CWE-639

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119325",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T17:12:59.241454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T17:13:16.422Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Bricks Theme",
          "vendor": "Bricks",
          "versions": [
            {
              "lessThan": "2.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-09-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T20:34:52.827Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://bricksbuilder.io/release/bricks-2-4-1/"
        },
        {
          "name": "VulnCheck Advisory: Bricks Theme Broken Access Control via load_popup_content",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/bricks-theme-broken-access-control-via-load-popup-content"
        }
      ],
      "title": "Bricks Theme Broken Access Control via load_popup_content",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119325",
    "datePublished": "2026-10-29T20:34:52.827Z",
    "dateReserved": "2026-10-29T20:34:27.485Z",
    "dateUpdated": "2026-10-30T17:13:16.422Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119215",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T17:49:11.213752Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T17:49:28.211Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027"
          ],
          "packageName": "ash_authentication",
          "packageURL": "pkg:hex/ash_authentication",
          "product": "ash_authentication",
          "programFiles": [
            "lib/ash_authentication/strategies/totp/confirm_setup_change.ex",
            "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex",
            "lib/ash_authentication/strategies/totp/generate_secret_change.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027:change/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027:change/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027:change/3"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "5.0.0-rc.16",
              "status": "affected",
              "version": "5.0.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027",
            "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027"
          ],
          "packageName": "team-alembic/ash_authentication",
          "packageURL": "pkg:github/team-alembic/ash_authentication",
          "product": "ash_authentication",
          "programFiles": [
            "lib/ash_authentication/strategies/totp/confirm_setup_change.ex",
            "lib/ash_authentication/strategies/totp/generate_pending_setup_change.ex",
            "lib/ash_authentication/strategies/totp/generate_secret_change.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.ConfirmSetupChange\u0027:change/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GeneratePendingSetupChange\u0027:change/3"
            },
            {
              "name": "\u0027Elixir.AshAuthentication.Strategy.Totp.GenerateSecretChange\u0027:change/3"
            }
          ],
          "repo": "https://github.com/team-alembic/ash_authentication",
          "vendor": "team-alembic",
          "versions": [
            {
              "lessThan": "4058be0f519c2e9b0d2266e90f9c7d8547d54574",
              "status": "affected",
              "version": "6e7a880698614887527a87df206b4eb0c0fbd8c1",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn application exposes the TOTP \u003ccode\u003esetup\u003c/code\u003e or \u003ccode\u003econfirm_setup\u003c/code\u003e action on a record the caller identifies, for example through AshJsonApi, AshGraphql or a controller that passes a looked-up user to \u003ccode\u003eAshAuthentication.Strategy.Totp.Actions.confirm_setup/3\u003c/code\u003e, and the attacker can read the victim\u0027s user record. Installing the attacker\u0027s secret requires \u003ccode\u003econfirm_setup_enabled? true\u003c/code\u003e; signing in with it alone requires \u003ccode\u003esign_in_enabled? true\u003c/code\u003e. The routes AshAuthentication and AshAuthenticationPhoenix provide always use the signed-in user and are not affected.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "An application exposes the TOTP `setup` or `confirm_setup` action on a record the caller identifies, for example through AshJsonApi, AshGraphql or a controller that passes a looked-up user to `AshAuthentication.Strategy.Totp.Actions.confirm_setup/3`, and the attacker can read the victim\u0027s user record. Installing the attacker\u0027s secret requires `confirm_setup_enabled? true`; signing in with it alone requires `sign_in_enabled? true`. The routes AshAuthentication and AshAuthenticationPhoenix provide always use the signed-in user and are not affected."
