com", "type": "Secondary", "version": "3.1", "score": 8.4, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 9.4, "cvss_source_score_spread": 1, "epss": { "score": 0.00191, "percentile": 0.0905 }, "nvd": { "published": "2026-07-21T19:17:13.340", "lastModified": "2026-07-24T05:16:47.993", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64877", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The ticket API concatenates attacker-controlled input into SQL syntax despite the record's generic input-validation mapping.", "basis": [ "CNA", "CWE-20" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.tenable.com/security/tns-2026-19", "host": "www.tenable.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 149, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64878", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T19:19:24.798Z", "date_published": "2026-07-21T19:41:36.053Z", "date_updated": "2026-07-24T03:55:54.040Z", "publisher": "tenable", "title": "Command Injection", "affected": { "vendors": [ "Tenable, Inc." ], "products": [ { "vendor": "Tenable, Inc.", "product": "Security Center" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "cna", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "NVD:vulnreport@tenable.com", "type": "Secondary", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:vulnreport@tenable.com", "type": "Secondary", "version": "3.1", "score": 9.9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.9, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00542, "percentile": 0.42478 }, "nvd": { "published": "2026-07-21T20:17:04.630", "lastModified": "2026-07-24T05:16:48.117", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64878", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Analysis REST endpoint places asset-filter input into a shell command without neutralizing shell metacharacters.", "basis": [ "CNA", "CWE-78" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.tenable.com/security/tns-2026-19", "host": "www.tenable.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 204, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64879", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T19:19:24.798Z", "date_published": "2026-07-21T19:54:06.008Z", "date_updated": "2026-07-24T03:55:54.833Z", "publisher": "tenable", "title": "Command Injection", "affected": { "vendors": [ "Tenable, Inc." ], "products": [ { "vendor": "Tenable, Inc.", "product": "Security Center" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": "cna", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "NVD:vulnreport@tenable.com", "type": "Secondary", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:vulnreport@tenable.com", "type": "Secondary", "version": "3.1", "score": 9.9, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.9, "cvss_source_score_spread": 0.5, "epss": { "score": 0.0259, "percentile": 0.83749 }, "nvd": { "published": "2026-07-21T20:17:04.763", "lastModified": "2026-07-24T05:16:48.240", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64879", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The audit upload path embeds an unsanitized filename in a system command, allowing shell metacharacters to alter the command.", "basis": [ "CNA", "CWE-78" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.tenable.com/security/tns-2026-19", "host": "www.tenable.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 234, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64880", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T19:19:24.798Z", "date_published": "2026-07-21T20:01:28.800Z", "date_updated": "2026-07-22T18:25:28.118Z", "publisher": "tenable", "title": "Blind SQL Injection", "affected": { "vendors": [ "Tenable, Inc." ], "products": [ { "vendor": "Tenable, Inc.", "product": "Security Center" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N" }, { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:vulnreport@tenable.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:vulnreport@tenable.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00184, "percentile": 0.08177 }, "nvd": { "published": "2026-07-21T20:17:04.900", "lastModified": "2026-07-22T20:35:40.827", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64880", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.tenable.com/security/tns-2026-19", "host": "www.tenable.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 222, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-64881", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-20T19:19:24.798Z", "date_published": "2026-07-21T20:09:50.741Z", "date_updated": "2026-07-24T03:55:55.735Z", "publisher": "tenable", "title": "Command Injection", "affected": { "vendors": [ "Tenable, Inc." ], "products": [ { "vendor": "Tenable, Inc.", "product": "Security Center" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:vulnreport@tenable.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:vulnreport@tenable.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.0144, "percentile": 0.70583 }, "nvd": { "published": "2026-07-21T21:16:53.880", "lastModified": "2026-07-24T05:16:48.357", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-64881", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution.", "basis": [ "CNA", "CWE-78" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.tenable.com/security/tns-2026-19", "host": "www.tenable.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 226, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65007", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T11:32:54.896Z", "date_published": "2026-07-21T11:39:56.387Z", "date_updated": "2026-07-23T14:29:10.593Z", "publisher": "VulnCheck", "title": "Grav before 1.0.8 Missing Authorization on API Key Generation", "affected": { "vendors": [ "getgrav" ], "products": [ { "vendor": "getgrav", "product": "grav" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.6, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.6, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 9.6, "cvss_source_score_spread": 0.9000000000000004, "epss": { "score": 0.00266, "percentile": 0.18305 }, "nvd": { "published": "2026-07-21T12:19:00.910", "lastModified": "2026-07-23T15:17:46.127", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65007", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The API-key task requires only baseline admin.login and lets the caller mint a key bound to any account.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/getgrav/grav/security/advisories/GHSA-7v74-m76q-8wf3", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/grav-before-missing-authorization-on-api-key-generation", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 638, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65008", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T11:32:54.897Z", "date_published": "2026-07-21T11:39:57.075Z", "date_updated": "2026-07-22T14:20:53.883Z", "publisher": "VulnCheck", "title": "Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData", "affected": { "vendors": [ "getgrav" ], "products": [ { "vendor": "getgrav", "product": "grav" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00838, "percentile": 0.54248 }, "nvd": { "published": "2026-07-21T12:19:01.183", "lastModified": "2026-07-22T15:17:21.973", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65008", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Blueprint::dynamicData() invokes an attacker-selected Class::method string with call_user_func_array() without an allowed-callable list.", "basis": [ "CNA", "CWE-94" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/getgrav/grav/security/advisories/GHSA-fj2p-qj2f-74v5", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/grav-before-remote-code-execution-via-blueprint-dynamicdata", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 590, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65009", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T11:32:54.897Z", "date_published": "2026-07-21T11:39:57.774Z", "date_updated": "2026-07-22T14:02:21.095Z", "publisher": "VulnCheck", "title": "OpenRemote before 1.26.2 Information Disclosure via Syslog REST API", "affected": { "vendors": [ "openremote" ], "products": [ { "vendor": "openremote", "product": "openremote" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 1, "epss": { "score": 0.00183, "percentile": 0.08123 }, "nvd": { "published": "2026-07-21T12:19:01.327", "lastModified": "2026-07-23T15:24:59.880", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65009", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "SyslogResource filters access by role but does not bind returned operational logs to the requested realm.", "basis": [ "CNA", "CWE-200" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/openremote/openremote/security/advisories/GHSA-fv8q-rwj8-2c55", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/openremote-before-information-disclosure-via-syslog-rest-api", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 415, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65010", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T11:32:54.897Z", "date_published": "2026-07-23T17:55:52.165Z", "date_updated": "2026-07-24T21:35:11.441Z", "publisher": "VulnCheck", "title": "Datasets Symlink-following Arbitrary File Write via Extractor.extract()", "affected": { "vendors": [ "huggingface" ], "products": [ { "vendor": "huggingface", "product": "datasets" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-61", "name": "UNIX Symbolic Link (Symlink) Following", "abstraction": "Compound", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 4.4, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 4.4, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 6.6, "cvss_source_score_spread": 2.1999999999999993, "epss": { "score": 0.00133, "percentile": 0.03224 }, "nvd": { "published": "2026-07-23T19:17:03.890", "lastModified": "2026-07-23T20:17:21.540", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65010", "family": "FILE_OBJECT_SELECTION", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "datasets follows an attacker-influenced link or pre-planted path without verifying the final filesystem object.", "basis": [ "CNA", "CWE-61" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/huggingface/datasets/issues/8296", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "issue-tracking", "technical-description" ] }, { "url": "https://github.com/huggingface/datasets/pull/8303", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "patch" ] }, { "url": "https://github.com/huggingface/datasets/commit/ad2d853ae2ce41d8068c23b44c2e29004312ccee", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/datasets-symlink-following-arbitrary-file-write-via-extractor-extract", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 418, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65011", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T11:32:54.897Z", "date_published": "2026-07-22T16:13:35.244Z", "date_updated": "2026-07-24T21:35:12.085Z", "publisher": "VulnCheck", "title": "Graylog2 Server Missing Permission Check on Event Definition Duplicate", "affected": { "vendors": [ "Graylog2" ], "products": [ { "vendor": "Graylog2", "product": "graylog2-server" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 1, "epss": { "score": 0.00218, "percentile": 0.12311 }, "nvd": { "published": "2026-07-22T17:16:58.837", "lastModified": "2026-07-23T15:24:59.880", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65011", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The event-definition duplicate endpoint checks create capability but omits permission on the selected source definition.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/Graylog2/graylog2-server/issues/26590", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "technical-description" ] }, { "url": "https://github.com/Graylog2/graylog2-server/pull/26706", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "patch" ] }, { "url": "https://github.com/Graylog2/graylog2-server/commit/46a2eeba4cdbc1408ff4cbf7b466853a8acfb38d", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://github.com/Graylog2/graylog2-server/pull/26718", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "patch" ] }, { "url": "https://github.com/Graylog2/graylog2-server/pull/26719", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "patch" ] }, { "url": "https://www.vulncheck.com/advisories/graylog2-server-missing-permission-check-on-event-definition-duplicate", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 444, "referenceCount": 6, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-65012", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T11:32:54.897Z", "date_published": "2026-07-22T16:13:58.807Z", "date_updated": "2026-07-24T21:35:12.778Z", "publisher": "VulnCheck", "title": "InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder", "affected": { "vendors": [ "invoke-ai" ], "products": [ { "vendor": "invoke-ai", "product": "InvokeAI" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 1, "epss": { "score": 0.00257, "percentile": 0.17239 }, "nvd": { "published": "2026-07-22T17:16:58.990", "lastModified": "2026-07-23T16:17:50.107", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65012", "family": "FILE_OBJECT_SELECTION", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "An arbitrary scan_path recursively enumerates server files outside the intended scan root.", "basis": [ "CNA", "CWE-306" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/invoke-ai/InvokeAI/issues/9365", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "issue-tracking", "technical-description" ] }, { "url": "https://github.com/invoke-ai/InvokeAI/releases/tag/v6.13.7", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch", "release-notes" ] }, { "url": "https://github.com/invoke-ai/InvokeAI/pull/9367", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "patch" ] }, { "url": "https://github.com/invoke-ai/InvokeAI/commit/d315b8967f548732912bd9b390853ed4af97d8cb", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/invokeai-unauthenticated-directory-enumeration-via-scan-folder", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 396, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65013", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T11:32:54.897Z", "date_published": "2026-07-22T16:14:23.346Z", "date_updated": "2026-07-24T21:35:13.457Z", "publisher": "VulnCheck", "title": "Onlook tRPC Insecure Direct Object Reference via multiple procedures", "affected": { "vendors": [ "onlook" ], "products": [ { "vendor": "onlook", "product": "repo" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.003, "percentile": 0.22232 }, "nvd": { "published": "2026-07-22T17:16:59.143", "lastModified": "2026-07-23T15:23:01.470", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65013", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Multiple tRPC procedures accept a caller-supplied project or conversation UUID without binding that object to the authenticated user.", "basis": [ "CNA record", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/onlook-dev/onlook/issues/3122", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "issue-tracking", "technical-description" ] }, { "url": "https://github.com/onlook-dev/onlook/pull/3129", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking", "patch" ] }, { "url": "https://github.com/onlook-dev/onlook/commit/423e2e924366419e418ee049093872d535eea41a", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/onlook-trpc-insecure-direct-object-reference-via-multiple-procedures", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 506, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65014", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T11:32:54.897Z", "date_published": "2026-07-22T11:21:37.350Z", "date_updated": "2026-07-22T12:26:12.006Z", "publisher": "VulnCheck", "title": "n8n before 2.28.0 Authentication Bypass via test-webhook", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 1, "epss": { "score": 0.00334, "percentile": 0.25944 }, "nvd": { "published": "2026-07-22T12:18:18.453", "lastModified": "2026-07-27T19:00:42.247", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65014", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "n8n exposes a security-sensitive endpoint without requiring caller authentication.", "basis": [ "CNA", "CWE-306" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-33q9-f52j-gc75", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-test-webhook", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 440, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-65015", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T11:32:54.897Z", "date_published": "2026-07-22T11:21:38.034Z", "date_updated": "2026-07-22T18:24:22.671Z", "publisher": "VulnCheck", "title": "n8n before 2.30.1 Privilege Escalation via run_node_tool", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 1.6000000000000005, "epss": { "score": 0.00324, "percentile": 0.24881 }, "nvd": { "published": "2026-07-22T12:18:18.587", "lastModified": "2026-07-28T18:17:25.740", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65015", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The AI Agents run-node tool lets a Project Viewer execute nodes and access credential secrets without checking that role's authorization.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-x5vx-c2c8-m3w9", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-run-node-tool", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "VDB Entry", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 364, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-65016", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T11:32:54.897Z", "date_published": "2026-07-22T11:21:38.704Z", "date_updated": "2026-07-24T21:35:14.139Z", "publisher": "VulnCheck", "title": "n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 1.1000000000000005, "epss": { "score": 0.00308, "percentile": 0.2315 }, "nvd": { "published": "2026-07-22T12:18:18.733", "lastModified": "2026-07-27T19:08:16.213", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65016", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The n8n SSO provisioning path accepts an IdP instance-role claim that maps to global:owner without applying the owner-role rejection used by token exchange.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-35q8-9mj6-wjmf", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-sso-instance-role", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 780, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-65048", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T14:05:53.719Z", "date_published": "2026-07-21T14:16:08.414Z", "date_updated": "2026-07-22T14:56:24.647Z", "publisher": "VulnCheck", "title": "Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index", "affected": { "vendors": [ "Saturday Drive" ], "products": [ { "vendor": "Saturday Drive", "product": "Ninja Forms" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00313, "percentile": 0.23662 }, "nvd": { "published": "2026-07-21T15:16:38.813", "lastModified": "2026-07-21T18:55:23.673", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65048", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled text is placed into an HTML or script context without context-appropriate escaping, allowing browser script execution.", "basis": [ "CNA record", "NVD", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://wordpress.org/plugins/ninja-forms/", "host": "wordpress.org", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://wordpress.org/plugins/ninja-forms/changelog/", "host": "wordpress.org", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ninja-forms-unauthenticated-stored-cross-site-scripting-via-repeatable-fieldset-submission-index", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 728, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65049", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T14:05:53.719Z", "date_published": "2026-07-21T14:22:08.297Z", "date_updated": "2026-07-22T14:56:16.047Z", "publisher": "VulnCheck", "title": "Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action", "affected": { "vendors": [ "Saturday Drive" ], "products": [ { "vendor": "Saturday Drive", "product": "Ninja Forms" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.4, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H" }, { "source": "cna", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.4, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0.9000000000000004, "epss": { "score": 0.00275, "percentile": 0.1962 }, "nvd": { "published": "2026-07-21T15:16:38.970", "lastModified": "2026-07-21T18:55:23.673", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65049", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "nf_delete_all_data accepts a subsite administrator's site-scoped capability and nonce before running a migration that deletes Ninja Forms data across every blog.", "basis": [ "CNA", "NVD", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://wordpress.org/plugins/ninja-forms/", "host": "wordpress.org", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://wordpress.org/plugins/ninja-forms/changelog/", "host": "wordpress.org", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ninja-forms-cross-site-network-wide-data-deletion-on-wordpress-multisite-via-nf-delete-all-data-ajax-action", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 682, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65050", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T14:05:53.719Z", "date_published": "2026-07-21T14:26:53.210Z", "date_updated": "2026-07-23T18:15:32.340Z", "publisher": "VulnCheck", "title": "Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors", "affected": { "vendors": [ "Saturday Drive" ], "products": [ { "vendor": "Saturday Drive", "product": "Ninja Forms" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00343, "percentile": 0.26973 }, "nvd": { "published": "2026-07-21T15:16:39.147", "lastModified": "2026-07-23T19:17:04.233", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65050", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Ninja Forms submissions-table block accepts an arbitrary formID from an Author and publishes a bearer token that exposes the selected form's submissions to visitors.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://wordpress.org/plugins/ninja-forms/", "host": "wordpress.org", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://wordpress.org/plugins/ninja-forms/changelog/", "host": "wordpress.org", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ninja-forms-missing-authorization-in-submissions-table-gutenberg-block-discloses-form-submissions-to-unauthenticated-visitors", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 699, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65051", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T14:05:53.719Z", "date_published": "2026-07-21T14:31:55.558Z", "date_updated": "2026-07-23T14:27:47.196Z", "publisher": "VulnCheck", "title": "Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler", "affected": { "vendors": [ "Saturday Drive" ], "products": [ { "vendor": "Saturday Drive", "product": "Ninja Forms" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-602", "name": "Client-Side Enforcement of Server-Side Security", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.9, "cvss_source_score_spread": 0.40000000000000036, "epss": { "score": 0.00283, "percentile": 0.20495 }, "nvd": { "published": "2026-07-21T15:16:39.290", "lastModified": "2026-07-23T15:17:47.920", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65051", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Client-supplied metadata overwrites server-defined form controls and their enforcement checks.", "basis": [ "CNA", "CWE-602" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://wordpress.org/plugins/ninja-forms/", "host": "wordpress.org", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://wordpress.org/plugins/ninja-forms/changelog/", "host": "wordpress.org", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ninja-forms-server-side-validation-bypass-via-client-controlled-field-metadata-merge-in-ajax-submission-handler", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 568, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65052", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T14:05:53.719Z", "date_published": "2026-07-21T14:36:07.284Z", "date_updated": "2026-07-22T14:57:13.781Z", "publisher": "VulnCheck", "title": "Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields", "affected": { "vendors": [ "Saturday Drive" ], "products": [ { "vendor": "Saturday Drive", "product": "Ninja Forms" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-472", "name": "External Control of Assumed-Immutable Web Parameter", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 1.1999999999999993, "epss": { "score": 0.00364, "percentile": 0.29149 }, "nvd": { "published": "2026-07-21T15:16:39.430", "lastModified": "2026-07-22T15:17:22.303", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65052", "family": "OTHER_SPECIFIC", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The calculation handler treats an option value absent from the configured choice list as a valid attacker-supplied numeric price.", "basis": [ "CNA", "CWE-472" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://wordpress.org/plugins/ninja-forms/", "host": "wordpress.org", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://wordpress.org/plugins/ninja-forms/changelog/", "host": "wordpress.org", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ninja-forms-calculation-and-payment-total-tampering-via-fail-open-get-calc-value-in-listselect-and-listradio-fields", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 600, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65054", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T14:05:53.719Z", "date_published": "2026-07-21T20:28:30.111Z", "date_updated": "2026-07-22T15:41:48.448Z", "publisher": "VulnCheck", "title": "MediaCMS Private Media Metadata Disclosure via Playlist Ownership Loophole", "affected": { "vendors": [ "MediaCMS" ], "products": [ { "vendor": "MediaCMS", "product": "MediaCMS" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 3.1, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 3.1, "severity": "LOW", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 5.1, "epss": { "score": 0.00202, "percentile": 0.10363 }, "nvd": { "published": "2026-07-21T21:16:54.020", "lastModified": "2026-07-23T15:13:11.420", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65054", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "MediaCMS lets a user add another owner's media token to a playlist and then returns private metadata without validating ownership.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mediacms-io/mediacms/issues/1548", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://github.com/mediacms-io/mediacms", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/mediacms-private-media-metadata-disclosure-via-playlist-ownership-loophole", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 601, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65055", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T14:05:53.720Z", "date_published": "2026-07-21T20:43:53.144Z", "date_updated": "2026-07-23T14:11:24.318Z", "publisher": "VulnCheck", "title": "Taiga taiga-back Private Project Member Roster Disclosure via Unauthenticated filters_data Endpoints", "affected": { "vendors": [ "Taiga" ], "products": [ { "vendor": "Taiga", "product": "taiga-back" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.9, "cvss_source_score_spread": 1.6000000000000005, "epss": { "score": 0.00251, "percentile": 0.16533 }, "nvd": { "published": "2026-07-21T21:16:54.157", "lastModified": "2026-07-23T15:24:59.880", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65055", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/taigaio/taiga-back/issues/246", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "product" ] }, { "url": "https://github.com/taigaio/taiga-back", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/taiga-taiga-back-private-project-member-roster-disclosure-via-unauthenticated-filters-data-endpoints", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 595, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65056", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T14:05:53.720Z", "date_published": "2026-07-21T20:48:50.681Z", "date_updated": "2026-07-22T15:01:19.864Z", "publisher": "VulnCheck", "title": "mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering", "affected": { "vendors": [ "mzxrai" ], "products": [ { "vendor": "mzxrai", "product": "mcp-webresearch" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" } ], "max_cvss_observed_across_sources": 8.3, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00231, "percentile": 0.1401 }, "nvd": { "published": "2026-07-21T21:16:54.287", "lastModified": "2026-07-23T15:24:59.880", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65056", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visit_page tool, which only validates the URL protocol without filtering private or reserved IP ranges.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/geo-chen/oss/blob/main/mcp-webresearch.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "product" ] }, { "url": "https://www.npmjs.com/package/@mzxrai/mcp-webresearch", "host": "www.npmjs.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/mcp-webresearch-server-side-request-forgery-in-visit-page-due-to-missing-internal-ip-filtering", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 598, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65057", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T14:05:53.720Z", "date_published": "2026-07-21T20:56:10.062Z", "date_updated": "2026-07-28T01:06:06.066Z", "publisher": "VulnCheck", "title": "Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck", "affected": { "vendors": [ "keephq" ], "products": [ { "vendor": "keephq", "product": "keep" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00246, "percentile": 0.15857 }, "nvd": { "published": "2026-07-21T21:16:54.427", "lastModified": "2026-07-23T15:23:01.470", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65057", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected component trusts attacker-controlled request, origin, redirect, or channel metadata without validating the final security boundary.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/keephq/keep/issues/6630", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "issue-tracking" ] }, { "url": "https://github.com/keephq/keep", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/keep-unauthenticated-server-side-request-forgery-via-post-providers-healthcheck", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 493, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65058", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T14:35:48.323Z", "date_published": "2026-07-21T20:13:00.560Z", "date_updated": "2026-07-30T17:29:43.291Z", "publisher": "cisa-cg", "title": "Trezor Safe improper security check in on-device display", "affected": { "vendors": [ "Trezor" ], "products": [ { "vendor": "Trezor", "product": "Safe 3" }, { "vendor": "Trezor", "product": "Safe 7" }, { "vendor": "Trezor", "product": "Safe 5" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unknown" ] }, "cwes": [ { "id": "CWE-358", "name": "Improperly Implemented Security Check for Standard", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": "cna", "version": "4.0", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary", "version": "4.0", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:9119a7d8-5eab-497f-8521-727c672e3725", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 5.9, "cvss_source_score_spread": 0.6000000000000005, "epss": { "score": 0.00279, "percentile": 0.2017 }, "nvd": { "published": "2026-07-21T21:16:54.567", "lastModified": "2026-07-30T19:18:35.550", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65058", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Trezor signs the full transaction tail while the confirmation screen presents only the first chunk, so the user authorization is not bound to all signed bytes.", "basis": [ "CNA", "CWE-358" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/trezor/trezor-firmware/commit/70c9b0c07748", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-65058", "host": "www.cve.org", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] }, { "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-02.json", "host": "raw.githubusercontent.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 396, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 3, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-65061", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T15:29:37.116Z", "date_published": "2026-07-21T19:07:41.644Z", "date_updated": "2026-07-23T12:48:19.771Z", "publisher": "CPANSec", "title": "Data::ReqRep::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::ReqRep::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 3.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00117, "percentile": 0.01927 }, "nvd": { "published": "2026-07-21T20:17:05.030", "lastModified": "2026-07-23T14:17:42.040", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65061", "family": "FILE_OBJECT_SELECTION", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The shared mmap file is created without O_EXCL or O_NOFOLLOW, allowing a local peer to pre-create or redirect the path before the process opens it.", "basis": [ "CNA", "CWE-59", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-ReqRep-Shared-0.05/diff/EGOR/Data-ReqRep-Shared-0.04#reqrep.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-ReqRep-Shared-0.05/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 807, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65062", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T15:29:37.116Z", "date_published": "2026-07-21T19:08:01.856Z", "date_updated": "2026-07-23T12:49:16.777Z", "publisher": "CPANSec", "title": "Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::SortedSet::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 3.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00117, "percentile": 0.01926 }, "nvd": { "published": "2026-07-21T20:17:05.190", "lastModified": "2026-07-23T14:17:42.913", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65062", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The shared backing file is created mode 0666 and opened without O_EXCL or O_NOFOLLOW, exposing contents and accepting a pre-planted file or symlink.", "basis": [ "CNA", "CWE-59", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/diff/EGOR/Data-SortedSet-Shared-0.02#sortedset.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 750, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65063", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T15:29:37.116Z", "date_published": "2026-07-21T19:08:19.927Z", "date_updated": "2026-07-23T12:50:22.071Z", "publisher": "CPANSec", "title": "Data::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::RadixTree::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 3.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00117, "percentile": 0.01927 }, "nvd": { "published": "2026-07-21T20:17:05.313", "lastModified": "2026-07-23T14:17:43.680", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65063", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The shared mmap file is created world-readable and opened without exclusive-create or no-follow safeguards in a shared directory.", "basis": [ "CNA", "CWE-59", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-RadixTree-Shared-0.02/diff/EGOR/Data-RadixTree-Shared-0.01#radix.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-RadixTree-Shared-0.02/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 746, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65064", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T15:29:37.116Z", "date_published": "2026-07-21T19:08:34.479Z", "date_updated": "2026-07-23T12:59:03.694Z", "publisher": "CPANSec", "title": "Data::HashMap::Shared versions before 0.14 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::HashMap::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 3.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00117, "percentile": 0.01926 }, "nvd": { "published": "2026-07-21T20:17:05.430", "lastModified": "2026-07-23T14:17:44.167", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65064", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The shared-map backing file is opened without O_EXCL or O_NOFOLLOW and with a world-readable mode, allowing a planted path or symlink to select the file object.", "basis": [ "CNA", "CWE-59", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-HashMap-Shared-0.14/diff/EGOR/Data-HashMap-Shared-0.13#shm_generic.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-HashMap-Shared-0.14/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 764, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65065", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T15:29:37.116Z", "date_published": "2026-07-21T19:08:49.522Z", "date_updated": "2026-07-27T14:07:43.749Z", "publisher": "CPANSec", "title": "Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::RoaringBitmap::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00123, "percentile": 0.02484 }, "nvd": { "published": "2026-07-21T20:17:05.537", "lastModified": "2026-07-24T18:18:08.287", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65065", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The shared segment open omits O_EXCL and O_NOFOLLOW, so a preplanted file or symlink can redirect the mmap backing object to an attacker-selected target.", "basis": [ "CNA", "CWE-59" ], "deepDive": false, "notes": "The record also describes mode 0666 and world-readable data; the symlink and pre-creation target failure is the selected primary family." }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-RoaringBitmap-Shared-0.02/diff/EGOR/Data-RoaringBitmap-Shared-0.01#roaring.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-RoaringBitmap-Shared-0.02/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 752, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65066", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T15:29:37.116Z", "date_published": "2026-07-21T19:09:03.992Z", "date_updated": "2026-07-23T13:08:00.634Z", "publisher": "CPANSec", "title": "Data::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::RingBuffer::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 3.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00117, "percentile": 0.01927 }, "nvd": { "published": "2026-07-21T20:17:05.637", "lastModified": "2026-07-23T14:17:45.217", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65066", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The shared-segment open follows a pre-planted symlink and reuses an existing path because O_NOFOLLOW and O_EXCL are absent.", "basis": [ "CNA", "CWE-59", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-RingBuffer-Shared-0.04/diff/EGOR/Data-RingBuffer-Shared-0.03#ring.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-RingBuffer-Shared-0.04/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 746, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65067", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T15:29:37.116Z", "date_published": "2026-07-21T19:09:26.950Z", "date_updated": "2026-07-23T13:16:50.281Z", "publisher": "CPANSec", "title": "Data::Intern::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::Intern::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 3.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00117, "percentile": 0.01925 }, "nvd": { "published": "2026-07-21T20:17:05.733", "lastModified": "2026-07-23T14:17:45.720", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65067", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The shared segment open follows a pre-planted symlink and reuses an existing attacker-selected path instead of creating a new file exclusively.", "basis": [ "CNA", "CWE-59", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-Intern-Shared-0.02/diff/EGOR/Data-Intern-Shared-0.01#intern.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-Intern-Shared-0.02/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 744, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65068", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T15:29:37.116Z", "date_published": "2026-07-21T19:09:41.280Z", "date_updated": "2026-07-23T13:18:33.180Z", "publisher": "CPANSec", "title": "Data::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::SpatialHash::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 3.8, "severity": "LOW", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 3.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00117, "percentile": 0.01926 }, "nvd": { "published": "2026-07-21T20:17:05.837", "lastModified": "2026-07-23T14:17:46.180", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65068", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The shared mmap file is opened with world-readable permissions and follows a pre-planted symlink because O_EXCL and O_NOFOLLOW are absent.", "basis": [ "CNA", "CWE-59", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-SpatialHash-Shared-0.02/diff/EGOR/Data-SpatialHash-Shared-0.01#sphash.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-SpatialHash-Shared-0.02/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 749, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65069", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T15:29:37.117Z", "date_published": "2026-07-21T19:10:00.536Z", "date_updated": "2026-07-23T13:22:20.294Z", "publisher": "CPANSec", "title": "Data::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW", "affected": { "vendors": [ "EGOR" ], "products": [ { "vendor": "EGOR", "product": "Data::DisjointSet::Shared" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4, "cvss_source_score_spread": 0, "epss": { "score": 0.00137, "percentile": 0.03556 }, "nvd": { "published": "2026-07-21T20:17:05.940", "lastModified": "2026-07-23T14:17:46.607", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65069", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Data::DisjointSet::Shared opens an attacker-selectable filesystem path without preventing symbolic-link substitution or exclusive-create races, so the operation can target a different object.", "basis": [ "CNA", "NVD", "CWE-59", "CWE-732" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://metacpan.org/release/EGOR/Data-DisjointSet-Shared-0.02/diff/EGOR/Data-DisjointSet-Shared-0.01#dsu.h", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://metacpan.org/release/EGOR/Data-DisjointSet-Shared-0.02/changes", "host": "metacpan.org", "sources": [ "cna", "nvd" ], "tags": [ "release-notes" ] } ], "record_shape": { "descriptionChars": 746, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65100", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T17:10:18.202Z", "date_published": "2026-07-29T09:06:17.226Z", "date_updated": "2026-07-29T12:10:22.340Z", "publisher": "apache", "title": "Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode", "affected": { "vendors": [ "Apache Software Foundation" ], "products": [ { "vendor": "Apache Software Foundation", "product": "Apache Traffic Server" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-696", "name": "Incorrect Behavior Order", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "source": "cna", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N" }, { "source": "NVD:security@apache.org", "type": "Secondary", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:security@apache.org", "type": "Secondary", "version": "3.1", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 1.5, "epss": { "score": 0.00449, "percentile": 0.36877 }, "nvd": { "published": "2026-07-29T10:16:44.523", "lastModified": "2026-08-03T19:31:56.333", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65100", "family": "STATE_SEQUENCE", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Traffic Server mutates its HPACK dynamic table before confirming encoding succeeds, leaving subsequent headers out of sync with the peer decoder.", "basis": [ "CNA", "NVD", "CWE-696" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d", "host": "lists.apache.org", "sources": [ "cna", "nvd" ], "tags": [ "Mailing List", "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 456, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-65309", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T20:33:52.962Z", "date_published": "2026-07-31T07:17:40.473Z", "date_updated": "2026-07-31T16:36:34.930Z", "publisher": "CyberDanube", "title": "Storage of passwords in a reversible format", "affected": { "vendors": [ "ANDRITZ" ], "products": [ { "vendor": "ANDRITZ", "product": "HIPASE-250" }, { "vendor": "ANDRITZ", "product": "250 SCALA" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-257", "name": "Storing Passwords in a Recoverable Format", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-327", "name": "Use of a Broken or Risky Cryptographic Algorithm", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:office@cyberdanube.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00152, "percentile": 0.04895 }, "nvd": { "published": "2026-07-31T08:16:28.330", "lastModified": "2026-07-31T17:16:34.640", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65309", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "HIPASE-250 stores and transmits passwords in a reversible encrypted form instead of a one-way password hash.", "basis": [ "CNA", "CWE-257", "CWE-327" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.andritz.com/", "host": "www.andritz.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 276, "referenceCount": 1, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-65310", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T20:33:52.962Z", "date_published": "2026-07-31T07:26:29.954Z", "date_updated": "2026-07-31T16:34:44.010Z", "publisher": "CyberDanube", "title": "Missing authentication and permissive CORS policy", "affected": { "vendors": [ "ANDRITZ" ], "products": [ { "vendor": "ANDRITZ", "product": "HIPASE-250" }, { "vendor": "ANDRITZ", "product": "250 SCALA" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-942", "name": "Permissive Cross-domain Security Policy with Untrusted Domains", "abstraction": "Variant", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:office@cyberdanube.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00318, "percentile": 0.24237 }, "nvd": { "published": "2026-07-31T09:16:58.447", "lastModified": "2026-07-31T17:16:34.750", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65310", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The HIPASE-250 data and configuration endpoint is exposed without authentication in the default configuration, permitting unauthenticated reads of process values and server settings.", "basis": [ "CNA", "CWE-306", "CWE-942" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.andritz.com/", "host": "www.andritz.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 304, "referenceCount": 1, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-65311", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T20:33:52.962Z", "date_published": "2026-07-31T07:30:07.250Z", "date_updated": "2026-07-31T16:33:32.293Z", "publisher": "CyberDanube", "title": "Missing authentication for logging-configuration endpoint", "affected": { "vendors": [ "ANDRITZ" ], "products": [ { "vendor": "ANDRITZ", "product": "HIPASE-250" }, { "vendor": "ANDRITZ", "product": "250 SCALA" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-306", "name": "Missing Authentication for Critical Function", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:office@cyberdanube.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00269, "percentile": 0.18847 }, "nvd": { "published": "2026-07-31T09:16:58.960", "lastModified": "2026-07-31T17:16:34.860", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65311", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication.", "basis": [ "CNA", "CWE-284", "CWE-306", "CWE-532" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.andritz.com/", "host": "www.andritz.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 358, "referenceCount": 1, "cweCount": 3, "cnaCweCount": 3, "adpCweCount": 0, "nvdCweCount": 3, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-65313", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T20:33:52.962Z", "date_published": "2026-07-31T07:34:11.400Z", "date_updated": "2026-07-31T16:32:44.345Z", "publisher": "CyberDanube", "title": "Use of hard-coded VNC credentials in the engineering-workstation provisioning", "affected": { "vendors": [ "ANDRITZ" ], "products": [ { "vendor": "ANDRITZ", "product": "HIPASE-250" }, { "vendor": "ANDRITZ", "product": "250 SCALA" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-798", "name": "Use of Hard-coded Credentials", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-1392", "name": "Use of Default Credentials", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:office@cyberdanube.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00176, "percentile": 0.07363 }, "nvd": { "published": "2026-07-31T09:16:59.090", "lastModified": "2026-07-31T17:16:34.970", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65313", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The workstation provisioning script installs the same fixed x11vnc password on every engineering workstation.", "basis": [ "CNA", "CWE-798", "CWE-1392" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.andritz.com/", "host": "www.andritz.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 333, "referenceCount": 1, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-65314", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T20:57:44.879Z", "date_published": "2026-07-21T21:05:44.377Z", "date_updated": "2026-07-22T15:35:06.428Z", "publisher": "VulnCheck", "title": "Electric Postgres Sync Excluded-Column Value Inference via Subset Where Clauses", "affected": { "vendors": [ "ElectricSQL" ], "products": [ { "vendor": "ElectricSQL", "product": "Electric Postgres Sync" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-203", "name": "Observable Discrepancy", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 1, "epss": { "score": 0.00228, "percentile": 0.13693 }, "nvd": { "published": "2026-07-21T22:19:09.907", "lastModified": "2026-07-23T15:23:01.470", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65314", "family": "EXPOSURE_OUTPUT", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Attackers can place excluded-column predicates in shape filters and infer hidden values from whether each predicate returns a row.", "basis": [ "CNA", "CWE-203" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/electric-sql/electric/security/advisories/GHSA-c82q-v86f-c87f", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://github.com/electric-sql/electric", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/electric-postgres-sync-excluded-column-value-inference-via-subset-where-clauses", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 426, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65315", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T20:57:44.879Z", "date_published": "2026-07-21T21:18:24.567Z", "date_updated": "2026-07-28T01:06:06.852Z", "publisher": "VulnCheck", "title": "Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser", "affected": { "vendors": [ "Ollama" ], "products": [ { "vendor": "Ollama", "product": "Ollama" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-789", "name": "Memory Allocation with Excessive Size Value", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 1.1999999999999993, "epss": { "score": 0.00572, "percentile": 0.4406 }, "nvd": { "published": "2026-07-21T22:19:10.050", "lastModified": "2026-07-22T20:40:02.810", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65315", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The GGUF parser trusts file-supplied lengths and counts as allocation sizes without checking them against the remaining file size.", "basis": [ "CNA", "CWE-789" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/ollama/ollama/issues/17042", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/ollama/ollama", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ollama-remote-denial-of-service-via-attacker-controlled-allocation-in-gguf-metadata-parser", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 649, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65316", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T20:57:44.880Z", "date_published": "2026-07-21T21:23:55.384Z", "date_updated": "2026-07-28T01:06:07.545Z", "publisher": "VulnCheck", "title": "xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat", "affected": { "vendors": [ "xuxueli" ], "products": [ { "vendor": "xuxueli", "product": "xxl-job" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00382, "percentile": 0.30903 }, "nvd": { "published": "2026-07-21T22:19:10.197", "lastModified": "2026-07-23T19:17:04.387", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65316", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "xxl-job resolves a caller-controlled object identifier without binding the selected object to the caller's authorized scope.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/xuxueli/xxl-job/issues/3983", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://github.com/xuxueli/xxl-job", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://www.vulncheck.com/advisories/xxl-job-cross-job-group-log-disclosure-via-missing-authorization-check-in-joblog-logdetailcat", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 541, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65317", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T20:57:44.880Z", "date_published": "2026-07-21T21:31:01.979Z", "date_updated": "2026-07-23T14:02:13.652Z", "publisher": "VulnCheck", "title": "Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass", "affected": { "vendors": [ "Weaviate" ], "products": [ { "vendor": "Weaviate", "product": "Verba" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 9.2, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00481, "percentile": 0.38935 }, "nvd": { "published": "2026-07-21T22:19:10.340", "lastModified": "2026-07-23T15:23:01.470", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65317", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A prefix-based Origin check can be forged and the connect endpoint then issues a server-side request to caller-selected host and port values.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/geo-chen/oss/blob/main/verba.md#finding-2-ssrf--same-origin-middleware-bypass-in-apiconnect----goldenverba", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] }, { "url": "https://github.com/weaviate/Verba", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://www.vulncheck.com/advisories/verba-goldenverba-server-side-request-forgery-via-api-connect-and-same-origin-middleware-bypass", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 611, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65318", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T20:57:44.880Z", "date_published": "2026-07-21T21:36:23.960Z", "date_updated": "2026-07-22T14:12:42.416Z", "publisher": "VulnCheck", "title": "Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader", "affected": { "vendors": [ "Weaviate" ], "products": [ { "vendor": "Weaviate", "product": "Verba" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 9.2, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00424, "percentile": 0.34964 }, "nvd": { "published": "2026-07-21T22:19:10.490", "lastModified": "2026-07-23T15:23:01.470", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65318", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A server-side request accepts an attacker-selected destination without enforcing the intended network boundary.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/geo-chen/oss/blob/main/verba.md#finding-1-unauthenticated-ssrf-in-verba-websocket-import-endpoint-htmlreader", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] }, { "url": "https://github.com/weaviate/Verba", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://www.vulncheck.com/advisories/verba-goldenverba-unauthenticated-server-side-request-forgery-via-websocket-import-endpoint-htmlreader", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 581, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65319", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T20:57:44.880Z", "date_published": "2026-07-21T21:40:53.529Z", "date_updated": "2026-07-22T15:09:30.443Z", "publisher": "VulnCheck", "title": "Feedbin Unauthenticated Entry Content Disclosure via GET /api/v2/entries/:id/text", "affected": { "vendors": [ "Feedbin" ], "products": [ { "vendor": "Feedbin", "product": "Feedbin" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 1.1999999999999993, "epss": { "score": 0.00371, "percentile": 0.29807 }, "nvd": { "published": "2026-07-21T22:19:10.630", "lastModified": "2026-07-23T15:23:01.470", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65319", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The entry-text API omits authentication before resolving a sequential entry identifier.", "basis": [ "CNA record", "CWE-306" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/geo-chen/oss/blob/main/feedbin.md", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit" ] }, { "url": "https://github.com/feedbin/feedbin/commit/04b89b84189e4727ea19d84ea4a44015859b29cc", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch", "product" ] }, { "url": "https://github.com/feedbin/feedbin", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://www.vulncheck.com/advisories/feedbin-unauthenticated-entry-content-disclosure-via-get-api-v2-entries-id-text", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 558, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65324", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T20:59:11.713Z", "date_published": "2026-07-29T08:17:46.795Z", "date_updated": "2026-07-29T12:20:42.788Z", "publisher": "apache", "title": "Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion", "affected": { "vendors": [ "Apache Software Foundation" ], "products": [ { "vendor": "Apache Software Foundation", "product": "Apache Traffic Server" } ], "affectedBlockCount": 1, "versionEntryCount": 3, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-400", "name": "Uncontrolled Resource Consumption", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "cna", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:security@apache.org", "type": "Secondary", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:security@apache.org", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0.6999999999999993, "epss": { "score": 0.00474, "percentile": 0.38512 }, "nvd": { "published": "2026-07-29T09:16:30.410", "lastModified": "2026-08-03T13:40:01.187", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65324", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "HTTP/2 and HTTP/3 dechunking drops the per-stream buffer cap, so a slow client can retain unbounded response data in memory.", "basis": [ "CNA", "CWE-400" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d", "host": "lists.apache.org", "sources": [ "cna", "nvd" ], "tags": [ "Mailing List", "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 350, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 3 } }, { "cve_id": "CVE-2026-65325", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-21T20:59:59.103Z", "date_published": "2026-07-29T08:23:28.374Z", "date_updated": "2026-07-29T12:19:26.906Z", "publisher": "apache", "title": "Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification", "affected": { "vendors": [ "Apache Software Foundation" ], "products": [ { "vendor": "Apache Software Foundation", "product": "Apache Traffic Server" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-295", "name": "Improper Certificate Validation", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": "cna", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "source": "NVD:security@apache.org", "type": "Secondary", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:security@apache.org", "type": "Secondary", "version": "3.1", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 1.5, "epss": { "score": 0.00165, "percentile": 0.06161 }, "nvd": { "published": "2026-07-29T09:16:30.543", "lastModified": "2026-08-03T13:39:52.730", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65325", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Traffic Server reuses an HTTP/2 origin connection for a new hostname without checking that the server certificate covers that hostname.", "basis": [ "CNA", "CWE-295" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d", "host": "lists.apache.org", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 322, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65421", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-27T19:32:49.396Z", "date_published": "2026-07-30T22:35:14.668Z", "date_updated": "2026-07-31T15:55:36.578Z", "publisher": "icscert", "title": "MZ Automation libiec61850 Out-of-bounds Read", "affected": { "vendors": [ "MZ Automation GmbH" ], "products": [ { "vendor": "MZ Automation GmbH", "product": "libiec61850" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-125", "name": "Out-of-bounds Read", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:ics-cert@hq.dhs.gov", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:ics-cert@hq.dhs.gov", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00175, "percentile": 0.07148 }, "nvd": { "published": "2026-07-30T23:16:52.597", "lastModified": "2026-07-31T16:17:09.443", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65421", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The MMS BER decoder trusts an attacker-supplied fixed-width field length and reads past the end of its heap buffer.", "basis": [ "CNA", "NVD", "CWE-125" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-10", "host": "www.cisa.gov", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-10.json", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 278, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65423", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-27T15:02:47.797Z", "date_published": "2026-07-30T21:59:06.093Z", "date_updated": "2026-07-31T15:47:55.815Z", "publisher": "icscert", "title": "o6 Automation open62541 Integer Overflow or Wraparound", "affected": { "vendors": [ "o6 Automation" ], "products": [ { "vendor": "o6 Automation", "product": "open62541" } ], "affectedBlockCount": 1, "versionEntryCount": 4, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-190", "name": "Integer Overflow or Wraparound", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:ics-cert@hq.dhs.gov", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:ics-cert@hq.dhs.gov", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00605, "percentile": 0.45555 }, "nvd": { "published": "2026-07-30T23:16:52.743", "lastModified": "2026-07-31T16:17:09.560", "vulnStatus": "Received", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65423", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The open62541 path performs attacker-influenced integer arithmetic that can overflow and invalidate a later memory bound.", "basis": [ "CNA", "CWE-190" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.o6-automation.com/contact", "host": "www.o6-automation.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/open62541/open62541/pull/8235/commits/b666d35769ce63998442e4d0810a3fb10b50179f", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/open62541/open62541/pull/8236/commits/06b99fef667c8ec5bdf0605b4f00c84fcc1d3a60", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/open62541/open62541/pull/8237/commits/1b71d9c5d9c4d02d4729b8903a52e9f530bf804e", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/open62541/open62541/pull/8238/commits/afab4107bfd161da9ce8bb30ed77f3968c9c97df", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-08", "host": "www.cisa.gov", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-08.json", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 151, "referenceCount": 7, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-65430", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T07:06:47.089Z", "date_published": "2026-07-23T09:10:32.150Z", "date_updated": "2026-07-27T13:47:43.782Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "GeoIP extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00245, "percentile": 0.15777 }, "nvd": { "published": "2026-07-23T10:16:52.613", "lastModified": "2026-07-27T14:17:00.237", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65430", "family": "EXPOSURE_OUTPUT", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "MaxMind credentials are placed in request URLs where logs, proxies, and other observers can read them.", "basis": [ "CNA", "CWE-200" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 178, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65431", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T07:06:47.089Z", "date_published": "2026-07-23T09:09:37.365Z", "date_updated": "2026-07-28T05:30:43.017Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - Zipslip in GeoIP extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "GeoIP extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0, "epss": { "score": 0.0038, "percentile": 0.30789 }, "nvd": { "published": "2026-07-23T10:16:52.723", "lastModified": "2026-07-27T17:16:39.360", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65431", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The GeoIP updater extracts archive members without validating their ZIP paths, allowing entries to escape the destination directory.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 186, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65433", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:52:41.029Z", "date_published": "2026-07-27T13:59:16.794Z", "date_updated": "2026-07-27T16:08:28.023Z", "publisher": "Patchstack", "title": "WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Broken Access Control vulnerability", "affected": { "vendors": [ "themewant" ], "products": [ { "vendor": "themewant", "product": "RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00279, "percentile": 0.20157 }, "nvd": { "published": "2026-07-27T15:17:08.480", "lastModified": "2026-07-27T17:46:02.447", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65433", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "RT Mega Menu permits a subscriber to cross an access-control boundary, but the protected action and failing check are not public.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/rt-mega-menu/vulnerability/wordpress-rt-mega-menu-mega-menu-builder-for-elementor-gutenberg-plugin-1-5-1-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 117, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65434", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:52:41.029Z", "date_published": "2026-07-27T13:59:17.436Z", "date_updated": "2026-07-27T14:58:43.451Z", "publisher": "Patchstack", "title": "WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Sensitive Data Exposure vulnerability", "affected": { "vendors": [ "yoomoney" ], "products": [ { "vendor": "yoomoney", "product": "ЮKassa для WooCommerce" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-201", "name": "Insertion of Sensitive Information Into Sent Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00355, "percentile": 0.28257 }, "nvd": { "published": "2026-07-27T15:17:08.620", "lastModified": "2026-07-27T17:46:02.447", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65434", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record says a WooCommerce subscriber can receive sensitive data, while it does not identify the endpoint, field, or missing object check.", "basis": [ "CNA", "CWE-201" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/yookassa/vulnerability/wordpress-yukassa-dlya-woocommerce-plugin-2-16-1-sensitive-data-exposure-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 80, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65435", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:52:41.029Z", "date_published": "2026-07-27T13:59:18.082Z", "date_updated": "2026-07-27T14:59:07.324Z", "publisher": "Patchstack", "title": "WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability", "affected": { "vendors": [ "Thrive Themes Coupon" ], "products": [ { "vendor": "Thrive Themes Coupon", "product": "Thrive Leads Version" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00242, "percentile": 0.15434 }, "nvd": { "published": "2026-07-27T15:17:08.760", "lastModified": "2026-07-27T17:46:02.447", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65435", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The Patchstack record reports an unauthenticated protected operation but does not name the action, object, or missing capability check.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/thrive-leads/vulnerability/wordpress-thrive-leads-version-plugin-10-9-2-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 81, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65436", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:52:41.029Z", "date_published": "2026-07-27T13:59:18.729Z", "date_updated": "2026-07-27T18:14:29.455Z", "publisher": "Patchstack", "title": "WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability", "affected": { "vendors": [ "Themeum" ], "products": [ { "vendor": "Themeum", "product": "Kirki" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 6.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00325, "percentile": 0.24996 }, "nvd": { "published": "2026-07-27T15:17:08.910", "lastModified": "2026-07-27T19:17:21.930", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65436", "family": "FILE_OBJECT_SELECTION", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The affected file operation accepts attacker-controlled path or link components without proving the resolved target remains in the intended namespace.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/kirki/vulnerability/wordpress-kirki-plugin-6-0-13-arbitrary-file-deletion-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 59, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65437", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:52:41.029Z", "date_published": "2026-07-27T22:44:00.867Z", "date_updated": "2026-07-28T13:52:02.436Z", "publisher": "Patchstack", "title": "WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "CleanTalk Inc" ], "products": [ { "vendor": "CleanTalk Inc", "product": "Spam protection, AntiSpam, FireWall by CleanTalk" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00146, "percentile": 0.0435 }, "nvd": { "published": "2026-07-27T23:16:41.540", "lastModified": "2026-07-28T16:19:12.780", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65437", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled content reaches an HTML, SVG or DOM output context without context-appropriate escaping, so the browser can interpret it as active script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/cleantalk-spam-protect/vulnerability/wordpress-spam-protection-antispam-firewall-by-cleantalk-plugin-6-82-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 112, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65438", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:52:41.029Z", "date_published": "2026-07-27T22:44:01.949Z", "date_updated": "2026-07-28T13:35:00.094Z", "publisher": "Patchstack", "title": "WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Kofi Mokome" ], "products": [ { "vendor": "Kofi Mokome", "product": "Message Filter for Contact Form 7" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00146, "percentile": 0.0435 }, "nvd": { "published": "2026-07-27T23:16:41.673", "lastModified": "2026-07-28T16:19:12.780", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65438", "family": "INTERPRETER_BOUNDARY", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The application renders attacker-controlled content into an HTML or JavaScript context without context-appropriate output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/cf7-message-filter/vulnerability/wordpress-message-filter-for-contact-form-7-plugin-1-6-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 100, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65439", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:52:41.029Z", "date_published": "2026-07-27T22:44:02.584Z", "date_updated": "2026-07-28T14:54:16.153Z", "publisher": "Patchstack", "title": "WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Themefic" ], "products": [ { "vendor": "Themefic", "product": "Ultimate Addons for Contact Form 7" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00146, "percentile": 0.0435 }, "nvd": { "published": "2026-07-27T23:16:41.807", "lastModified": "2026-07-28T16:20:06.270", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65439", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "User-controlled content reaches Ultimate Addons for Contact Form 7 page output without context-appropriate sanitization or escaping, so the browser interprets it as script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-contact-form-7/vulnerability/wordpress-ultimate-addons-for-contact-form-7-plugin-3-5-45-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 99, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65440", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:52:41.030Z", "date_published": "2026-07-27T22:44:03.223Z", "date_updated": "2026-07-28T13:32:17.246Z", "publisher": "Patchstack", "title": "WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Roxnor" ], "products": [ { "vendor": "Roxnor", "product": "GetGenie" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00146, "percentile": 0.04349 }, "nvd": { "published": "2026-07-27T23:16:41.933", "lastModified": "2026-07-28T16:19:12.780", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65440", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "medium", "mechanism": "GetGenie places unauthenticated input into generated web content without the encoding required to prevent script execution.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/getgenie/vulnerability/wordpress-getgenie-plugin-4-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 73, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65441", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:52:41.030Z", "date_published": "2026-07-27T22:44:03.877Z", "date_updated": "2026-07-28T16:07:09.463Z", "publisher": "Patchstack", "title": "WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Nexcess" ], "products": [ { "vendor": "Nexcess", "product": "GiveWP" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00146, "percentile": 0.04351 }, "nvd": { "published": "2026-07-27T23:16:42.060", "lastModified": "2026-07-28T16:20:06.957", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65441", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "GiveWP places unauthenticated attacker-controlled content into a browser-interpreted page without sufficient neutralization.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-3-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 72, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65442", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:52:41.030Z", "date_published": "2026-07-27T22:44:04.517Z", "date_updated": "2026-07-28T13:54:28.356Z", "publisher": "Patchstack", "title": "WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability", "affected": { "vendors": [ "Subtle Web Inc" ], "products": [ { "vendor": "Subtle Web Inc", "product": "FormCraft" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 7.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00159, "percentile": 0.05566 }, "nvd": { "published": "2026-07-27T23:16:42.207", "lastModified": "2026-07-28T16:19:12.780", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65442", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "medium", "mechanism": "An unauthenticated FormCraft request can choose a server-side request destination outside the intended trust boundary, although the input field is not public.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/formcraft/vulnerability/wordpress-formcraft-plugin-3-9-15-server-side-request-forgery-ssrf-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 83, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65443", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:04.434Z", "date_published": "2026-07-27T22:44:05.155Z", "date_updated": "2026-07-28T13:52:36.711Z", "publisher": "Patchstack", "title": "WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "WP Media" ], "products": [ { "vendor": "WP Media", "product": "BackWPup" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00146, "percentile": 0.04352 }, "nvd": { "published": "2026-07-27T23:16:42.330", "lastModified": "2026-07-28T16:19:12.780", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65443", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The BackWPup page renders attacker-controlled data as HTML or JavaScript without context-appropriate escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/backwpup/vulnerability/wordpress-backwpup-plugin-5-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 74, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65445", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:04.434Z", "date_published": "2026-07-27T22:44:05.796Z", "date_updated": "2026-07-28T13:33:21.768Z", "publisher": "Patchstack", "title": "WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability", "affected": { "vendors": [ "iSaumya" ], "products": [ { "vendor": "iSaumya", "product": "Ad Invalid Click Protector (AICP)" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00196, "percentile": 0.09572 }, "nvd": { "published": "2026-07-27T23:16:42.460", "lastModified": "2026-07-28T16:19:12.780", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65445", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "AICP exposes an unauthenticated operation, but the public record does not identify the protected resource or missing check.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/ad-invalid-click-protector/vulnerability/wordpress-ad-invalid-click-protector-aicp-plugin-1-3-0-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 93, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65446", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:04.434Z", "date_published": "2026-07-27T22:44:06.432Z", "date_updated": "2026-07-28T14:54:09.482Z", "publisher": "Patchstack", "title": "WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "WP Chill" ], "products": [ { "vendor": "WP Chill", "product": "Kali Forms" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00146, "percentile": 0.04344 }, "nvd": { "published": "2026-07-27T23:16:42.590", "lastModified": "2026-07-28T16:20:07.700", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65446", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In Kali Forms, attacker-controlled markup is rendered without the required HTML-context sanitization or output escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/kali-forms/vulnerability/wordpress-kali-forms-plugin-2-4-18-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 76, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65447", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:04.434Z", "date_published": "2026-07-27T22:44:07.069Z", "date_updated": "2026-07-28T13:31:41.593Z", "publisher": "Patchstack", "title": "WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Wasiliy Strecker / ContestGallery developer" ], "products": [ { "vendor": "Wasiliy Strecker / ContestGallery developer", "product": "Contest Gallery" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00146, "percentile": 0.04345 }, "nvd": { "published": "2026-07-27T23:16:42.720", "lastModified": "2026-07-28T16:19:12.780", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65447", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Contest Gallery places attacker-controlled markup, attributes, or URLs into an HTML or DOM rendering context without the required sanitization or output encoding.", "basis": [ "CNA", "NVD", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/contest-gallery/vulnerability/wordpress-contest-gallery-plugin-30-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 81, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65448", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:04.434Z", "date_published": "2026-07-27T22:44:07.710Z", "date_updated": "2026-07-28T16:07:25.050Z", "publisher": "Patchstack", "title": "WordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "AcyMailing Newsletter Team" ], "products": [ { "vendor": "AcyMailing Newsletter Team", "product": "Anti Spam and list cleaner – AcyChecker" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0013, "percentile": 0.03054 }, "nvd": { "published": "2026-07-27T23:16:42.850", "lastModified": "2026-07-28T16:20:08.387", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65448", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "AcyChecker renders unauthenticated input into a browser-interpreted page without sufficient contextual neutralization.", "basis": [ "CNA", "NVD", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/acychecker/vulnerability/wordpress-anti-spam-and-list-cleaner-acychecker-plugin-1-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 110, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65449", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:04.434Z", "date_published": "2026-07-23T11:18:33.123Z", "date_updated": "2026-07-23T14:52:16.480Z", "publisher": "Patchstack", "title": "WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "RomanCode" ], "products": [ { "vendor": "RomanCode", "product": "MapSVG" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.05715 }, "nvd": { "published": "2026-07-23T12:18:37.230", "lastModified": "2026-07-23T15:17:53.107", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65449", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "MapSVG renders attacker-controlled content without the required HTML sanitization or output escaping, allowing cross-site scripting.", "basis": [ "CNA", "NVD", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-14-0-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 68, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65450", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:04.434Z", "date_published": "2026-07-23T11:18:33.759Z", "date_updated": "2026-07-23T13:29:51.219Z", "publisher": "Patchstack", "title": "WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability", "affected": { "vendors": [ "RomanCode" ], "products": [ { "vendor": "RomanCode", "product": "MapSVG" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17656 }, "nvd": { "published": "2026-07-23T12:18:37.350", "lastModified": "2026-07-23T14:17:47.530", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65450", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected query treats attacker-controlled input as SQL syntax instead of binding it as data.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-14-0-sql-injection-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 55, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65451", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:04.434Z", "date_published": "2026-07-23T11:18:34.387Z", "date_updated": "2026-07-23T13:46:15.520Z", "publisher": "Patchstack", "title": "WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability", "affected": { "vendors": [ "RomanCode" ], "products": [ { "vendor": "RomanCode", "product": "MapSVG" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17654 }, "nvd": { "published": "2026-07-23T12:18:37.467", "lastModified": "2026-07-23T14:17:47.953", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65451", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "MapSVG allows a contributor-controlled value to alter the structure of an SQL query.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/mapsvg/vulnerability/wordpress-mapsvg-plugin-8-14-0-sql-injection-vulnerability-2?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 55, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65452", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:04.434Z", "date_published": "2026-07-23T11:18:35.032Z", "date_updated": "2026-07-23T14:48:39.833Z", "publisher": "Patchstack", "title": "WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability", "affected": { "vendors": [ "motov.net" ], "products": [ { "vendor": "motov.net", "product": "Ebook Store" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00228, "percentile": 0.13612 }, "nvd": { "published": "2026-07-23T12:18:37.590", "lastModified": "2026-07-23T15:17:54.827", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65452", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Ebook Store exposes a protected operation to an unauthenticated caller, while the affected object and missing check are not public.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/ebook-store/vulnerability/wordpress-ebook-store-plugin-6-19-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 70, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65453", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:17.416Z", "date_published": "2026-07-23T11:18:35.652Z", "date_updated": "2026-07-23T14:35:12.530Z", "publisher": "Patchstack", "title": "WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability", "affected": { "vendors": [ "motov.net" ], "products": [ { "vendor": "motov.net", "product": "Ebook Store" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00214, "percentile": 0.1186 }, "nvd": { "published": "2026-07-23T12:18:37.710", "lastModified": "2026-07-23T15:17:55.430", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65453", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/ebook-store/vulnerability/wordpress-ebook-store-plugin-6-19-broken-access-control-vulnerability-2?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 70, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65454", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:17.417Z", "date_published": "2026-07-23T11:18:36.289Z", "date_updated": "2026-07-23T15:58:40.224Z", "publisher": "Patchstack", "title": "WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability", "affected": { "vendors": [ "ExpressTech Systems" ], "products": [ { "vendor": "ExpressTech Systems", "product": "Quiz And Survey Master" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17654 }, "nvd": { "published": "2026-07-23T12:18:37.827", "lastModified": "2026-07-23T16:17:50.400", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65454", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-2-0-sql-injection-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 71, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65455", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:17.417Z", "date_published": "2026-07-23T11:18:36.950Z", "date_updated": "2026-07-23T14:52:08.214Z", "publisher": "Patchstack", "title": "WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability", "affected": { "vendors": [ "MapSVG" ], "products": [ { "vendor": "MapSVG", "product": "MapSVG" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00367, "percentile": 0.29426 }, "nvd": { "published": "2026-07-23T12:18:37.950", "lastModified": "2026-07-23T15:17:56.303", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65455", "family": "FILE_OBJECT_SELECTION", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The upload path accepts attacker-controlled file content or names without enforcing the intended storage and executable-content boundary.", "basis": [ "CNA", "CWE-434", "https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-14-0-arbitrary-file-upload-vulnerability?_s_id=cve" ], "deepDive": true, "notes": "Reviewed https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-14-0-arbitrary-file-upload-vulnerability?_s_id=cve. The linked Patchstack entry was not publicly readable through the review client, and the CVE record does not identify the upload handler or missing file-type check." }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-14-0-arbitrary-file-upload-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 65, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65456", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:17.417Z", "date_published": "2026-07-23T11:18:37.593Z", "date_updated": "2026-07-23T13:30:15.810Z", "publisher": "Patchstack", "title": "WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability", "affected": { "vendors": [ "PickPlugins" ], "products": [ { "vendor": "PickPlugins", "product": "Product Slider for WooCommerce" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00197, "percentile": 0.09641 }, "nvd": { "published": "2026-07-23T12:18:38.067", "lastModified": "2026-07-23T14:17:48.383", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65456", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The operation accepts a caller-supplied object identifier without binding the selected object to the authenticated caller.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/woocommerce-products-slider/vulnerability/wordpress-product-slider-for-woocommerce-plugin-1-13-62-insecure-direct-object-references-idor-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 107, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65457", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:17.417Z", "date_published": "2026-07-23T11:18:38.242Z", "date_updated": "2026-07-23T13:45:53.390Z", "publisher": "Patchstack", "title": "WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability", "affected": { "vendors": [ "yoomoney" ], "products": [ { "vendor": "yoomoney", "product": "ЮKassa для WooCommerce" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00243, "percentile": 0.15605 }, "nvd": { "published": "2026-07-23T12:18:38.203", "lastModified": "2026-07-23T14:17:48.863", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65457", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The affected action runs without the capability or object-level authorization check required for that caller.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/yookassa/vulnerability/wordpress-yukassa-dlya-woocommerce-plugin-2-16-1-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 78, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65458", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:17.417Z", "date_published": "2026-07-23T11:18:38.882Z", "date_updated": "2026-07-23T14:47:10.605Z", "publisher": "Patchstack", "title": "WordPress Polylang plugin <= 3.8.5 - Sensitive Data Exposure vulnerability", "affected": { "vendors": [ "Chouby" ], "products": [ { "vendor": "Chouby", "product": "Polylang" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-497", "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00215, "percentile": 0.11923 }, "nvd": { "published": "2026-07-23T12:18:38.357", "lastModified": "2026-07-23T15:17:56.947", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65458", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Polylang exposes sensitive system information to a contributor, but the record does not identify the data or output surface.", "basis": [ "CNA", "CWE-497" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/polylang/vulnerability/wordpress-polylang-plugin-3-8-5-sensitive-data-exposure-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 66, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65460", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:17.417Z", "date_published": "2026-07-23T11:18:39.523Z", "date_updated": "2026-07-23T14:35:52.112Z", "publisher": "Patchstack", "title": "WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability", "affected": { "vendors": [ "zarinpal" ], "products": [ { "vendor": "zarinpal", "product": "Zarinpal Gateway" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00107, "percentile": 0.01334 }, "nvd": { "published": "2026-07-23T12:18:38.483", "lastModified": "2026-07-23T15:17:57.520", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65460", "family": "REQUEST_CHANNEL_TRUST", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A Zarinpal state-changing action trusts a cross-site browser request, but the affected action and missing anti-CSRF binding are not public.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/zarinpal-woocommerce-payment-gateway/vulnerability/wordpress-zarinpal-gateway-plugin-5-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 88, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65461", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:17.417Z", "date_published": "2026-07-23T11:18:40.167Z", "date_updated": "2026-07-23T15:58:22.142Z", "publisher": "Patchstack", "title": "WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability", "affected": { "vendors": [ "Webの相談所" ], "products": [ { "vendor": "Webの相談所", "product": "Really Simple CSV Importer" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00367, "percentile": 0.29426 }, "nvd": { "published": "2026-07-23T12:18:38.610", "lastModified": "2026-07-23T16:17:50.500", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65461", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The upload path accepts a dangerous file type or destination beyond the intended file namespace.", "basis": [ "CNA", "CWE-434" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/really-simple-csv-importer/vulnerability/wordpress-really-simple-csv-importer-plugin-1-3-arbitrary-file-upload-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 82, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65462", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:17.417Z", "date_published": "2026-07-23T11:18:40.815Z", "date_updated": "2026-07-23T14:51:57.770Z", "publisher": "Patchstack", "title": "WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability", "affected": { "vendors": [ "Uncanny Owl" ], "products": [ { "vendor": "Uncanny Owl", "product": "Uncanny Automator" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L" } ], "max_cvss_observed_across_sources": 7.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00279, "percentile": 0.20116 }, "nvd": { "published": "2026-07-23T12:18:38.730", "lastModified": "2026-07-23T15:17:58.053", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65462", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An administrator-controlled Uncanny Automator value reaches an SQL query without separating data from SQL syntax.", "basis": [ "CNA record", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-plugin-7-3-2-sql-injection-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 67, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65463", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:23.246Z", "date_published": "2026-07-23T11:18:41.468Z", "date_updated": "2026-07-23T13:29:30.902Z", "publisher": "Patchstack", "title": "WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability", "affected": { "vendors": [ "masteriyo" ], "products": [ { "vendor": "masteriyo", "product": "Masteriyo - LMS" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00287, "percentile": 0.20962 }, "nvd": { "published": "2026-07-23T12:18:38.850", "lastModified": "2026-07-23T14:17:49.290", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65463", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Masteriyo - LMS trusts an attacker-supplied object identifier without checking that the object belongs to the caller's permitted scope.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-2-3-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 89, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65464", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:23.246Z", "date_published": "2026-07-23T11:18:42.106Z", "date_updated": "2026-07-23T13:41:23.004Z", "publisher": "Patchstack", "title": "WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability", "affected": { "vendors": [ "Nexcess" ], "products": [ { "vendor": "Nexcess", "product": "GiveWP" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00104, "percentile": 0.01194 }, "nvd": { "published": "2026-07-23T12:18:38.970", "lastModified": "2026-07-23T14:17:49.713", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65464", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "GiveWP accepts a state-changing request sent cross-site under the victim's browser credentials.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 79, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65465", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:23.246Z", "date_published": "2026-07-23T11:18:42.738Z", "date_updated": "2026-07-23T14:45:22.492Z", "publisher": "Patchstack", "title": "WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Crocoblock. Jetimpex Inc." ], "products": [ { "vendor": "Crocoblock. Jetimpex Inc.", "product": "JetElements For Elementor" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.05714 }, "nvd": { "published": "2026-07-23T12:18:39.090", "lastModified": "2026-07-23T15:17:58.543", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65465", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In JetElements For Elementor, attacker-controlled markup is rendered without the required HTML-context sanitization or output escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-plugin-2-9-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 88, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65466", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:23.246Z", "date_published": "2026-07-23T11:18:43.365Z", "date_updated": "2026-07-23T14:39:49.472Z", "publisher": "Patchstack", "title": "WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability", "affected": { "vendors": [ "Crocoblock. Jetimpex Inc." ], "products": [ { "vendor": "Crocoblock. Jetimpex Inc.", "product": "JetBooking" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00152, "percentile": 0.04838 }, "nvd": { "published": "2026-07-23T12:18:39.220", "lastModified": "2026-07-23T15:17:59.037", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65466", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The server follows an attacker-controlled outbound URL without constraining its destination to the intended remote service.", "basis": [ "CNA record", "NVD", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/jet-booking/vulnerability/wordpress-jetbooking-plugin-4-1-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 79, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65467", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:23.246Z", "date_published": "2026-07-23T11:18:44.003Z", "date_updated": "2026-07-23T15:57:57.723Z", "publisher": "Patchstack", "title": "WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability", "affected": { "vendors": [ "Crocoblock. Jetimpex Inc." ], "products": [ { "vendor": "Crocoblock. Jetimpex Inc.", "product": "JetEngine" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 4.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00145, "percentile": 0.04271 }, "nvd": { "published": "2026-07-23T12:18:39.347", "lastModified": "2026-07-23T16:17:50.600", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65467", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "JetEngine lets a contributor direct a server-side fetch to a destination outside the intended network trust boundary.", "basis": [ "CNA", "NVD", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-8-11-server-side-request-forgery-ssrf-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 79, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65468", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:23.247Z", "date_published": "2026-07-23T11:18:44.638Z", "date_updated": "2026-07-23T14:51:48.962Z", "publisher": "Patchstack", "title": "WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability", "affected": { "vendors": [ "Crocoblock. Jetimpex Inc." ], "products": [ { "vendor": "Crocoblock. Jetimpex Inc.", "product": "JetBooking" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00214, "percentile": 0.11855 }, "nvd": { "published": "2026-07-23T12:18:39.470", "lastModified": "2026-07-23T15:17:59.630", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65468", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The Patchstack record reports unauthenticated broken access control in JetBooking but does not identify the handler, protected object, or omitted gate.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/jet-booking/vulnerability/wordpress-jetbooking-plugin-4-1-2-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 70, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65469", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:23.247Z", "date_published": "2026-07-23T11:18:45.293Z", "date_updated": "2026-07-23T13:29:09.929Z", "publisher": "Patchstack", "title": "WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability", "affected": { "vendors": [ "Strategy11 Team" ], "products": [ { "vendor": "Strategy11 Team", "product": "AWP Classifieds" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00214, "percentile": 0.11853 }, "nvd": { "published": "2026-07-23T12:18:39.600", "lastModified": "2026-07-23T14:17:50.140", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65469", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A protected action is reachable without sufficient authorization, but the public record does not identify the missing check.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/another-wordpress-classifieds-plugin/vulnerability/wordpress-awp-classifieds-plugin-4-4-7-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 75, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65470", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:23.247Z", "date_published": "2026-07-23T11:18:45.941Z", "date_updated": "2026-07-23T13:43:37.316Z", "publisher": "Patchstack", "title": "WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "WPManageNinja" ], "products": [ { "vendor": "WPManageNinja", "product": "Fluent Support" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.05712 }, "nvd": { "published": "2026-07-23T12:18:39.723", "lastModified": "2026-07-23T14:17:50.573", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65470", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Fluent Support rendering path places attacker-controlled data into executable browser markup without context-appropriate sanitization or escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/fluent-support/vulnerability/wordpress-fluent-support-plugin-2-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 75, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65471", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:23.247Z", "date_published": "2026-07-23T11:18:46.575Z", "date_updated": "2026-07-23T14:33:46.791Z", "publisher": "Patchstack", "title": "WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability", "affected": { "vendors": [ "Avada Studio" ], "products": [ { "vendor": "Avada Studio", "product": "Avada Core" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 9.6, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 9.6, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00143, "percentile": 0.04039 }, "nvd": { "published": "2026-07-23T12:18:39.857", "lastModified": "2026-07-23T15:18:00.250", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65471", "family": "REQUEST_CHANNEL_TRUST", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A cross-site request can cause Avada Core to perform an unspecified action under the victim's session because the required request-verification boundary is absent.", "basis": [ "CNA", "CWE-352", "Avada Core security update" ], "deepDive": true, "notes": "Inspected https://avada.com/blog/avada-core-security-update/; Avada confirms that versions through 5.15.6 are affected and 5.15.7 is the standalone fix, but does not identify the state-changing action, request-verification check, or code path." }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/fusion-core/vulnerability/wordpress-avada-core-plugin-5-15-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 83, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65472", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:23.247Z", "date_published": "2026-07-23T11:18:47.217Z", "date_updated": "2026-07-23T14:40:21.477Z", "publisher": "Patchstack", "title": "WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability", "affected": { "vendors": [ "Kit" ], "products": [ { "vendor": "Kit", "product": "Kit (formerly ConvertKit)" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00214, "percentile": 0.11852 }, "nvd": { "published": "2026-07-23T12:18:39.980", "lastModified": "2026-07-23T15:18:00.893", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65472", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record says Kit exposes a protected operation without authentication, while it does not identify the endpoint or credential decision.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/convertkit/vulnerability/wordpress-kit-formerly-convertkit-plugin-3-3-5-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 85, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65473", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:30.833Z", "date_published": "2026-07-23T11:18:47.853Z", "date_updated": "2026-07-23T15:57:44.103Z", "publisher": "Patchstack", "title": "WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Nexcess" ], "products": [ { "vendor": "Nexcess", "product": "Virtue/Ascend/Pinnacle Toolkit" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00171, "percentile": 0.06726 }, "nvd": { "published": "2026-07-23T12:18:40.110", "lastModified": "2026-07-23T16:17:50.700", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65473", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Virtue, Ascend, or Pinnacle Toolkit renders contributor-controlled input as active HTML or script without context-appropriate neutralization.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/virtue-toolkit/vulnerability/wordpress-virtue-ascend-pinnacle-toolkit-plugin-4-9-12-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 92, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65474", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:30.833Z", "date_published": "2026-07-23T11:18:48.491Z", "date_updated": "2026-07-23T14:51:38.883Z", "publisher": "Patchstack", "title": "WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability", "affected": { "vendors": [ "WPManageNinja" ], "products": [ { "vendor": "WPManageNinja", "product": "Ninja Tables" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-497", "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.0024, "percentile": 0.15215 }, "nvd": { "published": "2026-07-23T12:18:40.230", "lastModified": "2026-07-23T15:18:01.420", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65474", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The affected response, log, or client-visible object emits sensitive data without the required redaction or audience restriction.", "basis": [ "CNA", "CWE-497" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/ninja-tables/vulnerability/wordpress-ninja-tables-plugin-5-2-10-sensitive-data-exposure-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 75, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65475", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:30.834Z", "date_published": "2026-07-23T11:53:14.158Z", "date_updated": "2026-07-23T15:47:33.645Z", "publisher": "Patchstack", "title": "WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "WP Chill" ], "products": [ { "vendor": "WP Chill", "product": "Modula Image Gallery" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0013, "percentile": 0.03054 }, "nvd": { "published": "2026-07-23T12:18:40.350", "lastModified": "2026-07-23T16:17:50.797", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65475", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled content reaches an HTML, SVG or DOM output context without context-appropriate escaping, so the browser can interpret it as active script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/modula-best-grid-gallery/vulnerability/wordpress-modula-image-gallery-plugin-2-14-25-2-14-30-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 222, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65476", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:30.834Z", "date_published": "2026-07-23T11:18:49.155Z", "date_updated": "2026-07-23T13:40:00.430Z", "publisher": "Patchstack", "title": "WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability", "affected": { "vendors": [ "uxper" ], "products": [ { "vendor": "uxper", "product": "Civi" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00214, "percentile": 0.11852 }, "nvd": { "published": "2026-07-23T12:18:40.470", "lastModified": "2026-07-23T14:17:51.020", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65476", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The affected action runs without the capability or object-level authorization check required for that caller.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/civi/vulnerability/wordpress-civi-theme-2-2-4-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 64, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65477", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:30.834Z", "date_published": "2026-07-23T11:18:49.794Z", "date_updated": "2026-07-23T13:43:06.979Z", "publisher": "Patchstack", "title": "WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability", "affected": { "vendors": [ "Select-Themes" ], "products": [ { "vendor": "Select-Themes", "product": "Tonda Core" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-98", "name": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0032, "percentile": 0.24377 }, "nvd": { "published": "2026-07-23T12:18:40.593", "lastModified": "2026-07-23T14:17:51.477", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65477", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Tonda Core lets a caller influence the PHP file selected by an include operation outside the intended template set.", "basis": [ "CNA", "CWE-98" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/tonda-core/vulnerability/wordpress-tonda-core-plugin-2-1-2-local-file-inclusion-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 65, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65478", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:30.834Z", "date_published": "2026-07-23T11:18:50.446Z", "date_updated": "2026-07-23T14:32:40.795Z", "publisher": "Patchstack", "title": "WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability", "affected": { "vendors": [ "CridioStudio" ], "products": [ { "vendor": "CridioStudio", "product": "ListingPro" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.0022, "percentile": 0.12656 }, "nvd": { "published": "2026-07-23T12:18:40.707", "lastModified": "2026-07-23T15:18:01.967", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65478", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A subscriber can perform a ListingPro operation outside the intended role, but the affected object and missing check are not public.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/listingpro-plugin/vulnerability/wordpress-listingpro-plugin-2-9-10-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 66, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65479", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:30.834Z", "date_published": "2026-07-23T11:18:51.090Z", "date_updated": "2026-07-23T15:04:51.859Z", "publisher": "Patchstack", "title": "WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability", "affected": { "vendors": [ "MVP Themes" ], "products": [ { "vendor": "MVP Themes", "product": "Reviewer" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00275, "percentile": 0.1967 }, "nvd": { "published": "2026-07-23T12:18:40.830", "lastModified": "2026-07-23T16:17:50.900", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65479", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Reviewer lets a subscriber perform an operation beyond that role's authority, but the object, action, and failed check are not public.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/reviewer/vulnerability/wordpress-reviewer-plugin-3-14-2-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 64, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65480", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:30.834Z", "date_published": "2026-07-23T11:18:51.737Z", "date_updated": "2026-07-23T15:57:26.561Z", "publisher": "Patchstack", "title": "WordPress TheGem theme <= 5.11.1 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "CodexThemes" ], "products": [ { "vendor": "CodexThemes", "product": "TheGem" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.05712 }, "nvd": { "published": "2026-07-23T12:18:40.973", "lastModified": "2026-07-23T16:17:51.007", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65480", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "medium", "mechanism": "Contributor-controlled theme content is rendered as executable browser markup without sufficient context separation, although the affected field is not public.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/thegem/vulnerability/wordpress-thegem-theme-5-11-1-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 68, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65481", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:30.834Z", "date_published": "2026-07-23T11:18:52.377Z", "date_updated": "2026-07-23T14:51:28.879Z", "publisher": "Patchstack", "title": "WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability", "affected": { "vendors": [ "Elated-Themes" ], "products": [ { "vendor": "Elated-Themes", "product": "Vino" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-98", "name": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "abstraction": "Variant", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0032, "percentile": 0.24377 }, "nvd": { "published": "2026-07-23T12:18:41.100", "lastModified": "2026-07-23T15:18:02.513", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65481", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Vino include path lets an attacker select a local file outside the intended include namespace.", "basis": [ "CNA", "CWE-98" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/vino/vulnerability/wordpress-vino-theme-1-9-local-file-inclusion-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 57, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65482", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:30.834Z", "date_published": "2026-07-23T11:18:53.013Z", "date_updated": "2026-07-23T13:28:48.738Z", "publisher": "Patchstack", "title": "WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "LA-Studio" ], "products": [ { "vendor": "LA-Studio", "product": "LA-Studio Element Kit for Elementor" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.0572 }, "nvd": { "published": "2026-07-23T12:18:41.220", "lastModified": "2026-07-23T14:17:51.903", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65482", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "LA-Studio Element Kit lets contributor input reach generated page markup without sufficient browser-context escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 96, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65483", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:35.326Z", "date_published": "2026-07-23T11:18:53.649Z", "date_updated": "2026-07-23T13:42:43.335Z", "publisher": "Patchstack", "title": "WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "hashthemes" ], "products": [ { "vendor": "hashthemes", "product": "HashThemes Demo Importer" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 5.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00172, "percentile": 0.06854 }, "nvd": { "published": "2026-07-23T12:18:41.347", "lastModified": "2026-07-23T14:17:52.327", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65483", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "In HashThemes Demo Importer, attacker-controlled markup is rendered without the required HTML-context sanitization or output escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/hashthemes-demo-importer/vulnerability/wordpress-hashthemes-demo-importer-plugin-1-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 80, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65484", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:35.326Z", "date_published": "2026-07-23T11:18:54.280Z", "date_updated": "2026-07-23T14:42:47.774Z", "publisher": "Patchstack", "title": "WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability", "affected": { "vendors": [ "AnalogWP" ], "products": [ { "vendor": "AnalogWP", "product": "Style Kits" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00198, "percentile": 0.09793 }, "nvd": { "published": "2026-07-23T12:18:41.470", "lastModified": "2026-07-23T15:18:03.603", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65484", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Style Kits fails to enforce the required capability, object ownership, tenant, role, or scope check at the affected operation, allowing a caller outside that authority boundary to invoke it.", "basis": [ "CNA", "NVD", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/analogwp-templates/vulnerability/wordpress-style-kits-plugin-2-6-5-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 66, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65485", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:35.327Z", "date_published": "2026-07-23T11:18:54.913Z", "date_updated": "2026-07-23T15:06:40.370Z", "publisher": "Patchstack", "title": "WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability", "affected": { "vendors": [ "Daniel Iser" ], "products": [ { "vendor": "Daniel Iser", "product": "Content Control" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00228, "percentile": 0.13609 }, "nvd": { "published": "2026-07-23T12:18:41.590", "lastModified": "2026-07-23T16:17:51.110", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65485", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Content Control exposes an action without authenticating or authorizing the caller, while the exact object and endpoint are not public.", "basis": [ "CNA", "NVD", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/content-control/vulnerability/wordpress-content-control-plugin-2-6-5-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 75, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65486", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:35.327Z", "date_published": "2026-07-23T11:18:55.544Z", "date_updated": "2026-07-23T15:57:06.027Z", "publisher": "Patchstack", "title": "WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability", "affected": { "vendors": [ "Bastien Ho" ], "products": [ { "vendor": "Bastien Ho", "product": "Event post" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00228, "percentile": 0.1361 }, "nvd": { "published": "2026-07-23T12:18:41.713", "lastModified": "2026-07-23T16:17:51.210", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65486", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record identifies an authentication or authorization bypass in Event post, but does not disclose the operation or failing identity, role, or object-scope check.", "basis": [ "CNA", "NVD", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/event-post/vulnerability/wordpress-event-post-plugin-6-0-1-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 70, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65487", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:35.327Z", "date_published": "2026-07-23T11:18:56.183Z", "date_updated": "2026-07-23T14:51:19.862Z", "publisher": "Patchstack", "title": "WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability", "affected": { "vendors": [ "ThemeGoods" ], "products": [ { "vendor": "ThemeGoods", "product": "Photography" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00214, "percentile": 0.11852 }, "nvd": { "published": "2026-07-23T12:18:41.823", "lastModified": "2026-07-23T15:18:05.490", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65487", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "An unauthenticated request reaches a protected operation without the required access-control check.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/photography/vulnerability/wordpress-photography-theme-7-7-6-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 71, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65488", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:35.327Z", "date_published": "2026-07-23T11:18:56.816Z", "date_updated": "2026-07-23T13:28:27.843Z", "publisher": "Patchstack", "title": "WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability", "affected": { "vendors": [ "LA-Studio" ], "products": [ { "vendor": "LA-Studio", "product": "LA-Studio Element Kit for Elementor" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00097, "percentile": 0.0088 }, "nvd": { "published": "2026-07-23T12:18:41.943", "lastModified": "2026-07-23T14:17:52.750", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65488", "family": "REQUEST_CHANNEL_TRUST", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The Elementor extension accepts a cross-site state-changing request, while the public record does not identify the endpoint or missing request-binding control.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-6-2-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 107, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65489", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:35.327Z", "date_published": "2026-07-23T11:18:57.444Z", "date_updated": "2026-07-23T13:42:22.886Z", "publisher": "Patchstack", "title": "WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability", "affected": { "vendors": [ "LA-Studio" ], "products": [ { "vendor": "LA-Studio", "product": "LA-Studio Element Kit for Elementor" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00228, "percentile": 0.13613 }, "nvd": { "published": "2026-07-23T12:18:42.067", "lastModified": "2026-07-23T14:17:53.173", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65489", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "LA-Studio Element Kit exposes a protected operation to an unauthenticated caller, while the affected object and missing check are not public.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 95, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65490", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:35.327Z", "date_published": "2026-07-23T11:18:58.080Z", "date_updated": "2026-07-23T14:37:44.167Z", "publisher": "Patchstack", "title": "WordPress Create by Mediavine plugin <= 2.5.3 - Sensitive Data Exposure vulnerability", "affected": { "vendors": [ "mischiefmarmot" ], "products": [ { "vendor": "mischiefmarmot", "product": "Create by Mediavine" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-497", "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00251, "percentile": 0.16531 }, "nvd": { "published": "2026-07-23T12:18:42.187", "lastModified": "2026-07-23T15:18:06.230", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65490", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Unauthenticated Sensitive Data Exposure in Create by Mediavine <= 2.5.3 versions.", "basis": [ "CNA", "CWE-497" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/mediavine-create/vulnerability/wordpress-create-by-mediavine-plugin-2-5-3-sensitive-data-exposure-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 81, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65491", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:35.327Z", "date_published": "2026-07-23T11:18:58.714Z", "date_updated": "2026-07-23T15:07:19.770Z", "publisher": "Patchstack", "title": "WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability", "affected": { "vendors": [ "Jonathan Daggerhart" ], "products": [ { "vendor": "Jonathan Daggerhart", "product": "Query Wrangler" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00259, "percentile": 0.17475 }, "nvd": { "published": "2026-07-23T12:18:42.313", "lastModified": "2026-07-23T16:17:51.307", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65491", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The Query Wrangler record identifies subscriber-level access to a protected operation but does not name that operation or the missing capability check.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/query-wrangler/vulnerability/wordpress-query-wrangler-plugin-1-5-57-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 70, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65492", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:35.327Z", "date_published": "2026-07-23T11:18:59.356Z", "date_updated": "2026-07-23T15:56:46.675Z", "publisher": "Patchstack", "title": "WordPress Dokan Pro plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Dokan WordPress Plugin" ], "products": [ { "vendor": "Dokan WordPress Plugin", "product": "Dokan Pro" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0018, "percentile": 0.07759 }, "nvd": { "published": "2026-07-23T12:18:42.430", "lastModified": "2026-07-23T16:17:51.417", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65492", "family": "INTERPRETER_BOUNDARY", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Attacker-controlled data reaches an HTML or DOM sink without context-appropriate sanitization and output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "The public record supports the family and impact but does not identify the failing check, parser rule, or state transition." }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 74, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65493", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:43.311Z", "date_published": "2026-07-23T11:18:59.986Z", "date_updated": "2026-07-23T14:51:07.788Z", "publisher": "Patchstack", "title": "WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability", "affected": { "vendors": [ "Dokan" ], "products": [ { "vendor": "Dokan", "product": "Dokan Pro" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00373, "percentile": 0.30046 }, "nvd": { "published": "2026-07-23T12:18:42.553", "lastModified": "2026-07-23T15:18:06.870", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65493", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The application deserializes attacker-controlled object data without enforcing a safe type and behavior boundary.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-2-php-object-injection-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 63, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65494", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:43.312Z", "date_published": "2026-07-23T11:19:00.620Z", "date_updated": "2026-07-23T13:28:09.284Z", "publisher": "Patchstack", "title": "WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability", "affected": { "vendors": [ "Dokan" ], "products": [ { "vendor": "Dokan", "product": "Dokan Pro" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00274, "percentile": 0.19517 }, "nvd": { "published": "2026-07-23T12:18:42.677", "lastModified": "2026-07-23T14:17:53.600", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65494", "family": "INTERPRETER_BOUNDARY", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The affected query incorporates attacker-controlled input without parameterization or context-appropriate SQL escaping.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-2-sql-injection-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 56, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65495", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:43.312Z", "date_published": "2026-07-23T11:19:01.262Z", "date_updated": "2026-07-23T13:41:55.388Z", "publisher": "Patchstack", "title": "WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability", "affected": { "vendors": [ "Dokan Multivendor Plugin" ], "products": [ { "vendor": "Dokan Multivendor Plugin", "product": "Dokan Pro" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.003, "percentile": 0.22236 }, "nvd": { "published": "2026-07-23T12:18:42.790", "lastModified": "2026-07-23T14:17:54.020", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65495", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Dokan Pro exposes an unauthenticated operation without adequate access control, but the public record does not identify the action or object.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/dokan-pro/vulnerability/wordpress-dokan-pro-plugin-5-0-3-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 69, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65496", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:43.312Z", "date_published": "2026-07-23T11:19:01.901Z", "date_updated": "2026-07-23T14:52:46.291Z", "publisher": "Patchstack", "title": "WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability", "affected": { "vendors": [ "Complianz" ], "products": [ { "vendor": "Complianz", "product": "Complianz" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 4.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.05707 }, "nvd": { "published": "2026-07-23T12:18:42.910", "lastModified": "2026-07-23T15:18:07.640", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65496", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An authenticated author can make Complianz issue a server-side request to a caller-selected destination.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/complianz-gdpr/vulnerability/wordpress-complianz-plugin-7-5-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 73, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65497", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:43.312Z", "date_published": "2026-07-23T11:19:02.535Z", "date_updated": "2026-07-23T15:08:01.311Z", "publisher": "Patchstack", "title": "WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability", "affected": { "vendors": [ "Complianz" ], "products": [ { "vendor": "Complianz", "product": "Complianz" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.2, "cvss_source_score_spread": 0, "epss": { "score": 0.0037, "percentile": 0.29687 }, "nvd": { "published": "2026-07-23T12:18:43.040", "lastModified": "2026-07-23T16:17:51.517", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65497", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Untrusted serialized data is instantiated as application objects without a safe type boundary.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/complianz-gdpr/vulnerability/wordpress-complianz-plugin-7-5-0-php-object-injection-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 66, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65498", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:43.312Z", "date_published": "2026-07-23T11:19:03.170Z", "date_updated": "2026-07-23T15:55:57.946Z", "publisher": "Patchstack", "title": "WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability", "affected": { "vendors": [ "Complianz" ], "products": [ { "vendor": "Complianz", "product": "Complianz" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-497", "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.0024, "percentile": 0.15217 }, "nvd": { "published": "2026-07-23T12:18:43.160", "lastModified": "2026-07-23T16:17:51.617", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65498", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "medium", "mechanism": "Complianz returns sensitive system information to an unauthenticated caller outside the intended control sphere.", "basis": [ "CNA record", "CWE-497" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/complianz-gdpr/vulnerability/wordpress-complianz-plugin-7-5-0-sensitive-data-exposure-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 71, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65499", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:43.312Z", "date_published": "2026-07-23T11:19:03.852Z", "date_updated": "2026-07-23T14:50:56.515Z", "publisher": "Patchstack", "title": "WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability", "affected": { "vendors": [ "Pepro Dev. Group" ], "products": [ { "vendor": "Pepro Dev. Group", "product": "PeproDev Ultimate Invoice" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00194, "percentile": 0.09323 }, "nvd": { "published": "2026-07-23T12:18:43.280", "lastModified": "2026-07-23T15:18:08.270", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65499", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record shows that PeproDev Ultimate Invoice permits an unauthorized operation but does not identify the endpoint, protected object, or failing identity or privilege check.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/pepro-ultimate-invoice/vulnerability/wordpress-peprodev-ultimate-invoice-plugin-2-2-6-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 85, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65500", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:43.312Z", "date_published": "2026-07-23T11:19:04.485Z", "date_updated": "2026-07-23T13:27:48.081Z", "publisher": "Patchstack", "title": "WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability", "affected": { "vendors": [ "pixelacehq" ], "products": [ { "vendor": "pixelacehq", "product": "Manual - Documentation, Knowledge Base & Education WordPress Theme" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00287, "percentile": 0.2091 }, "nvd": { "published": "2026-07-23T12:18:43.397", "lastModified": "2026-07-23T14:17:54.450", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65500", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The Manual theme exposes an unauthenticated action beyond public authority, but the affected action and missing check are not public.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/manual/vulnerability/wordpress-manual-documentation-knowledge-base-education-wordpress-theme-theme-7-5-4-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 126, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65501", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:43.312Z", "date_published": "2026-07-23T11:19:05.175Z", "date_updated": "2026-07-23T13:35:22.051Z", "publisher": "Patchstack", "title": "WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability", "affected": { "vendors": [ "vendidero" ], "products": [ { "vendor": "vendidero", "product": "Shiptastic for WooCommerce" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00228, "percentile": 0.13614 }, "nvd": { "published": "2026-07-23T12:18:43.520", "lastModified": "2026-07-23T14:17:54.967", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65501", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Shiptastic accepts an unauthenticated caller-controlled object identifier without binding the selected object to an authorized user.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/shiptastic-for-woocommerce/vulnerability/wordpress-shiptastic-for-woocommerce-plugin-5-1-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 105, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65503", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:52.509Z", "date_published": "2026-07-23T11:19:05.898Z", "date_updated": "2026-07-23T14:06:22.698Z", "publisher": "Patchstack", "title": "WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "bdthemes" ], "products": [ { "vendor": "bdthemes", "product": "Ultimate Store Kit Elementor Addons" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.0571 }, "nvd": { "published": "2026-07-23T12:18:43.643", "lastModified": "2026-07-23T15:18:08.837", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65503", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled text is placed into an HTML or script context without context-appropriate escaping, allowing browser script execution.", "basis": [ "CNA record", "NVD", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/ultimate-store-kit/vulnerability/wordpress-ultimate-store-kit-elementor-addons-plugin-3-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 96, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65505", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:52.510Z", "date_published": "2026-07-23T11:19:06.553Z", "date_updated": "2026-07-23T15:08:47.236Z", "publisher": "Patchstack", "title": "WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability", "affected": { "vendors": [ "bdthemes" ], "products": [ { "vendor": "bdthemes", "product": "Ultimate Store Kit Elementor Addons" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-497", "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.0024, "percentile": 0.15218 }, "nvd": { "published": "2026-07-23T12:18:43.763", "lastModified": "2026-07-23T16:17:51.720", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65505", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "medium", "mechanism": "Ultimate Store Kit exposes protected system information through an unauthenticated output path, although the exact fields are not public.", "basis": [ "CNA", "NVD", "CWE-497" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/ultimate-store-kit/vulnerability/wordpress-ultimate-store-kit-elementor-addons-plugin-3-0-5-sensitive-data-exposure-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 97, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65506", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:52.510Z", "date_published": "2026-07-23T11:19:07.185Z", "date_updated": "2026-07-23T16:05:10.926Z", "publisher": "Patchstack", "title": "WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability", "affected": { "vendors": [ "sonaar" ], "products": [ { "vendor": "sonaar", "product": "MP3 Audio Player for Music, Radio & Podcast by Sonaar" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00214, "percentile": 0.11853 }, "nvd": { "published": "2026-07-23T12:18:43.887", "lastModified": "2026-07-23T16:17:51.820", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65506", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The Patchstack record reports unauthenticated broken access control in MP3 Audio Player but does not identify the handler, protected object, or omitted gate.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/mp3-music-player-by-sonaar/vulnerability/wordpress-mp3-audio-player-for-music-radio-podcast-by-sonaar-plugin-5-12-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 112, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65510", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:52.510Z", "date_published": "2026-07-23T11:19:07.828Z", "date_updated": "2026-07-23T14:50:44.301Z", "publisher": "Patchstack", "title": "WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Pepro Dev. Group" ], "products": [ { "vendor": "Pepro Dev. Group", "product": "PeproDev Ultimate Invoice" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0018, "percentile": 0.07756 }, "nvd": { "published": "2026-07-23T12:18:44.010", "lastModified": "2026-07-23T15:18:09.497", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65510", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled input crosses into executable syntax without context-safe neutralization.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/pepro-ultimate-invoice/vulnerability/wordpress-peprodev-ultimate-invoice-plugin-2-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 90, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65511", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:52.510Z", "date_published": "2026-07-23T11:19:08.475Z", "date_updated": "2026-07-23T13:26:54.308Z", "publisher": "Patchstack", "title": "WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "pixelacehq" ], "products": [ { "vendor": "pixelacehq", "product": "Manual - Documentation, Knowledge Base & Education WordPress Theme" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0018, "percentile": 0.07763 }, "nvd": { "published": "2026-07-23T12:18:44.130", "lastModified": "2026-07-23T14:17:55.637", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65511", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Manual - Documentation, Knowledge Base & Education WordPress Theme rendering path places attacker-controlled data into executable browser markup without context-appropriate sanitization or escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/manual/vulnerability/wordpress-manual-documentation-knowledge-base-education-wordpress-theme-theme-7-5-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 131, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65512", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:53:52.510Z", "date_published": "2026-07-23T11:19:09.110Z", "date_updated": "2026-07-23T13:40:50.020Z", "publisher": "Patchstack", "title": "WordPress WP Activity Log plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability", "affected": { "vendors": [ "Melapress" ], "products": [ { "vendor": "Melapress", "product": "WP Activity Log" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00104, "percentile": 0.01194 }, "nvd": { "published": "2026-07-23T12:18:44.253", "lastModified": "2026-07-23T14:17:56.357", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65512", "family": "REQUEST_CHANNEL_TRUST", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A cross-site request can cause WP Activity Log to perform an unspecified action under the victim's session because the required request-verification boundary is absent.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/wp-security-audit-log/vulnerability/wordpress-wp-activity-log-plugin-5-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 87, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65514", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:01.673Z", "date_published": "2026-07-23T11:19:09.754Z", "date_updated": "2026-07-23T14:04:49.364Z", "publisher": "Patchstack", "title": "WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "codepeople" ], "products": [ { "vendor": "codepeople", "product": "Appointment Hour Booking" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.05711 }, "nvd": { "published": "2026-07-23T12:18:44.383", "lastModified": "2026-07-23T15:18:10.253", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65514", "family": "INTERPRETER_BOUNDARY", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record says attacker-controlled input reaches executable syntax in Appointment Hour Booking, while the input field and interpreter sink are not public.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/appointment-hour-booking/vulnerability/wordpress-appointment-hour-booking-plugin-1-5-86-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 86, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65516", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:01.673Z", "date_published": "2026-07-23T11:19:10.392Z", "date_updated": "2026-07-23T15:09:52.250Z", "publisher": "Patchstack", "title": "WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability", "affected": { "vendors": [ "Pepro Dev. Group" ], "products": [ { "vendor": "Pepro Dev. Group", "product": "PeproDev Ultimate Invoice" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 7.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00194, "percentile": 0.09323 }, "nvd": { "published": "2026-07-23T12:18:44.510", "lastModified": "2026-07-23T16:17:51.937", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65516", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "PeproDev Ultimate Invoice makes a server-side request to an unauthenticated caller-selected destination.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/pepro-ultimate-invoice/vulnerability/wordpress-peprodev-ultimate-invoice-plugin-2-2-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 98, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65518", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:01.673Z", "date_published": "2026-07-23T11:19:11.027Z", "date_updated": "2026-07-23T15:55:23.460Z", "publisher": "Patchstack", "title": "WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Scott Paterson" ], "products": [ { "vendor": "Scott Paterson", "product": "Accept Donations with PayPal & Stripe" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.05721 }, "nvd": { "published": "2026-07-23T12:18:44.630", "lastModified": "2026-07-23T16:17:52.057", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65518", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled data reaches an HTML or DOM sink without context-appropriate sanitization and output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/easy-paypal-donation/vulnerability/wordpress-accept-donations-with-paypal-stripe-plugin-1-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 98, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65519", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:01.673Z", "date_published": "2026-07-23T11:19:11.667Z", "date_updated": "2026-07-23T14:50:33.382Z", "publisher": "Patchstack", "title": "WordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "gt3themes" ], "products": [ { "vendor": "gt3themes", "product": "Photo Gallery" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.0572 }, "nvd": { "published": "2026-07-23T12:18:44.760", "lastModified": "2026-07-23T15:18:10.837", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65519", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled content reaches an HTML, SVG or DOM output context without context-appropriate escaping, so the browser can interpret it as active script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/gt3-photo-video-gallery/vulnerability/wordpress-photo-gallery-plugin-2-7-7-29-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 72, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65521", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:01.673Z", "date_published": "2026-07-23T11:19:12.301Z", "date_updated": "2026-07-23T13:26:33.284Z", "publisher": "Patchstack", "title": "WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability", "affected": { "vendors": [ "Mahmudul Hasan Arif" ], "products": [ { "vendor": "Mahmudul Hasan Arif", "product": "WP Social Ninja" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-497", "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.0024, "percentile": 0.15217 }, "nvd": { "published": "2026-07-23T12:18:44.887", "lastModified": "2026-07-23T14:17:57.040", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65521", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "An unauthenticated response exposes system or application data that should remain inside the protected context.", "basis": [ "CNA", "CWE-497" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/wp-social-reviews/vulnerability/wordpress-wp-social-ninja-plugin-4-3-0-sensitive-data-exposure-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 77, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65522", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:01.673Z", "date_published": "2026-07-23T11:19:12.937Z", "date_updated": "2026-07-23T13:40:24.896Z", "publisher": "Patchstack", "title": "WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "pixelacehq" ], "products": [ { "vendor": "pixelacehq", "product": "Manual - Documentation, Knowledge Base & Education WordPress Theme" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.0571 }, "nvd": { "published": "2026-07-23T12:18:45.013", "lastModified": "2026-07-23T14:17:57.563", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65522", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "User-controlled content reaches Manual - Documentation, Knowledge Base & Education WordPress Theme page output without context-appropriate sanitization or escaping, so the browser interprets it as script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/theme/manual/vulnerability/wordpress-manual-documentation-knowledge-base-education-wordpress-theme-theme-7-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 127, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65524", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:08.234Z", "date_published": "2026-07-23T11:19:13.568Z", "date_updated": "2026-07-23T14:07:15.288Z", "publisher": "Patchstack", "title": "WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability", "affected": { "vendors": [ "ThemeFusion" ], "products": [ { "vendor": "ThemeFusion", "product": "Avada Custom Branding" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00162, "percentile": 0.05821 }, "nvd": { "published": "2026-07-23T12:18:45.137", "lastModified": "2026-07-23T15:18:11.360", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65524", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A contributor can perform an Avada Custom Branding operation outside the intended role, but the affected object and missing check are not public.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/fusion-white-label-branding/vulnerability/wordpress-avada-custom-branding-plugin-1-2-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 75, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65525", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:08.234Z", "date_published": "2026-07-23T11:19:14.202Z", "date_updated": "2026-07-23T15:11:16.484Z", "publisher": "Patchstack", "title": "WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability", "affected": { "vendors": [ "uxper" ], "products": [ { "vendor": "uxper", "product": "Civi Framework" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00176, "percentile": 0.07311 }, "nvd": { "published": "2026-07-23T12:18:45.263", "lastModified": "2026-07-23T16:17:52.167", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65525", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Civi Framework exposes an operation without requiring the intended authorization, but the object, action, and failed check are not public.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/civi-framework/vulnerability/wordpress-civi-framework-plugin-2-2-0-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 74, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65526", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:08.234Z", "date_published": "2026-07-23T11:19:14.846Z", "date_updated": "2026-08-03T09:14:14.010Z", "publisher": "Patchstack", "title": "WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability", "affected": { "vendors": [ "Themeisle" ], "products": [ { "vendor": "Themeisle", "product": "Visualizer" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 8.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0026, "percentile": 0.17655 }, "nvd": { "published": "2026-07-23T12:18:45.393", "lastModified": "2026-08-03T10:16:32.957", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65526", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "medium", "mechanism": "An authenticated Visualizer value is incorporated into a SQL query without safe parameter binding, enabling blind query manipulation.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/visualizer/vulnerability/wordpress-visualizer-plugin-4-0-6-sql-injection-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 206, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65527", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:08.235Z", "date_published": "2026-07-23T11:19:15.479Z", "date_updated": "2026-07-23T14:50:24.030Z", "publisher": "Patchstack", "title": "WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "lqd" ], "products": [ { "vendor": "lqd", "product": "LIQUID SPEECH BALLOON" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0013, "percentile": 0.03054 }, "nvd": { "published": "2026-07-23T12:18:45.517", "lastModified": "2026-07-23T15:18:11.890", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65527", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The LIQUID SPEECH BALLOON page renders attacker-controlled data as HTML or JavaScript without context-appropriate escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/liquid-speech-balloon/vulnerability/wordpress-liquid-speech-balloon-plugin-1-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 82, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65528", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:08.235Z", "date_published": "2026-07-23T11:19:16.111Z", "date_updated": "2026-07-23T13:26:07.357Z", "publisher": "Patchstack", "title": "WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "bannersky" ], "products": [ { "vendor": "bannersky", "product": "BSK PDF Manager" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00139, "percentile": 0.03681 }, "nvd": { "published": "2026-07-23T12:18:45.640", "lastModified": "2026-07-23T14:17:58.047", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65528", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "BSK PDF Manager lets contributor input reach generated page markup without sufficient browser-context escaping.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/bsk-pdf-manager/vulnerability/wordpress-bsk-pdf-manager-plugin-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 74, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65529", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:08.235Z", "date_published": "2026-07-23T11:19:16.755Z", "date_updated": "2026-07-23T13:39:58.992Z", "publisher": "Patchstack", "title": "WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability", "affected": { "vendors": [ "Iqonic Design" ], "products": [ { "vendor": "Iqonic Design", "product": "Graphina" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00195, "percentile": 0.09473 }, "nvd": { "published": "2026-07-23T12:18:45.760", "lastModified": "2026-07-23T14:17:58.570", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65529", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The affected operation is reachable without the authentication or authorization decision required for its protected action.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/graphina-elementor-charts-and-graphs/vulnerability/wordpress-graphina-plugin-3-1-12-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 69, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65530", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:08.235Z", "date_published": "2026-07-23T11:19:17.398Z", "date_updated": "2026-07-23T14:08:47.141Z", "publisher": "Patchstack", "title": "WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability", "affected": { "vendors": [ "Templatespare" ], "products": [ { "vendor": "Templatespare", "product": "TemplateSpare" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00222, "percentile": 0.12874 }, "nvd": { "published": "2026-07-23T12:18:45.880", "lastModified": "2026-07-23T15:18:12.427", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65530", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "TemplateSpare fails to enforce the required capability, object ownership, tenant, role, or scope check at the affected operation, allowing a caller outside that authority boundary to invoke it.", "basis": [ "CNA", "NVD", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/templatespare/vulnerability/wordpress-templatespare-plugin-4-2-2-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 68, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65531", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:08.235Z", "date_published": "2026-07-23T11:19:18.064Z", "date_updated": "2026-07-23T15:12:18.787Z", "publisher": "Patchstack", "title": "WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability", "affected": { "vendors": [ "Themeum" ], "products": [ { "vendor": "Themeum", "product": "Qubely" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 4.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00144, "percentile": 0.04171 }, "nvd": { "published": "2026-07-23T12:18:46.017", "lastModified": "2026-07-23T16:17:52.380", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65531", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Qubely exposes an action without authenticating or authorizing the caller, while the exact object and endpoint are not public.", "basis": [ "CNA", "NVD", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/qubely/vulnerability/wordpress-qubely-plugin-1-8-14-broken-access-control-vulnerability-2?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 67, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65532", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:08.235Z", "date_published": "2026-07-23T11:19:18.696Z", "date_updated": "2026-07-23T15:53:28.095Z", "publisher": "Patchstack", "title": "WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability", "affected": { "vendors": [ "PersianScript" ], "products": [ { "vendor": "PersianScript", "product": "Persian Woocommerce SMS" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L" } ], "max_cvss_observed_across_sources": 7.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00226, "percentile": 0.13418 }, "nvd": { "published": "2026-07-23T12:18:46.143", "lastModified": "2026-07-23T16:17:52.483", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65532", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Persian Woocommerce SMS incorporates attacker-controlled input into an SQL statement without parameterization, allowing input syntax to alter the database query.", "basis": [ "CNA", "NVD", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/persian-woocommerce-sms/vulnerability/wordpress-persian-woocommerce-sms-plugin-7-2-2-sql-injection-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 72, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65533", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:12.816Z", "date_published": "2026-07-23T11:19:19.336Z", "date_updated": "2026-07-23T14:50:11.064Z", "publisher": "Patchstack", "title": "WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "wbolt.com" ], "products": [ { "vendor": "wbolt.com", "product": "Smart SEO Tool" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00139, "percentile": 0.03682 }, "nvd": { "published": "2026-07-23T12:18:46.263", "lastModified": "2026-07-23T15:18:12.957", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65533", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The application inserts attacker-controlled input into an HTML execution context without the required output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/smart-seo-tool/vulnerability/wordpress-smart-seo-tool-plugin-4-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 75, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65534", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:12.816Z", "date_published": "2026-07-23T11:19:19.964Z", "date_updated": "2026-07-23T13:25:45.530Z", "publisher": "Patchstack", "title": "WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Charlie Etienne" ], "products": [ { "vendor": "Charlie Etienne", "product": "Custom links in Elementor Image Carousel" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 5.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00148, "percentile": 0.04536 }, "nvd": { "published": "2026-07-23T12:18:46.377", "lastModified": "2026-07-23T14:17:59.047", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65534", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The image-carousel extension emits author-controlled input as executable page markup without sufficient neutralization.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/custom-links-in-elementor-image-carousel/vulnerability/wordpress-custom-links-in-elementor-image-carousel-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 96, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65535", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:12.816Z", "date_published": "2026-07-23T11:19:20.599Z", "date_updated": "2026-07-23T13:37:26.146Z", "publisher": "Patchstack", "title": "WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability", "affected": { "vendors": [ "Takayuki Miyauchi" ], "products": [ { "vendor": "Takayuki Miyauchi", "product": "TinyMCE Templates" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-497", "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00184, "percentile": 0.08229 }, "nvd": { "published": "2026-07-23T12:18:46.497", "lastModified": "2026-07-23T14:17:59.510", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65535", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "TinyMCE Templates exposes protected data to a contributor, while the public record does not identify the data field or output path.", "basis": [ "CNA", "CWE-497" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/tinymce-templates/vulnerability/wordpress-tinymce-templates-plugin-4-8-1-sensitive-data-exposure-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 75, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65536", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:12.816Z", "date_published": "2026-07-23T11:19:21.247Z", "date_updated": "2026-07-23T14:03:30.708Z", "publisher": "Patchstack", "title": "WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability", "affected": { "vendors": [ "Mahdi Yousefi" ], "products": [ { "vendor": "Mahdi Yousefi", "product": "افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری)" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00123, "percentile": 0.02444 }, "nvd": { "published": "2026-07-23T12:18:46.617", "lastModified": "2026-07-23T14:17:59.933", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65536", "family": "REQUEST_CHANNEL_TRUST", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/persian-woocommerce-shipping/vulnerability/wordpress-fzonh-hml-o-nkl-oo-mrs-st-sht-z-o-sf-rsh-motor-plugin-4-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 130, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65537", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:12.816Z", "date_published": "2026-07-23T11:19:21.892Z", "date_updated": "2026-07-23T15:22:08.465Z", "publisher": "Patchstack", "title": "WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability", "affected": { "vendors": [ "Themeisle" ], "products": [ { "vendor": "Themeisle", "product": "Cyr to Lat reloaded – transliteration of links and file names" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00209, "percentile": 0.11168 }, "nvd": { "published": "2026-07-23T12:18:46.737", "lastModified": "2026-07-23T16:17:52.597", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65537", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The Cyr to Lat record identifies subscriber-level access to a protected operation but does not name that operation or the missing capability check.", "basis": [ "CNA", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/cyr-and-lat/vulnerability/wordpress-cyr-to-lat-reloaded-transliteration-of-links-and-file-names-plugin-1-3-3-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 116, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65538", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:12.816Z", "date_published": "2026-07-23T11:19:22.531Z", "date_updated": "2026-07-23T15:48:44.017Z", "publisher": "Patchstack", "title": "WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Nilo Velez" ], "products": [ { "vendor": "Nilo Velez", "product": "Machete" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 5.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00148, "percentile": 0.04535 }, "nvd": { "published": "2026-07-23T12:18:46.863", "lastModified": "2026-07-23T16:17:52.693", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65538", "family": "INTERPRETER_BOUNDARY", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Attacker-controlled data reaches an HTML or DOM sink without context-appropriate sanitization and output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "The public record supports the family and impact but does not identify the failing check, parser rule, or state transition." }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/machete/vulnerability/wordpress-machete-plugin-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 61, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65539", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:12.816Z", "date_published": "2026-07-23T11:19:23.165Z", "date_updated": "2026-07-23T14:49:58.989Z", "publisher": "Patchstack", "title": "WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability", "affected": { "vendors": [ "Bimal Rekhadiya" ], "products": [ { "vendor": "Bimal Rekhadiya", "product": "Kwayy HTML Sitemap" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00094, "percentile": 0.00738 }, "nvd": { "published": "2026-07-23T12:18:46.983", "lastModified": "2026-07-23T15:18:13.577", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65539", "family": "REQUEST_CHANNEL_TRUST", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Patchstack identifies a cross-site request forgery in Kwayy HTML Sitemap, but does not publish the state-changing action or missing request check.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/kwayy-html-sitemap/vulnerability/wordpress-kwayy-html-sitemap-plugin-4-0-csrf-to-stored-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 88, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65540", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:12.816Z", "date_published": "2026-07-23T11:19:23.800Z", "date_updated": "2026-07-23T13:24:19.102Z", "publisher": "Patchstack", "title": "WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability", "affected": { "vendors": [ "Metin Saraç" ], "products": [ { "vendor": "Metin Saraç", "product": "Popup for CF7 with Sweet Alert" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00094, "percentile": 0.00738 }, "nvd": { "published": "2026-07-23T12:18:47.110", "lastModified": "2026-07-23T14:18:00.523", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65540", "family": "REQUEST_CHANNEL_TRUST", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "A state-changing browser request is accepted without a valid origin-bound anti-forgery check.", "basis": [ "CNA", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/cf7-sweet-alert-popup/vulnerability/wordpress-popup-for-cf7-with-sweet-alert-plugin-1-6-5-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 102, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65550", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:17.066Z", "date_published": "2026-07-23T11:19:24.434Z", "date_updated": "2026-07-23T13:35:46.597Z", "publisher": "Patchstack", "title": "WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "wpshopmart" ], "products": [ { "vendor": "wpshopmart", "product": "Tabs" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 5.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00148, "percentile": 0.04535 }, "nvd": { "published": "2026-07-23T12:18:47.230", "lastModified": "2026-07-23T14:18:01.160", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65550", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "User-controlled content reaches Tabs page output without context-appropriate sanitization or escaping, so the browser interprets it as script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/tabs-responsive/vulnerability/wordpress-tabs-plugin-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 64, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65557", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:23.962Z", "date_published": "2026-07-27T13:59:19.377Z", "date_updated": "2026-07-27T16:30:02.069Z", "publisher": "Patchstack", "title": "WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Tychesoftwares" ], "products": [ { "vendor": "Tychesoftwares", "product": "Abandoned Cart Lite for WooCommerce" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 5.9, "cvss_source_score_spread": 0, "epss": { "score": 0.0014, "percentile": 0.03783 }, "nvd": { "published": "2026-07-27T15:17:09.060", "lastModified": "2026-07-27T17:46:02.447", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65557", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Shop-manager-controlled cart data is rendered without the required browser-context separation.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/woocommerce-abandoned-cart/vulnerability/wordpress-abandoned-cart-lite-for-woocommerce-plugin-6-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 97, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65558", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:23.962Z", "date_published": "2026-07-27T13:59:20.025Z", "date_updated": "2026-07-27T16:17:44.977Z", "publisher": "Patchstack", "title": "WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability", "affected": { "vendors": [ "WPCenter" ], "products": [ { "vendor": "WPCenter", "product": "AffiliateX" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0, "epss": { "score": 0.00138, "percentile": 0.03625 }, "nvd": { "published": "2026-07-27T15:17:09.210", "lastModified": "2026-07-27T17:46:02.447", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65558", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A server-side request accepts an attacker-selected destination without enforcing the intended network boundary.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/affiliatex/vulnerability/wordpress-affiliatex-plugin-2-3-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 83, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65561", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:23.962Z", "date_published": "2026-07-27T13:59:20.665Z", "date_updated": "2026-07-27T16:07:44.552Z", "publisher": "Patchstack", "title": "WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "miniOrange" ], "products": [ { "vendor": "miniOrange", "product": "WordPress Social Login and Register" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0013, "percentile": 0.03049 }, "nvd": { "published": "2026-07-27T15:17:09.357", "lastModified": "2026-07-27T17:46:02.447", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65561", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Contributor-controlled Social Login data reaches a browser-executable context without sufficient HTML neutralization.", "basis": [ "CNA record", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/miniorange-login-openid/vulnerability/wordpress-wordpress-social-login-and-register-plugin-7-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 96, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65562", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:23.962Z", "date_published": "2026-07-27T13:59:21.316Z", "date_updated": "2026-07-27T14:59:56.545Z", "publisher": "Patchstack", "title": "WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "WPDeveloper" ], "products": [ { "vendor": "WPDeveloper", "product": "BetterDocs" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.0013, "percentile": 0.03053 }, "nvd": { "published": "2026-07-27T15:17:09.507", "lastModified": "2026-07-27T17:46:02.447", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65562", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "BetterDocs renders attacker-controlled content into a browser-interpreted context without context-appropriate encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/betterdocs/vulnerability/wordpress-betterdocs-plugin-4-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 71, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65563", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:32.759Z", "date_published": "2026-07-27T13:59:21.954Z", "date_updated": "2026-07-27T15:01:58.458Z", "publisher": "Patchstack", "title": "WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability", "affected": { "vendors": [ "Themeisle" ], "products": [ { "vendor": "Themeisle", "product": "Orbit Fox by ThemeIsle" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.9, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 5.9, "cvss_source_score_spread": 0, "epss": { "score": 0.0014, "percentile": 0.03784 }, "nvd": { "published": "2026-07-27T15:17:09.657", "lastModified": "2026-07-27T17:46:02.447", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65563", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Orbit Fox lets author-controlled content reach page markup without neutralizing executable script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/themeisle-companion/vulnerability/wordpress-orbit-fox-by-themeisle-plugin-3-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 78, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65564", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:32.759Z", "date_published": "2026-07-27T13:59:22.589Z", "date_updated": "2026-07-27T18:15:15.556Z", "publisher": "Patchstack", "title": "WordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerability", "affected": { "vendors": [ "chrisvrichardson" ], "products": [ { "vendor": "chrisvrichardson", "product": "MapPress Maps for WordPress" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-497", "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00197, "percentile": 0.09729 }, "nvd": { "published": "2026-07-27T15:17:09.807", "lastModified": "2026-07-27T19:17:22.047", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65564", "family": "EXPOSURE_OUTPUT", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "MapPress exposes sensitive system information to unauthenticated callers, while the Patchstack record does not identify the data, endpoint, or response.", "basis": [ "CNA", "CWE-497" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/mappress-google-maps-for-wordpress/vulnerability/wordpress-mappress-maps-for-wordpress-plugin-2-97-6-sensitive-data-exposure-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 90, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65567", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:32.759Z", "date_published": "2026-07-27T13:59:23.233Z", "date_updated": "2026-07-27T16:29:36.731Z", "publisher": "Patchstack", "title": "WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability", "affected": { "vendors": [ "Nexcess" ], "products": [ { "vendor": "Nexcess", "product": "Event Tickets" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00176, "percentile": 0.0731 }, "nvd": { "published": "2026-07-27T15:17:09.990", "lastModified": "2026-07-27T17:46:02.447", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65567", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "The public record shows an unauthenticated Event Tickets action crosses an authorization boundary but does not identify the action or missing check.", "basis": [ "CNA record", "NVD", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/event-tickets/vulnerability/wordpress-event-tickets-plugin-5-29-0-1-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 76, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65568", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T08:54:32.759Z", "date_published": "2026-07-27T13:59:23.873Z", "date_updated": "2026-07-27T16:17:37.177Z", "publisher": "Patchstack", "title": "WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulnerability", "affected": { "vendors": [ "Visual Composer" ], "products": [ { "vendor": "Visual Composer", "product": "Visual Composer Website Builder" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-862", "name": "Missing Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N" }, { "source": "NVD:audit@patchstack.com", "type": "Secondary", "version": "3.1", "score": 5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N" } ], "max_cvss_observed_across_sources": 5, "cvss_source_score_spread": 0, "epss": { "score": 0.00165, "percentile": 0.06175 }, "nvd": { "published": "2026-07-27T15:17:10.217", "lastModified": "2026-07-27T17:46:02.447", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65568", "family": "AUTHORITY_BINDING", "precision": "BROAD_RECORD", "confidence": "medium", "mechanism": "Visual Composer permits a contributor to perform an undisclosed action without the required authorization check.", "basis": [ "CNA", "NVD", "CWE-862" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://patchstack.com/database/wordpress/plugin/visualcomposer/vulnerability/wordpress-visual-composer-website-builder-plugin-45-15-0-broken-access-control-vulnerability?_s_id=cve", "host": "patchstack.com", "sources": [ "cna", "nvd" ], "tags": [ "vdb-entry" ] } ], "record_shape": { "descriptionChars": 89, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65589", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:45:44.832Z", "date_published": "2026-07-22T11:21:39.365Z", "date_updated": "2026-07-23T13:53:56.061Z", "publisher": "VulnCheck", "title": "n8n before 1.123.64 Credential Exposure via LLM Node Execution Data", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 1.4000000000000004, "epss": { "score": 0.00371, "percentile": 0.2989 }, "nvd": { "published": "2026-07-22T12:18:18.857", "lastModified": "2026-07-27T19:09:14.453", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65589", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The n8n execution path writes secrets into records or logs readable by users who are not entitled to those secret values.", "basis": [ "CNA", "CWE-532" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-89gh-3pgc-v5h2", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-credential-exposure-via-llm-node-execution-data", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 330, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-65590", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:45:44.832Z", "date_published": "2026-07-22T11:21:40.040Z", "date_updated": "2026-07-22T13:03:15.692Z", "publisher": "VulnCheck", "title": "n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.5, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 4.300000000000001, "epss": { "score": 0.00322, "percentile": 0.24604 }, "nvd": { "published": "2026-07-22T12:18:18.987", "lastModified": "2026-07-27T19:10:27.807", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65590", "family": "CONFIG_UPDATE_DEPENDENCY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The computer-use shell applies its sandbox only on macOS, leaving Linux and Windows commands unrestricted on the host.", "basis": [ "CNA", "CWE-78", "https://github.com/n8n-io/n8n/security/advisories/GHSA-fpg6-x68q-5793" ], "deepDive": true, "notes": "The official n8n advisory rates the issue Moderate at CVSS 4.0 5.5 with PR:H and no CWE, while the embedded VulnCheck/NVD row reports CVSS 3.1 9.8 with PR:N and CWE-78; the advisory describes missing platform sandbox enforcement rather than command injection." }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-fpg6-x68q-5793", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-shell-sandbox-bypass-on-linux-windows", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 530, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-65591", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:45:44.832Z", "date_published": "2026-07-22T11:21:40.743Z", "date_updated": "2026-07-22T15:51:37.174Z", "publisher": "VulnCheck", "title": "n8n before 1.123.64 Sanitizer Bypass Remote Code Execution", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-917", "name": "Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.9, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.9, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.9, "cvss_source_score_spread": 0.09999999999999964, "epss": { "score": 0.00471, "percentile": 0.38303 }, "nvd": { "published": "2026-07-22T12:18:19.117", "lastModified": "2026-07-27T19:11:06.293", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65591", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The n8n evaluator permits attacker-controlled expression syntax to cross its sanitizer and execute in the host context.", "basis": [ "CNA", "CWE-917" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-pm35-fqvh-cq5g", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-sanitizer-bypass-remote-code-execution", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 396, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-65592", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:45:44.832Z", "date_published": "2026-07-22T11:21:41.381Z", "date_updated": "2026-07-22T12:23:52.475Z", "publisher": "VulnCheck", "title": "n8n before 1.123.64 Stored DOM XSS via cachedResultUrl", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.4, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.4, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 8.4, "cvss_source_score_spread": 3, "epss": { "score": 0.00172, "percentile": 0.06833 }, "nvd": { "published": "2026-07-22T12:18:19.253", "lastModified": "2026-07-27T19:11:30.983", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65592", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "n8n passes workflow-persisted cachedResultUrl to window.open without rejecting executable URL schemes.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-9wcp-9r3j-383q", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-stored-dom-xss-via-cachedresulturl", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 498, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-65593", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:45:44.832Z", "date_published": "2026-07-22T11:21:42.062Z", "date_updated": "2026-07-24T21:35:14.789Z", "publisher": "VulnCheck", "title": "n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 6.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.3, "cvss_source_score_spread": 0.8999999999999995, "epss": { "score": 0.00143, "percentile": 0.04086 }, "nvd": { "published": "2026-07-22T12:18:19.390", "lastModified": "2026-07-27T19:12:13.733", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65593", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "The n8n dynamic-node-parameters endpoints lack authorization scopes and accept absolute routing URLs that override baseURL restrictions, allowing an authenticated caller to reach internal targets when SSRF protection is disabled.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-9w78-79q7-r4fp", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-ssrf-via-dynamic-node-parameters", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 388, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-65594", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:45:44.832Z", "date_published": "2026-07-22T11:21:42.750Z", "date_updated": "2026-07-23T18:01:35.800Z", "publisher": "VulnCheck", "title": "n8n before 2.30.1 Missing OAuth Authorization Check", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 1.4000000000000004, "epss": { "score": 0.00268, "percentile": 0.1878 }, "nvd": { "published": "2026-07-22T12:18:19.527", "lastModified": "2026-07-27T19:13:07.460", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65594", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-q5xf-xhwf-cwqf", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-missing-oauth-authorization-check", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 724, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-65595", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:45:44.832Z", "date_published": "2026-07-22T11:21:43.411Z", "date_updated": "2026-07-24T21:35:15.441Z", "publisher": "VulnCheck", "title": "n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchange", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-269", "name": "Improper Privilege Management", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.9, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.9, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.9, "cvss_source_score_spread": 0.09999999999999964, "epss": { "score": 0.0047, "percentile": 0.38214 }, "nvd": { "published": "2026-07-22T12:18:19.660", "lastModified": "2026-07-27T19:14:35.053", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65595", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "n8n token exchange grants every Public API scope to the issued JWT without intersecting the scopes with the acting user's role.", "basis": [ "CNA", "CWE-269" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-777w-rpr6-c52h", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-token-exchange", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 611, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-65596", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:45:44.833Z", "date_published": "2026-07-22T11:21:44.064Z", "date_updated": "2026-07-22T13:03:54.789Z", "publisher": "VulnCheck", "title": "n8n before 1.123.64 Credential Exfiltration via GraphQL Node", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 3, "epss": { "score": 0.00209, "percentile": 0.11159 }, "nvd": { "published": "2026-07-22T12:18:19.790", "lastModified": "2026-07-27T19:15:28.190", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65596", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "n8n permits a GraphQL credential operation outside the credential's configured domain restriction, applying authorization to the wrong destination scope.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-gq66-9cw5-j5jm", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-credential-exfiltration-via-graphql-node", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 501, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-65597", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:45:44.833Z", "date_published": "2026-07-22T11:21:44.721Z", "date_updated": "2026-07-22T15:58:12.717Z", "publisher": "VulnCheck", "title": "n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 2.799999999999999, "epss": { "score": 0.00214, "percentile": 0.11816 }, "nvd": { "published": "2026-07-22T12:18:19.913", "lastModified": "2026-07-27T19:15:45.820", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65597", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The application renders attacker-controlled content into an HTML or JavaScript context without context-appropriate output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-p3rg-hrf9-w9gj", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-dom-based-xss-via-unsandboxed-iframe", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 462, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-65598", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:45:44.833Z", "date_published": "2026-07-22T11:21:45.418Z", "date_updated": "2026-07-22T12:22:51.683Z", "publisher": "VulnCheck", "title": "n8n before 1.123.64 Remote Code Execution via Git Clone", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-367", "name": "Time-of-check Time-of-use (TOCTOU) Race Condition", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.9, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.9, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.9, "cvss_source_score_spread": 1.4000000000000004, "epss": { "score": 0.00241, "percentile": 0.15376 }, "nvd": { "published": "2026-07-22T12:18:20.037", "lastModified": "2026-07-27T19:18:06.673", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65598", "family": "STATE_SEQUENCE", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The Git clone path is validated before use, allowing an authenticated user to replace the checked directory with a symlink before cloning.", "basis": [ "CNA", "CWE-367" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-g3r5-9h93-4j2c", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-remote-code-execution-via-git-clone", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 492, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-65599", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:48:36.000Z", "date_published": "2026-07-22T11:21:46.100Z", "date_updated": "2026-07-24T21:35:16.181Z", "publisher": "VulnCheck", "title": "n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure via JWT Header", "affected": { "vendors": [ "n8n-io" ], "products": [ { "vendor": "n8n-io", "product": "n8n" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-312", "name": "Cleartext Storage of Sensitive Information", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:nvd@nist.gov", "type": "Primary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 1.4000000000000004, "epss": { "score": 0.00153, "percentile": 0.0501 }, "nvd": { "published": "2026-07-22T12:18:20.167", "lastModified": "2026-07-27T19:18:25.940", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65599", "family": "EXPOSURE_OUTPUT", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "n8n places an entire PEM private key in the readable kid field of a JWT header instead of placing only a key identifier there.", "basis": [ "CNA", "CWE-312" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-9r8p-h6cc-6qhm", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "Mitigation", "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/n8n-before-credential-exposure-via-jwt-header", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 616, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 3, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-65600", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:48:36.000Z", "date_published": "2026-07-22T11:21:46.783Z", "date_updated": "2026-07-23T19:08:19.233Z", "publisher": "VulnCheck", "title": "Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex", "affected": { "vendors": [ "traefik" ], "products": [ { "vendor": "traefik", "product": "traefik" } ], "affectedBlockCount": 3, "versionEntryCount": 6, "versionRangeCount": 3, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.8, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.8, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00674, "percentile": 0.48618 }, "nvd": { "published": "2026-07-22T12:18:20.297", "lastModified": "2026-07-23T20:17:21.667", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65600", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Traefik forwards an unnormalized replacement path that the backend later normalizes to a protected route, so middleware and backend authorize different paths.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 736, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-65601", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:48:36.000Z", "date_published": "2026-07-22T11:21:47.468Z", "date_updated": "2026-07-24T21:35:16.899Z", "publisher": "VulnCheck", "title": "Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef", "affected": { "vendors": [ "traefik" ], "products": [ { "vendor": "traefik", "product": "traefik" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00238, "percentile": 0.14917 }, "nvd": { "published": "2026-07-22T12:18:20.430", "lastModified": "2026-07-23T14:18:02.560", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65601", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Traefik resolves an HTTPRoute extensionRef in the backend Service namespace and therefore applies the Service grant to a Middleware that requires a separate namespace authorization.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-httproute-extensionref", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 599, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65602", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:48:36.000Z", "date_published": "2026-07-22T11:21:48.127Z", "date_updated": "2026-07-24T21:35:17.581Z", "publisher": "VulnCheck", "title": "Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass", "affected": { "vendors": [ "traefik" ], "products": [ { "vendor": "traefik", "product": "traefik" } ], "affectedBlockCount": 2, "versionEntryCount": 4, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 5.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00161, "percentile": 0.05746 }, "nvd": { "published": "2026-07-22T12:18:20.560", "lastModified": "2026-07-22T16:27:18.220", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65602", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The TCP route path omits the crossProviderNamespaces allowlist applied to HTTP and accepts a forbidden cross-provider transport reference.", "basis": [ "CNA", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/traefik/traefik/security/advisories/GHSA-42cj-m3vj-89wv", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/traefik-before-ingressroutetcp-serverstransport-namespace-bypass", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 632, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 4 } }, { "cve_id": "CVE-2026-65603", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:48:36.000Z", "date_published": "2026-07-22T11:21:48.928Z", "date_updated": "2026-07-22T16:00:38.403Z", "publisher": "VulnCheck", "title": "Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update", "affected": { "vendors": [ "getgrav" ], "products": [ { "vendor": "getgrav", "product": "grav" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-269", "name": "Improper Privilege Management", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00303, "percentile": 0.22647 }, "nvd": { "published": "2026-07-22T12:18:20.683", "lastModified": "2026-07-22T17:16:59.437", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65603", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The profile update handler persists attacker-supplied groups and access fields instead of stripping privilege attributes.", "basis": [ "CNA", "CWE-269" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/getgrav/grav/security/advisories/GHSA-h33v-82r9-v8pm", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/grav-login-plugin-privilege-escalation-via-profile-update", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 725, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65604", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:48:36.000Z", "date_published": "2026-07-23T21:16:47.608Z", "date_updated": "2026-07-24T14:04:07.992Z", "publisher": "VulnCheck", "title": "Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass", "affected": { "vendors": [ "zalando" ], "products": [ { "vendor": "zalando", "product": "skipper" } ], "affectedBlockCount": 1, "versionEntryCount": 0, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-20", "name": "Improper Input Validation", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.8, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.8, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.6000000000000014, "epss": { "score": 0.0029, "percentile": 0.21239 }, "nvd": { "published": "2026-07-23T22:16:53.170", "lastModified": "2026-07-30T19:53:34.757", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65604", "family": "REQUEST_CHANNEL_TRUST", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Skipper forwards an oversized request body while presenting an empty parsed_body to OPA, so body-dependent deny rules inspect different data from the upstream request.", "basis": [ "CNA", "CWE-20" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://www.vulncheck.com/advisories/skipper-incomplete-fix-for-cve-2026-50197-policy-bypass", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 496, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 0 } }, { "cve_id": "CVE-2026-65605", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:48:36.000Z", "date_published": "2026-07-23T11:42:13.521Z", "date_updated": "2026-07-28T01:06:08.238Z", "publisher": "VulnCheck", "title": "SiYuan before v3.7.2 Stored XSS to RCE via Attribute View", "affected": { "vendors": [ "siyuan-note" ], "products": [ { "vendor": "siyuan-note", "product": "siyuan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "cna", "version": "3.1", "score": 9.6, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.6, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.6, "cvss_source_score_spread": 0.1999999999999993, "epss": { "score": 0.00516, "percentile": 0.41056 }, "nvd": { "published": "2026-07-23T12:18:47.357", "lastModified": "2026-07-23T16:17:52.793", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65605", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "siyuan places attacker-controlled markup, attributes, or URLs into an HTML or DOM rendering context without the required sanitization or output encoding.", "basis": [ "CNA", "NVD", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pw5c-qhf3-jhwh", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://github.com/siyuan-note/siyuan/commit/41f2861c87575ff5ac4b50a0520b1a4fe55b4a70", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/siyuan-before-stored-xss-to-rce-via-attribute-view", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 641, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65606", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:48:36.000Z", "date_published": "2026-07-23T11:42:14.200Z", "date_updated": "2026-07-28T01:06:08.923Z", "publisher": "VulnCheck", "title": "SiYuan before v3.7.2 Cross-Site Scripting to RCE", "affected": { "vendors": [ "siyuan-note" ], "products": [ { "vendor": "siyuan-note", "product": "siyuan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" }, { "source": "cna", "version": "3.1", "score": 9.6, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.4, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.6, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.6, "cvss_source_score_spread": 0.1999999999999993, "epss": { "score": 0.00516, "percentile": 0.41056 }, "nvd": { "published": "2026-07-23T12:18:47.493", "lastModified": "2026-07-23T16:17:52.913", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65606", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The SiYuan protocol handler inserts the icon parameter through innerHTML, and nodeIntegration lets the resulting script invoke operating-system commands.", "basis": [ "CNA", "NVD", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wp64-x7qh-h728", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://github.com/siyuan-note/siyuan/commit/41f2861c87575ff5ac4b50a0520b1a4fe55b4a70", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/siyuan-before-cross-site-scripting-to-rce", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 646, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65607", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:48:36.000Z", "date_published": "2026-07-23T11:42:14.890Z", "date_updated": "2026-07-28T01:06:09.636Z", "publisher": "VulnCheck", "title": "SiYuan before v3.7.2 Path Traversal via /export/temp/", "affected": { "vendors": [ "siyuan-note" ], "products": [ { "vendor": "siyuan-note", "product": "siyuan" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0.5999999999999996, "epss": { "score": 0.00399, "percentile": 0.32674 }, "nvd": { "published": "2026-07-23T12:18:47.633", "lastModified": "2026-07-27T17:16:40.020", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65607", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "siyuan resolves attacker-controlled path components without confirming that the final path remains beneath the intended root.", "basis": [ "CNA", "NVD", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gw25-m53r-qh88", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "vendor-advisory" ] }, { "url": "https://github.com/siyuan-note/siyuan/commit/bb481e1290c4a34255652ede85a546504505d2a7", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/siyuan-before-path-traversal-via-export-temp", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 715, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65608", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T10:48:36.000Z", "date_published": "2026-07-23T11:42:15.534Z", "date_updated": "2026-07-24T21:35:20.322Z", "publisher": "VulnCheck", "title": "Grav before 2.0.9 Remote Code Execution via FlexDirectory", "affected": { "vendors": [ "getgrav" ], "products": [ { "vendor": "getgrav", "product": "grav" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-470", "name": "Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00849, "percentile": 0.54582 }, "nvd": { "published": "2026-07-23T12:18:47.770", "lastModified": "2026-07-23T19:17:04.707", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65608", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The application passes an attacker-selected callable to call_user_func_array after only an is_callable check, allowing dangerous functions to execute.", "basis": [ "CNA", "CWE-470" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/getgrav/grav/security/advisories/GHSA-c4wf-2xxc-68qm", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "vendor-advisory" ] }, { "url": "https://github.com/getgrav/grav/commit/fae9e1bf2c40ce0b50d0dfce647aaa1d22f98969", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/grav-before-remote-code-execution-via-flexdirectory", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 731, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65616", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T12:02:46.789Z", "date_published": "2026-07-27T19:34:17.137Z", "date_updated": "2026-07-27T20:05:20.710Z", "publisher": "JFROG", "title": "Potential privilege escalation to JFrog administrator privileges", "affected": { "vendors": [ "jfrog" ], "products": [ { "vendor": "jfrog", "product": "artifactory" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-347", "name": "Improper Verification of Cryptographic Signature", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:reefs@jfrog.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00187, "percentile": 0.08596 }, "nvd": { "published": "2026-07-27T20:16:40.843", "lastModified": "2026-07-30T14:49:28.900", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65616", "family": "CRYPTO_SECRET", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Artifactory validates a refresh-token signature incorrectly and issues a signed administrator token to a non-administrator.", "basis": [ "CNA", "CWE-347" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "host": "docs.jfrog.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "host": "docs.jfrog.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 130, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65617", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T12:02:46.789Z", "date_published": "2026-07-27T19:37:27.983Z", "date_updated": "2026-07-27T19:59:29.655Z", "publisher": "JFROG", "title": "Potential remote code execution on an Artifactory package service container.", "affected": { "vendors": [ "jfrog" ], "products": [ { "vendor": "jfrog", "product": "artifactory" } ], "affectedBlockCount": 1, "versionEntryCount": 6, "versionRangeCount": 6, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:reefs@jfrog.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00312, "percentile": 0.2357 }, "nvd": { "published": "2026-07-27T20:16:40.953", "lastModified": "2026-07-30T14:49:42.093", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65617", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "JFrog Artifactory deserializes attacker-influenced package data into executable object behavior without a safe serialization boundary.", "basis": [ "CNA", "CWE-502" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "host": "docs.jfrog.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "host": "docs.jfrog.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 191, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 6 } }, { "cve_id": "CVE-2026-65618", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T12:02:46.789Z", "date_published": "2026-07-27T19:32:29.202Z", "date_updated": "2026-07-27T20:06:56.305Z", "publisher": "JFROG", "title": "Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability", "affected": { "vendors": [ "jfrog" ], "products": [ { "vendor": "jfrog", "product": "artifactory" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:reefs@jfrog.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00209, "percentile": 0.11129 }, "nvd": { "published": "2026-07-27T20:16:41.077", "lastModified": "2026-07-30T14:51:10.990", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65618", "family": "REQUEST_CHANNEL_TRUST", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.", "basis": [ "CNA", "CWE-918" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "host": "docs.jfrog.com", "sources": [ "cna", "nvd" ], "tags": [ "Vendor Advisory", "vendor-advisory" ] }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "host": "docs.jfrog.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "vendor-advisory" ] } ], "record_shape": { "descriptionChars": 217, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65623", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T13:55:59.401Z", "date_published": "2026-07-24T16:32:24.923Z", "date_updated": "2026-07-25T04:16:42.726Z", "publisher": "EEF", "title": "Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit", "affected": { "vendors": [ "mtrudel" ], "products": [ { "vendor": "mtrudel", "product": "bandit" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-407", "name": "Inefficient Algorithmic Complexity", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 0, "epss": { "score": 0.00392, "percentile": 0.31919 }, "nvd": { "published": "2026-07-24T17:17:34.107", "lastModified": "2026-07-30T17:01:07.343", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65623", "family": "RESOURCE_CONTROL", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly.", "basis": [ "CNA", "CWE-407" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-vg8x-66vg-5pxh", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "related", "vendor-advisory" ] }, { "url": "https://cna.erlef.org/cves/CVE-2026-65623.html", "host": "cna.erlef.org", "sources": [ "cna", "nvd" ], "tags": [ "related" ] }, { "url": "https://osv.dev/vulnerability/EEF-CVE-2026-65623", "host": "osv.dev", "sources": [ "cna", "nvd" ], "tags": [ "related" ] }, { "url": "https://github.com/mtrudel/bandit/commit/418ef7e906192a230ddba112f7a669c87b6b0e3a", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] } ], "record_shape": { "descriptionChars": 1238, "referenceCount": 4, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65624", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T13:55:59.401Z", "date_published": "2026-07-28T10:01:01.811Z", "date_updated": "2026-07-29T04:17:22.788Z", "publisher": "EEF", "title": "Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion", "affected": { "vendors": [ "ninenines" ], "products": [ { "vendor": "ninenines", "product": "cowboy" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 6.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00383, "percentile": 0.3105 }, "nvd": { "published": "2026-07-28T10:16:50.500", "lastModified": "2026-07-30T19:14:09.213", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65624", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Cowboy counts distinct header names while concatenating unlimited duplicate values, so max_headers never caps total header memory.", "basis": [ "CNA", "CWE-770" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://cna.erlef.org/cves/CVE-2026-65624.html", "host": "cna.erlef.org", "sources": [ "cna", "nvd" ], "tags": [ "related", "third-party-advisory" ] }, { "url": "https://osv.dev/vulnerability/EEF-CVE-2026-65624", "host": "osv.dev", "sources": [ "cna", "nvd" ], "tags": [ "related" ] }, { "url": "https://github.com/ninenines/cowboy/commit/3a34d8c1cfd94326466aa16a9017236691dc9c55", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] } ], "record_shape": { "descriptionChars": 1375, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65635", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T13:58:26.233Z", "date_published": "2026-07-30T14:17:02.942Z", "date_updated": "2026-07-31T04:20:15.914Z", "publisher": "EEF", "title": "Boruta dynamic client registration allows creation of over-privileged OAuth clients", "affected": { "vendors": [ "malach-it" ], "products": [ { "vendor": "malach-it", "product": "boruta" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-653", "name": "Improper Isolation or Compartmentalization", "abstraction": "Class", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N" }, { "source": "NVD:6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary", "version": "4.0", "score": 8.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 8.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00301, "percentile": 0.22417 }, "nvd": { "published": "2026-07-30T15:16:35.017", "lastModified": "2026-07-30T17:16:34.043", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65635", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Public dynamic client registration forwards caller-supplied fields into the administrative client-creation path without separating operator-only controls.", "basis": [ "CNA", "CWE-653" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/malach-it/boruta_auth/security/advisories/GHSA-w869-fcf2-68vp", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "related", "vendor-advisory" ] }, { "url": "https://cna.erlef.org/cves/CVE-2026-65635.html", "host": "cna.erlef.org", "sources": [ "cna", "nvd" ], "tags": [ "related" ] }, { "url": "https://osv.dev/vulnerability/EEF-CVE-2026-65635", "host": "osv.dev", "sources": [ "cna", "nvd" ], "tags": [ "related" ] }, { "url": "https://github.com/malach-it/boruta_auth/commit/82584c854a332482232fd25301ab12a835f9f643", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://github.com/malach-it/boruta_auth/commit/95619a1beaff68fa766cca9b388e7c780d182525", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] } ], "record_shape": { "descriptionChars": 1028, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65636", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T13:58:26.233Z", "date_published": "2026-07-31T13:29:31.198Z", "date_updated": "2026-08-01T04:18:38.726Z", "publisher": "EEF", "title": "YAML injection via unescaped newlines in ymlr document comments", "affected": { "vendors": [ "ufirstgroup" ], "products": [ { "vendor": "ufirstgroup", "product": "ymlr" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences ('CRLF Injection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 2.1, "severity": "LOW", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N" }, { "source": "NVD:6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary", "version": "4.0", "score": 2.1, "severity": "LOW", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 2.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00141, "percentile": 0.03896 }, "nvd": { "published": "2026-07-31T14:16:51.240", "lastModified": "2026-08-04T14:52:54.493", "vulnStatus": "Awaiting Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65636", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An unescaped line break ends the intended comment context and turns the remaining attacker text into YAML document content.", "basis": [ "CNA", "CWE-93" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/ufirstgroup/ymlr/security/advisories/GHSA-p8qx-7cp9-v6c9", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "related", "vendor-advisory" ] }, { "url": "https://cna.erlef.org/cves/CVE-2026-65636.html", "host": "cna.erlef.org", "sources": [ "cna", "nvd" ], "tags": [ "related" ] }, { "url": "https://osv.dev/vulnerability/EEF-CVE-2026-65636", "host": "osv.dev", "sources": [ "cna", "nvd" ], "tags": [ "related" ] }, { "url": "https://github.com/ufirstgroup/ymlr/commit/7e53061fb2809b787fba0373c46b78e253c83adc", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://github.com/ufirstgroup/ymlr/commit/42a0bf8b2af44b0e7c42d0b7044c8588ca5866dc", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] } ], "record_shape": { "descriptionChars": 1292, "referenceCount": 5, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65650", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T17:07:58.054Z", "date_published": "2026-07-22T17:07:58.988Z", "date_updated": "2026-07-22T18:49:19.203Z", "publisher": "mitre", "title": "Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.", "affected": { "vendors": [ "Elgg" ], "products": [ { "vendor": "Elgg", "product": "Elgg" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 2, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": "NVD:cve@mitre.org", "type": "Secondary", "version": "3.1", "score": 4.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" } ], "max_cvss_observed_across_sources": 4.3, "cvss_source_score_spread": 0, "epss": { "score": 0.0039, "percentile": 0.31761 }, "nvd": { "published": "2026-07-22T18:17:06.047", "lastModified": "2026-07-22T20:50:36.493", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65650", "family": "RESOURCE_CONTROL", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Elgg accepts attacker-driven work or allocation without an effective size, rate, release, or termination bound.", "basis": [ "CNA", "CWE-770" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/Elgg/Elgg/compare/7.0.0-rc.1...7.0.0", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/Elgg/Elgg/commit/ab91d59dc2caaa3fdbfe7e9b916fc0cc7e6b323a", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] }, { "url": "https://github.com/Elgg/Elgg/pull/15041", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [] } ], "record_shape": { "descriptionChars": 105, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65687", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.979Z", "date_published": "2026-07-23T13:24:44.107Z", "date_updated": "2026-07-24T14:32:12.957Z", "publisher": "VulnCheck", "title": "Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processing", "affected": { "vendors": [ "Bold Reports (By SyncFusion)" ], "products": [ { "vendor": "Bold Reports (By SyncFusion)", "product": "Standalone Report Designer" } ], "affectedBlockCount": 1, "versionEntryCount": 8, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00581, "percentile": 0.4449 }, "nvd": { "published": "2026-07-23T14:18:02.993", "lastModified": "2026-07-28T15:57:12.643", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65687", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "SVG processing accepts an unauthenticated file path without confining it to an allowed report directory.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12", "host": "www.boldreports.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "release-notes" ] }, { "url": "https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-arbitrary-file-read-via-svg-processing", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 583, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-65688", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.979Z", "date_published": "2026-07-23T13:25:42.187Z", "date_updated": "2026-07-24T14:32:24.855Z", "publisher": "VulnCheck", "title": "Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Font Processing", "affected": { "vendors": [ "Bold Reports (By SyncFusion)" ], "products": [ { "vendor": "Bold Reports (By SyncFusion)", "product": "Standalone Report Designer" } ], "affectedBlockCount": 1, "versionEntryCount": 8, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00594, "percentile": 0.45039 }, "nvd": { "published": "2026-07-23T14:18:03.163", "lastModified": "2026-07-28T15:56:12.793", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65688", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "A traversal path selects an arbitrary file outside the intended root for reading.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12", "host": "www.boldreports.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "release-notes" ] }, { "url": "https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-arbitrary-file-read-via-font-processing", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 584, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-65689", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.979Z", "date_published": "2026-07-23T13:28:35.327Z", "date_updated": "2026-07-27T16:20:25.316Z", "publisher": "VulnCheck", "title": "Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download", "affected": { "vendors": [ "Bold Reports (By SyncFusion)" ], "products": [ { "vendor": "Bold Reports (By SyncFusion)", "product": "Standalone Report Designer" } ], "affectedBlockCount": 1, "versionEntryCount": 8, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00581, "percentile": 0.4449 }, "nvd": { "published": "2026-07-23T14:18:03.340", "lastModified": "2026-07-28T15:55:34.947", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65689", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The unauthenticated database-download feature accepts a traversal path and reads the selected file outside its intended directory.", "basis": [ "CNA record", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12", "host": "www.boldreports.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "release-notes" ] }, { "url": "https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-arbitrary-file-read-via-database-download", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 586, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-65690", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.979Z", "date_published": "2026-07-23T13:30:16.990Z", "date_updated": "2026-07-24T14:34:37.299Z", "publisher": "VulnCheck", "title": "Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload", "affected": { "vendors": [ "Bold Reports (By SyncFusion)" ], "products": [ { "vendor": "Bold Reports (By SyncFusion)", "product": "Standalone Report Designer" } ], "affectedBlockCount": 1, "versionEntryCount": 8, "versionRangeCount": 0, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.10000000000000142, "epss": { "score": 0.00599, "percentile": 0.45324 }, "nvd": { "published": "2026-07-23T14:18:03.503", "lastModified": "2026-07-28T15:55:00.480", "vulnStatus": "Analyzed", "hasConfigurations": true }, "cause_review": { "cveId": "CVE-2026-65690", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Standalone Report Designer accepts an attacker-controlled path that can resolve outside the intended directory.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.boldreports.com/resources/release-history/standalone-report-designer/14-1#14-1-12", "host": "www.boldreports.com", "sources": [ "cna", "nvd" ], "tags": [ "Release Notes", "release-notes" ] }, { "url": "https://www.vulncheck.com/advisories/bold-reports-standalone-report-designer-path-traversal-rce-via-file-upload", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "Third Party Advisory", "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 515, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 8 } }, { "cve_id": "CVE-2026-65693", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.979Z", "date_published": "2026-07-24T15:33:35.973Z", "date_updated": "2026-07-28T01:06:10.301Z", "publisher": "VulnCheck", "title": "Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates", "affected": { "vendors": [ "microweber" ], "products": [ { "vendor": "microweber", "product": "microweber" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.6, "cvss_source_score_spread": 1.3999999999999995, "epss": { "score": 0.00484, "percentile": 0.391 }, "nvd": { "published": "2026-07-24T16:16:55.360", "lastModified": "2026-07-28T20:37:39.353", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65693", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Microweber renders stored administrator mail templates in an unsandboxed Twig environment that exposes command-capable filters.", "basis": [ "CNA", "CWE-94" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://gist.github.com/W40X/584f4b088d310bc5280cc74bbf97831a", "host": "gist.github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/microweber-cms-server-side-template-injection-via-mail-templates", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 570, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65694", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.979Z", "date_published": "2026-07-23T21:20:29.159Z", "date_updated": "2026-07-28T01:06:10.984Z", "publisher": "VulnCheck", "title": "Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController", "affected": { "vendors": [ "microweber" ], "products": [ { "vendor": "microweber", "product": "microweber" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 1.1999999999999993, "epss": { "score": 0.02456, "percentile": 0.8283 }, "nvd": { "published": "2026-07-23T22:16:53.313", "lastModified": "2026-07-30T19:56:33.480", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65694", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "ServeStaticFileController passes path query traversal through normalize_path and reads files outside the static-file root.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/microweber/microweber/pull/1181", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "patch", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/microweber-cms-path-traversal-via-servestaticfilecontroller", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 482, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65695", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.979Z", "date_published": "2026-07-23T16:20:44.117Z", "date_updated": "2026-07-23T18:05:41.254Z", "publisher": "VulnCheck", "title": "Office-Word-MCP-Server 1.1.11 Path Traversal via document tools", "affected": { "vendors": [ "GongRzhe" ], "products": [ { "vendor": "GongRzhe", "product": "Office-Word-MCP-Server" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 7.6, "cvss_source_score_spread": 0.7999999999999998, "epss": { "score": 0.00321, "percentile": 0.24546 }, "nvd": { "published": "2026-07-23T17:16:29.610", "lastModified": "2026-07-23T19:17:04.857", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65695", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "An attacker-controlled path is used without confinement to the intended directory, allowing file access outside that namespace.", "basis": [ "CNA record", "NVD", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/geo-chen/oss/blob/main/Office-Word-MCP-Server.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/office-word-mcp-server-path-traversal-via-document-tools", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 514, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65696", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.979Z", "date_published": "2026-07-23T16:24:27.966Z", "date_updated": "2026-07-23T17:44:18.635Z", "publisher": "VulnCheck", "title": "Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API", "affected": { "vendors": [ "sct" ], "products": [ { "vendor": "sct", "product": "overseerr" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 5.4, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 5.4, "cvss_source_score_spread": 0.10000000000000053, "epss": { "score": 0.00164, "percentile": 0.06053 }, "nvd": { "published": "2026-07-23T17:16:29.763", "lastModified": "2026-07-23T18:17:01.017", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65696", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Push-subscription handlers trust an arbitrary userId path value without an ownership check, allowing one user to list, read, or delete another user's records.", "basis": [ "CNA", "NVD", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/geo-chen/oss/blob/main/overseerr.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/overseerr-authorization-bypass-via-pushsubscriptions-api", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 487, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65697", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.979Z", "date_published": "2026-07-23T16:29:20.087Z", "date_updated": "2026-07-23T18:12:34.036Z", "publisher": "VulnCheck", "title": "Fathom Lite 1.3.1 Stored XSS via /collect Endpoint", "affected": { "vendors": [ "usefathom" ], "products": [ { "vendor": "usefathom", "product": "fathom" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 1, "epss": { "score": 0.0016, "percentile": 0.05683 }, "nvd": { "published": "2026-07-23T17:16:29.907", "lastModified": "2026-07-23T19:17:05.020", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65697", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The fathom rendering path places attacker-controlled data into executable browser markup without context-appropriate neutralization.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/geo-chen/oss/blob/main/fathom.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/fathom-lite-stored-xss-via-collect-endpoint", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 651, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65698", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.980Z", "date_published": "2026-07-23T16:37:42.944Z", "date_updated": "2026-07-24T22:00:16.889Z", "publisher": "VulnCheck", "title": "Void 1.3.4 Path Traversal via AI Agent File-Reading Tools", "affected": { "vendors": [ "voideditor" ], "products": [ { "vendor": "voideditor", "product": "void" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 6, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 5.3, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6, "cvss_source_score_spread": 0.7000000000000002, "epss": { "score": 0.00347, "percentile": 0.27393 }, "nvd": { "published": "2026-07-23T17:16:30.050", "lastModified": "2026-07-24T23:16:51.503", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65698", "family": "FILE_OBJECT_SELECTION", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "AI file-reading tools accept absolute paths and file URIs without confining resolution to the open workspace.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/geo-chen/oss/blob/main/void.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/void-path-traversal-via-ai-agent-file-reading-tools", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 549, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65699", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.980Z", "date_published": "2026-07-23T16:59:46.107Z", "date_updated": "2026-07-23T18:17:32.104Z", "publisher": "VulnCheck", "title": "AgentGPT 1.0.0 Authorization Bypass via Agent Task Creation", "affected": { "vendors": [ "reworkd" ], "products": [ { "vendor": "reworkd", "product": "AgentGPT" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 2.3, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 4.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 2.3, "severity": "LOW", "vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 4.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L" } ], "max_cvss_observed_across_sources": 4.2, "cvss_source_score_spread": 1.9000000000000004, "epss": { "score": 0.00222, "percentile": 0.12816 }, "nvd": { "published": "2026-07-23T18:17:01.153", "lastModified": "2026-07-23T19:17:05.160", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65699", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The AgentGPT request path accepts an attacker-selected object identifier without binding that object to the caller's tenant, owner, or permitted scope.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/geo-chen/oss/blob/main/AgentGPT.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/agentgpt-authorization-bypass-via-agent-task-creation", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 586, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65700", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.980Z", "date_published": "2026-07-23T17:02:24.458Z", "date_updated": "2026-07-27T16:19:50.766Z", "publisher": "VulnCheck", "title": "h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API", "affected": { "vendors": [ "h2oai" ], "products": [ { "vendor": "h2oai", "product": "h2ogpt" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.8, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 9.8, "cvss_source_score_spread": 0.5, "epss": { "score": 0.01269, "percentile": 0.66911 }, "nvd": { "published": "2026-07-23T18:17:01.327", "lastModified": "2026-07-27T17:16:40.310", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65700", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "h2oGPT uses the bearer token as an unsanitized path component, allowing file API operations to escape the intended user directory.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/geo-chen/oss/blob/main/h2ogpt.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/h2ogpt-path-traversal-via-openai-compatible-files-api", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 690, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65701", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.980Z", "date_published": "2026-07-23T17:05:47.594Z", "date_updated": "2026-07-23T18:04:13.633Z", "publisher": "VulnCheck", "title": "SoftVC VITS Singing Voice Conversion Path Traversal via /wav2wav Flask Route", "affected": { "vendors": [ "svc-develop-team" ], "products": [ { "vendor": "svc-develop-team", "product": "so-vits-svc" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 9.1, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0.20000000000000107, "epss": { "score": 0.00582, "percentile": 0.44537 }, "nvd": { "published": "2026-07-23T18:17:01.480", "lastModified": "2026-07-23T19:17:05.310", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65701", "family": "FILE_OBJECT_SELECTION", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audio_path field of an unauthenticated POST request to the /wav2wav route.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/geo-chen/oss/blob/main/so-vits-svc.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/softvc-vits-singing-voice-conversion-path-traversal-via-wav2wav-flask-route", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 643, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65702", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.980Z", "date_published": "2026-07-23T17:09:37.574Z", "date_updated": "2026-07-23T17:43:42.379Z", "publisher": "VulnCheck", "title": "Vanna 2.0.2 Path Traversal via FileSystemConversationStore", "affected": { "vendors": [ "vanna-ai" ], "products": [ { "vendor": "vanna-ai", "product": "vanna" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.8, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.8, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Primary", "version": "3.1", "score": 8.6, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L" } ], "max_cvss_observed_across_sources": 8.8, "cvss_source_score_spread": 0.20000000000000107, "epss": { "score": 0.00487, "percentile": 0.39336 }, "nvd": { "published": "2026-07-23T18:17:01.630", "lastModified": "2026-07-23T18:26:28.517", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65702", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "FileSystemConversationStore joins an attacker-controlled conversation_id without containing the result under its base directory.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/geo-chen/oss/blob/main/vanna.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/vanna-path-traversal-via-filesystemconversationstore", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 631, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65703", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.980Z", "date_published": "2026-07-23T18:52:19.441Z", "date_updated": "2026-07-28T01:06:11.716Z", "publisher": "VulnCheck", "title": "FFmpeg 2.7 - 8.1.2 Out-of-Bounds Write in TDSC Video Decoder", "affected": { "vendors": [ "FFmpeg" ], "products": [ { "vendor": "FFmpeg", "product": "FFmpeg" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 0.7000000000000002, "epss": { "score": 0.00207, "percentile": 0.10902 }, "nvd": { "published": "2026-07-23T20:17:21.803", "lastModified": "2026-07-27T20:34:24.887", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65703", "family": "MEMORY_LIFETIME", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "tdsc_parse_tdsf() keeps an undersized reference frame across a dimension change, so later pixel conversion writes beyond that frame's heap buffer.", "basis": [ "CNA", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 554, "referenceCount": 3, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65704", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.981Z", "date_published": "2026-07-23T18:55:41.842Z", "date_updated": "2026-07-28T01:06:12.410Z", "publisher": "VulnCheck", "title": "FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder", "affected": { "vendors": [ "FFmpeg" ], "products": [ { "vendor": "FFmpeg", "product": "FFmpeg" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00126, "percentile": 0.02681 }, "nvd": { "published": "2026-07-23T20:17:21.973", "lastModified": "2026-07-27T20:34:24.887", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65704", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "FFmpeg subtracts an attacker-influenced value without rejecting underflow and uses the wrapped result in a memory operation.", "basis": [ "CNA", "CWE-191", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23767", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-via-ty-demuxer-and-shorten-decoder", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 527, "referenceCount": 3, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65705", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.981Z", "date_published": "2026-07-23T19:00:36.133Z", "date_updated": "2026-07-28T01:06:13.065Z", "publisher": "VulnCheck", "title": "FFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame()", "affected": { "vendors": [ "FFmpeg" ], "products": [ { "vendor": "FFmpeg", "product": "FFmpeg" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-131", "name": "Incorrect Calculation of Buffer Size", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.3, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 7.8, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00133, "percentile": 0.03223 }, "nvd": { "published": "2026-07-23T20:17:22.120", "lastModified": "2026-07-27T20:34:24.887", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65705", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "vf_floodfill allocates its traversal stack for the initial frame dimensions and reuses it when a later frame is larger, so neighbor pushes exceed the allocation.", "basis": [ "CNA", "CWE-131", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ffmpeg-vf-floodfill-out-of-bounds-write-via-filter-frame", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 623, "referenceCount": 3, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65706", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.981Z", "date_published": "2026-07-23T19:05:11.560Z", "date_updated": "2026-07-28T01:06:13.738Z", "publisher": "VulnCheck", "title": "FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing", "affected": { "vendors": [ "FFmpeg" ], "products": [ { "vendor": "FFmpeg", "product": "FFmpeg" } ], "affectedBlockCount": 1, "versionEntryCount": 2, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-131", "name": "Incorrect Calculation of Buffer Size", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-787", "name": "Out-of-bounds Write", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.8, "severity": "HIGH", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 0.7000000000000002, "epss": { "score": 0.00133, "percentile": 0.03222 }, "nvd": { "published": "2026-07-23T20:17:22.257", "lastModified": "2026-07-27T20:34:24.887", "vulnStatus": "Undergoing Analysis", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65706", "family": "MEMORY_LIFETIME", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "vf_swaprect reuses a temporary row buffer sized for the one-byte luma plane when copying the two-byte interleaved chroma plane.", "basis": [ "CNA", "CWE-131", "CWE-787" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "issue-tracking" ] }, { "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527", "host": "code.ffmpeg.org", "sources": [ "cna", "nvd" ], "tags": [ "patch" ] }, { "url": "https://www.vulncheck.com/advisories/ffmpeg-vf-swaprect-out-of-bounds-write-via-nv12-frame-processing", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 569, "referenceCount": 3, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65707", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.981Z", "date_published": "2026-07-24T15:43:35.413Z", "date_updated": "2026-07-28T01:06:14.405Z", "publisher": "VulnCheck", "title": "Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint", "affected": { "vendors": [ "likeadmin-likeshop" ], "products": [ { "vendor": "likeadmin-likeshop", "product": "likeshop" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.5, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.5, "cvss_source_score_spread": 2, "epss": { "score": 0.00266, "percentile": 0.18357 }, "nvd": { "published": "2026-07-24T17:17:34.290", "lastModified": "2026-07-28T16:07:15.840", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65707", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "adjustAccount concatenates money, integral, growth, and earnings values into Db::raw SQL fragments without validation or binding.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://gist.github.com/peoz14/794521dc40f5bb7e6a6ec6630d894be6", "host": "gist.github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/likeshop-authenticated-sql-injection-via-adjustaccount-endpoint", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 568, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65708", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.981Z", "date_published": "2026-07-24T15:57:26.326Z", "date_updated": "2026-07-28T01:06:15.083Z", "publisher": "VulnCheck", "title": "sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController", "affected": { "vendors": [ "nuxsmin" ], "products": [ { "vendor": "nuxsmin", "product": "sysPass" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.6, "cvss_source_score_spread": 0.5, "epss": { "score": 0.00221, "percentile": 0.12767 }, "nvd": { "published": "2026-07-24T17:17:34.433", "lastModified": "2026-07-27T20:36:13.407", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65708", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "AccountFileController accepts a numeric attachment ID without checking the caller's ACL on the owning account.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/Caycon/cve-advisories/blob/main/2026/sysPass/CVE-2026-65708.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/syspass-insecure-direct-object-reference-via-accountfilecontroller", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 507, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65709", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.981Z", "date_published": "2026-07-24T15:59:26.627Z", "date_updated": "2026-07-28T01:06:15.783Z", "publisher": "VulnCheck", "title": "sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API", "affected": { "vendors": [ "nuxsmin" ], "products": [ { "vendor": "nuxsmin", "product": "sysPass" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 8.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 8.3, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 0.3999999999999986, "epss": { "score": 0.00223, "percentile": 0.13029 }, "nvd": { "published": "2026-07-24T17:17:34.573", "lastModified": "2026-07-27T20:36:13.407", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65709", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "JSON-RPC AccountController methods act on caller-selected account IDs without applying AccountFilterUser to bind each account to the token's permitted scope.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/Caycon/cve-advisories/blob/main/2026/sysPass/CVE-2026-65709.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/syspass-missing-object-level-authorization-via-json-rpc-api", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 500, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65710", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.982Z", "date_published": "2026-07-24T16:00:50.584Z", "date_updated": "2026-07-28T01:06:16.444Z", "publisher": "VulnCheck", "title": "sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption", "affected": { "vendors": [ "nuxsmin" ], "products": [ { "vendor": "nuxsmin", "product": "sysPass" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 7.1, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N" } ], "max_cvss_observed_across_sources": 7.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00178, "percentile": 0.07505 }, "nvd": { "published": "2026-07-24T17:17:34.713", "lastModified": "2026-07-27T20:36:13.407", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65710", "family": "AUTHORITY_BINDING", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Public-link creation decrypts the account selected by caller-controlled ID without applying the selected account ACL.", "basis": [ "CNA", "CWE-639" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/Caycon/cve-advisories/blob/main/2026/sysPass/CVE-2026-65710.md", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/syspass-missing-authorization-via-publiclinkcontroller-account-decryption", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 718, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65711", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:26:09.982Z", "date_published": "2026-07-24T16:12:57.797Z", "date_updated": "2026-07-28T01:06:17.122Z", "publisher": "VulnCheck", "title": "sysPass 3.2.11 Authenticated OS Command Injection via Backup Path", "affected": { "vendors": [ "nuxsmin" ], "products": [ { "vendor": "nuxsmin", "product": "sysPass" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 1, "defaultStatuses": [ "affected" ] }, "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "cna", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "4.0", "score": 8.6, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" }, { "source": "NVD:disclosure@vulncheck.com", "type": "Secondary", "version": "3.1", "score": 7.2, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "max_cvss_observed_across_sources": 8.6, "cvss_source_score_spread": 1.3999999999999995, "epss": { "score": 0.02406, "percentile": 0.82436 }, "nvd": { "published": "2026-07-24T17:17:34.857", "lastModified": "2026-07-27T20:36:13.407", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65711", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "FileBackupService concatenates the configured backup path into a tar command and passes it to exec without shell escaping.", "basis": [ "CNA", "CWE-78" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://gist.github.com/sermikr0/16bcbc799dc33d39d5714db9bbcbdb77", "host": "gist.github.com", "sources": [ "cna", "nvd" ], "tags": [ "exploit", "technical-description" ] }, { "url": "https://www.vulncheck.com/advisories/syspass-authenticated-os-command-injection-via-backup-path", "host": "www.vulncheck.com", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 536, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 4, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65712", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:27:32.365Z", "date_published": "2026-07-23T09:11:52.342Z", "date_updated": "2026-07-25T05:32:00.664Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "CDN for Joomla Pro extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.2, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 6.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00145, "percentile": 0.04258 }, "nvd": { "published": "2026-07-23T10:16:52.820", "lastModified": "2026-07-24T20:18:19.980", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65712", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The file operation in CDN for Joomla Pro extension for Joomla uses an attacker-controlled path without confining the resolved object to the intended namespace.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 216, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65713", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:27:32.366Z", "date_published": "2026-07-23T09:15:13.463Z", "date_updated": "2026-07-25T05:35:22.795Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Modals Pro extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.5, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00224, "percentile": 0.13079 }, "nvd": { "published": "2026-07-23T10:16:52.930", "lastModified": "2026-07-24T20:18:20.123", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65713", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Modals Pro extension for Joomla allows attacker-controlled path or filename components to escape the intended directory or select a different file object than the operation was authorized to access.", "basis": [ "CNA", "NVD", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 146, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65754", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:46:13.953Z", "date_published": "2026-07-23T09:13:56.352Z", "date_updated": "2026-07-29T05:39:51.063Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "ReReplacer PRo extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00335, "percentile": 0.26109 }, "nvd": { "published": "2026-07-23T10:16:53.037", "lastModified": "2026-07-28T16:20:09.080", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65754", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "ReReplacer accepts an XML include path that resolves outside the Joomla site directory.", "basis": [ "CNA", "NVD", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 163, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65755", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:46:13.953Z", "date_published": "2026-07-23T09:14:11.923Z", "date_updated": "2026-07-29T05:40:11.634Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Articles Anywhere extension for Joomla" }, { "vendor": "regularlabs.com", "product": "Users Anywhere extension for Joomla" } ], "affectedBlockCount": 2, "versionEntryCount": 2, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-524", "name": "Use of Cache Containing Sensitive Information", "abstraction": "Base", "status": "Incomplete", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "max_cvss_observed_across_sources": 7.5, "cvss_source_score_spread": 0, "epss": { "score": 0.00245, "percentile": 0.15774 }, "nvd": { "published": "2026-07-23T10:16:53.143", "lastModified": "2026-07-28T16:20:09.810", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65755", "family": "STATE_SEQUENCE", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The query-cache key omits a bounded time component, allowing an old result to remain valid after a publication or expiry boundary.", "basis": [ "CNA", "NVD", "CWE-524" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 344, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 2, "affectedVersionEntryCount": 2 } }, { "cve_id": "CVE-2026-65756", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:46:13.953Z", "date_published": "2026-07-23T09:11:48.636Z", "date_updated": "2026-07-24T07:17:56.388Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Keyboard Shortcuts extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 6.1, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "max_cvss_observed_across_sources": 6.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00149, "percentile": 0.04573 }, "nvd": { "published": "2026-07-23T10:16:53.253", "lastModified": "2026-07-23T20:17:22.407", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65756", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Shortcut configuration accepts attacker-controlled inline JavaScript and executes it in the application context.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 142, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65757", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:46:13.953Z", "date_published": "2026-07-23T09:14:12.872Z", "date_updated": "2026-07-25T05:34:17.823Z", "publisher": "Joomla", "title": "Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension", "affected": { "vendors": [ "regularlabs.com" ], "products": [ { "vendor": "regularlabs.com", "product": "Modules Anywhere extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "abstraction": "Compound", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "adp:0", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": "NVD:134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "version": "3.1", "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "max_cvss_observed_across_sources": 8.1, "cvss_source_score_spread": 0, "epss": { "score": 0.0013, "percentile": 0.03059 }, "nvd": { "published": "2026-07-23T10:16:53.353", "lastModified": "2026-07-24T20:18:20.277", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65757", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "The Modules Anywhere editor popup returns restricted module data without consistently enforcing module permission and request-token checks.", "basis": [ "CNA", "CWE-284", "CWE-352" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://regularlabs.com/", "host": "regularlabs.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 259, "referenceCount": 1, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65758", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:46:13.953Z", "date_published": "2026-07-23T09:24:44.471Z", "date_updated": "2026-07-24T07:16:36.665Z", "publisher": "Joomla", "title": "Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2", "affected": { "vendors": [ "tassos.gr" ], "products": [ { "vendor": "tassos.gr", "product": "Convert Forms extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:security@joomla.org", "type": "Secondary", "version": "4.0", "score": 8.2, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 8.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00197, "percentile": 0.09615 }, "nvd": { "published": "2026-07-23T10:16:53.467", "lastModified": "2026-07-23T20:17:22.560", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65758", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Convert Forms exposes its front-end Submissions view without enforcing the access control required to list form submissions.", "basis": [ "CNA", "CWE-200", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.tassos.gr/joomla-extensions/convert-forms", "host": "www.tassos.gr", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 228, "referenceCount": 1, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65759", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:46:13.953Z", "date_published": "2026-07-23T16:42:54.627Z", "date_updated": "2026-07-24T07:20:09.614Z", "publisher": "Joomla", "title": "Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1", "affected": { "vendors": [ "joomshaper.com" ], "products": [ { "vendor": "joomshaper.com", "product": "Easy Store extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "source": "NVD:security@joomla.org", "type": "Secondary", "version": "4.0", "score": 8.7, "severity": "HIGH", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 8.7, "cvss_source_score_spread": 0, "epss": { "score": 0.00257, "percentile": 0.17282 }, "nvd": { "published": "2026-07-23T17:16:30.190", "lastModified": "2026-07-23T20:17:22.667", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65759", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "medium", "mechanism": "Easy Store accepts client-supplied payment and order states without binding them to a server-verified payment result or order owner.", "basis": [ "CNA", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.joomshaper.com/easystore", "host": "www.joomshaper.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://mysites.guru/blog/easystore-security-disclosure/", "host": "mysites.guru", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 303, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65760", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:46:13.953Z", "date_published": "2026-07-23T16:38:21.882Z", "date_updated": "2026-07-24T07:15:33.699Z", "publisher": "Joomla", "title": "Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1", "affected": { "vendors": [ "joomshaper.com" ], "products": [ { "vendor": "joomshaper.com", "product": "Easy Store extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-284", "name": "Improper Access Control", "abstraction": "Pillar", "status": "Incomplete", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" }, { "source": "NVD:security@joomla.org", "type": "Secondary", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00249, "percentile": 0.1628 }, "nvd": { "published": "2026-07-23T17:16:30.310", "lastModified": "2026-07-23T20:17:22.780", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65760", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.", "basis": [ "CNA", "CWE-200", "CWE-284" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.joomshaper.com/easystore", "host": "www.joomshaper.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://mysites.guru/blog/easystore-security-disclosure/", "host": "mysites.guru", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 246, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65761", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:46:13.953Z", "date_published": "2026-07-23T16:38:58.787Z", "date_updated": "2026-07-24T07:16:11.356Z", "publisher": "Joomla", "title": "Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1", "affected": { "vendors": [ "joomshaper.com" ], "products": [ { "vendor": "joomshaper.com", "product": "Easy Store extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "source": "NVD:security@joomla.org", "type": "Secondary", "version": "4.0", "score": 9.3, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.3, "cvss_source_score_spread": 0, "epss": { "score": 0.00237, "percentile": 0.1476 }, "nvd": { "published": "2026-07-23T17:16:30.433", "lastModified": "2026-07-23T20:17:22.897", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65761", "family": "INTERPRETER_BOUNDARY", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "EasyStore returns an unchecked filter_sortby direction from FilterHelper.php and concatenates it into ProductsModel.php's ORDER BY clause.", "basis": [ "CNA", "CWE-89", "https://mysites.guru/blog/easystore-security-disclosure/" ], "deepDive": true, "notes": "Reviewed https://mysites.guru/blog/easystore-security-disclosure/. The discoverer's report identifies filter_sortby, FilterHelper.php:741, ProductsModel.php:923, and the ASC/DESC allowlist fix, but the proprietary source was not independently inspected." }, "references": [ { "url": "https://www.joomshaper.com/easystore", "host": "www.joomshaper.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://mysites.guru/blog/easystore-security-disclosure/", "host": "mysites.guru", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 263, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65762", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:46:13.953Z", "date_published": "2026-07-23T17:01:04.967Z", "date_updated": "2026-07-24T07:20:31.602Z", "publisher": "Joomla", "title": "Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0", "affected": { "vendors": [ "phoca.cz" ], "products": [ { "vendor": "phoca.cz", "product": "Phoca Guestbook extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:security@joomla.org", "type": "Secondary", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 5.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00339, "percentile": 0.26488 }, "nvd": { "published": "2026-07-23T18:17:01.903", "lastModified": "2026-07-24T08:16:27.293", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65762", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled content reaches an HTML, SVG or DOM output context without context-appropriate escaping, so the browser can interpret it as active script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.phoca.cz/phocaguestbook", "host": "www.phoca.cz", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 165, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65763", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:46:13.953Z", "date_published": "2026-07-23T16:57:49.345Z", "date_updated": "2026-07-24T07:17:15.853Z", "publisher": "Joomla", "title": "Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4", "affected": { "vendors": [ "phoca.cz" ], "products": [ { "vendor": "phoca.cz", "product": "Phoca Maps extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:security@joomla.org", "type": "Secondary", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 5.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00339, "percentile": 0.26489 }, "nvd": { "published": "2026-07-23T18:17:02.023", "lastModified": "2026-07-24T08:16:27.413", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65763", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The application renders attacker-controlled content into an HTML or JavaScript context without context-appropriate output encoding.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.phoca.cz/phocamaps", "host": "www.phoca.cz", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 160, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65764", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:46:13.953Z", "date_published": "2026-07-27T07:57:38.356Z", "date_updated": "2026-07-27T12:56:14.032Z", "publisher": "Joomla", "title": "Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1", "affected": { "vendors": [ "phoca.cz" ], "products": [ { "vendor": "phoca.cz", "product": "Phoca Commander extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" }, { "source": "NVD:security@joomla.org", "type": "Secondary", "version": "4.0", "score": 5.1, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 5.1, "cvss_source_score_spread": 0, "epss": { "score": 0.00318, "percentile": 0.24181 }, "nvd": { "published": "2026-07-27T09:16:37.790", "lastModified": "2026-07-27T20:32:11.620", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65764", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "User-controlled content reaches Phoca Commander extension for Joomla page output without context-appropriate sanitization or escaping, so the browser interprets it as script.", "basis": [ "CNA", "CWE-79" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.phoca.cz/phocacommander", "host": "www.phoca.cz", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 165, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65765", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:46:13.953Z", "date_published": "2026-07-27T08:01:19.270Z", "date_updated": "2026-07-27T12:59:43.593Z", "publisher": "Joomla", "title": "Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.1", "affected": { "vendors": [ "phoca.cz" ], "products": [ { "vendor": "phoca.cz", "product": "Phoca Commander extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" }, { "source": "NVD:security@joomla.org", "type": "Secondary", "version": "4.0", "score": 6.9, "severity": "MEDIUM", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 6.9, "cvss_source_score_spread": 0, "epss": { "score": 0.00347, "percentile": 0.2736 }, "nvd": { "published": "2026-07-27T09:16:37.923", "lastModified": "2026-07-27T20:32:11.620", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65765", "family": "FILE_OBJECT_SELECTION", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Phoca Commander save and download actions do not confine caller-selected paths to their intended directory.", "basis": [ "CNA", "CWE-22" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.phoca.cz/phocacommander", "host": "www.phoca.cz", "sources": [ "cna", "nvd" ], "tags": [ "product" ] } ], "record_shape": { "descriptionChars": 190, "referenceCount": 1, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65766", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T20:46:13.953Z", "date_published": "2026-07-27T12:55:11.623Z", "date_updated": "2026-07-28T05:31:25.460Z", "publisher": "Joomla", "title": "Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1", "affected": { "vendors": [ "joomshaper.com" ], "products": [ { "vendor": "joomshaper.com", "product": "SP Page Builder extension for Joomla" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [ "unaffected" ] }, "cwes": [ { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "abstraction": "Base", "status": "Stable", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N" }, { "source": "NVD:security@joomla.org", "type": "Secondary", "version": "4.0", "score": 9.2, "severity": "CRITICAL", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "max_cvss_observed_across_sources": 9.2, "cvss_source_score_spread": 0, "epss": { "score": 0.00237, "percentile": 0.1476 }, "nvd": { "published": "2026-07-27T14:17:00.533", "lastModified": "2026-07-27T21:17:16.120", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65766", "family": "INTERPRETER_BOUNDARY", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "Attacker-controlled input reaches an SQL statement without separation from SQL grammar.", "basis": [ "CNA", "CWE-89" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://www.joomshaper.com/page-builder", "host": "www.joomshaper.com", "sources": [ "cna", "nvd" ], "tags": [ "product" ] }, { "url": "https://mysites.guru/blog/sp-page-builder-sql-injection-mail-relay-disclosure/", "host": "mysites.guru", "sources": [ "cna", "nvd" ], "tags": [ "third-party-advisory" ] } ], "record_shape": { "descriptionChars": 201, "referenceCount": 2, "cweCount": 1, "cnaCweCount": 1, "adpCweCount": 0, "nvdCweCount": 1, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65834", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T23:16:47.753Z", "date_published": "2026-07-30T19:48:55.027Z", "date_updated": "2026-07-31T11:29:43.998Z", "publisher": "GitHub_M", "title": "Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests", "affected": { "vendors": [ "projectcapsule" ], "products": [ { "vendor": "projectcapsule", "product": "capsule" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-20", "name": "Improper Input Validation", "abstraction": "Class", "status": "Stable", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-248", "name": "Uncaught Exception", "abstraction": "Base", "status": "Draft", "mappingUsage": "Allowed", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "3.1", "score": 6.8, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H" } ], "max_cvss_observed_across_sources": 6.8, "cvss_source_score_spread": 0, "epss": { "score": 0.00266, "percentile": 0.18625 }, "nvd": { "published": "2026-07-30T20:18:13.107", "lastModified": "2026-07-31T12:16:53.700", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65834", "family": "OTHER_SPECIFIC", "precision": "SPECIFIC_RECORD", "confidence": "high", "mechanism": "The admission webhook accepts a malformed regex that later reaches regexp.MustCompile as an uncaught exception and terminates node admission handling.", "basis": [ "CNA record", "CWE-248" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-68cj-mvg9-rgm2", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "x_refsource_CONFIRM" ] }, { "url": "https://github.com/projectcapsule/capsule/releases/tag/v0.13.8", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 563, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65835", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T23:16:47.753Z", "date_published": "2026-07-30T19:53:52.769Z", "date_updated": "2026-07-31T19:17:25.535Z", "publisher": "GitHub_M", "title": "Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)", "affected": { "vendors": [ "projectcapsule" ], "products": [ { "vendor": "projectcapsule", "product": "capsule" } ], "affectedBlockCount": 1, "versionEntryCount": 1, "versionRangeCount": 0, "defaultStatuses": [] }, "cwes": [ { "id": "CWE-269", "name": "Improper Privilege Management", "abstraction": "Class", "status": "Draft", "mappingUsage": "Discouraged", "provenance": [ "cna", "nvd" ] }, { "id": "CWE-863", "name": "Incorrect Authorization", "abstraction": "Class", "status": "Incomplete", "mappingUsage": "Allowed-with-Review", "provenance": [ "cna", "nvd" ] } ], "cvss": [ { "source": "cna", "version": "3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L" }, { "source": "NVD:security-advisories@github.com", "type": "Secondary", "version": "3.1", "score": 6.6, "severity": "MEDIUM", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L" } ], "max_cvss_observed_across_sources": 6.6, "cvss_source_score_spread": 0, "epss": { "score": 0.00192, "percentile": 0.09125 }, "nvd": { "published": "2026-07-30T20:18:13.267", "lastModified": "2026-07-31T20:16:53.843", "vulnStatus": "Deferred", "hasConfigurations": false }, "cause_review": { "cveId": "CVE-2026-65835", "family": "AUTHORITY_BINDING", "precision": "DESCRIPTION_SPECIFIC", "confidence": "high", "mechanism": "TenantResource RawItems and Generators omit the namespaced-kind guard and let a tenant owner create cluster-scoped resources through a cluster-admin client.", "basis": [ "CNA", "CWE-269", "CWE-863" ], "deepDive": false, "notes": "" }, "references": [ { "url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-jr6p-8pjj-mfx6", "host": "github.com", "sources": [ "adp:0", "cna", "nvd" ], "tags": [ "exploit", "x_refsource_CONFIRM" ] }, { "url": "https://github.com/projectcapsule/capsule/releases/tag/v0.13.8", "host": "github.com", "sources": [ "cna", "nvd" ], "tags": [ "x_refsource_MISC" ] } ], "record_shape": { "descriptionChars": 602, "referenceCount": 2, "cweCount": 2, "cnaCweCount": 2, "adpCweCount": 0, "nvdCweCount": 2, "cvssCount": 2, "affectedProductCount": 1, "affectedVersionEntryCount": 1 } }, { "cve_id": "CVE-2026-65841", "id_year": 2026, "state": "PUBLISHED", "date_reserved": "2026-07-22T23:16:47.753Z", "date_published": "2026-07-31T19:16:05.952Z", "date_updated": "2026-07-31T20:05:10.590Z", "publisher": "GitHub_M", "title": "Jodit has cross-site scripting (XSS) via