            }
          ],
          "value": "An application exposes the TOTP setup or confirm_setup action on a record the caller identifies, for example through AshJsonApi, AshGraphql or a controller that passes a looked-up user to AshAuthentication.Strategy.Totp.Actions.confirm_setup/3, and the attacker can read the victim\u0027s user record. Installing the attacker\u0027s secret requires confirm_setup_enabled? true; signing in with it alone requires sign_in_enabled? true. The routes AshAuthentication and AshAuthenticationPhoenix provide always use the signed-in user and are not affected."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.0.0-rc.16",
                  "versionStartIncluding": "5.0.0-rc.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "eliteaja11-dev"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "eliteaja11-dev"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        }
      ],
      "dateAssigned": "2026-11-03T03:41:55.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user\u0027s account, and then sign in as that user or hold their second factor.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAuthentication.Strategy.Totp.ConfirmSetupChange\u003c/code\u003e verified a setup token but did not check that it was issued to the record being confirmed, so an attacker\u0027s own pending secret could be confirmed onto another user\u0027s record. The TOTP setup changes, \u003ccode\u003eConfirmSetupChange\u003c/code\u003e, \u003ccode\u003eGeneratePendingSetupChange\u003c/code\u003e and \u003ccode\u003eGenerateSecretChange\u003c/code\u003e, also marked their changesets as AshAuthentication interactions, which the standard \u003ccode\u003eAshAuthenticationInteraction\u003c/code\u003e policy bypass lets through. A policy limiting \u003ccode\u003esetup\u003c/code\u003e and \u003ccode\u003econfirm_setup\u003c/code\u003e to the actor\u0027s own record therefore never ran when an application exposed those actions by record key, and a direct \u003ccode\u003esetup\u003c/code\u003e call on another user\u0027s record returned that user\u0027s pending secret and setup token.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user\u0027s account, and then sign in as that user or hold their second factor.\n\n`AshAuthentication.Strategy.Totp.ConfirmSetupChange` verified a setup token but did not check that it was issued to the record being confirmed, so an attacker\u0027s own pending secret could be confirmed onto another user\u0027s record. The TOTP setup changes, `ConfirmSetupChange`, `GeneratePendingSetupChange` and `GenerateSecretChange`, also marked their changesets as AshAuthentication interactions, which the standard `AshAuthenticationInteraction` policy bypass lets through. A policy limiting `setup` and `confirm_setup` to the actor\u0027s own record therefore never ran when an application exposed those actions by record key, and a direct `setup` call on another user\u0027s record returned that user\u0027s pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16."
            }
          ],
          "value": "Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user\u0027s account, and then sign in as that user or hold their second factor.\n\nAshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker\u0027s own pending secret could be confirmed onto another user\u0027s record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor\u0027s own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user\u0027s record returned that user\u0027s pending secret and setup token.\n\nThis issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T15:46:32.432Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "TOTP setup in AshAuthentication lets a user install their own authenticator secret on another user\u0027s account",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-gx67-694c-655c"
        },
        {
          "name": "EEF CNA record for CVE-2026-119215",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-119215.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-119215",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-119215"
        },
        {
          "name": "Introducing commit 6e7a880 in team-alembic/ash_authentication",
          "tags": [
            "related"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/6e7a880698614887527a87df206b4eb0c0fbd8c1"
        },
        {
          "name": "Fix commit 4058be0 in team-alembic/ash_authentication",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/team-alembic/ash_authentication/commit/4058be0f519c2e9b0d2266e90f9c7d8547d54574"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "AshAuthentication TOTP setup lets a user install their own authenticator secret on another user\u0027s account",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDo not expose \u003ccode\u003esetup\u003c/code\u003e or \u003ccode\u003econfirm_setup\u003c/code\u003e on a record the caller chooses. Call them through \u003ccode\u003eAshAuthentication.Strategy.Totp.Actions\u003c/code\u003e with the signed-in user, as the built-in routes do.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Do not expose `setup` or `confirm_setup` on a record the caller chooses. Call them through `AshAuthentication.Strategy.Totp.Actions` with the signed-in user, as the built-in routes do."
            }
          ],
          "value": "Do not expose setup or confirm_setup on a record the caller chooses. Call them through AshAuthentication.Strategy.Totp.Actions with the signed-in user, as the built-in routes do."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-119215",
    "datePublished": "2026-11-03T15:46:32.432Z",
    "dateReserved": "2026-11-03T03:30:01.648Z",
    "dateUpdated": "2026-11-03T17:49:28.211Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119213",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-08T18:50:22.389447Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-08T19:05:25.099Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Fluent Support \u2013 Helpdesk \u0026 Customer Support Ticket System",
          "vendor": "wpmanageninja",
          "versions": [
            {
              "lessThanOrEqual": "2.4.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Santh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Fluent Support \u2013 Helpdesk \u0026 Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer\u0027s stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by(\u0027email\u0027, ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer\u0027s stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T02:29:15.139Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5aea4f76-053d-4ce4-ae8c-7c01d7727718?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluent-support/tags/2.4.5/app/Services/Integrations/FluentForm/FeedIntegration.php#L358"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluent-support/tags/2.4.5/app/Services/Integrations/FluentForm/FeedIntegration.php#L335"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fluent-support/tags/2.4.5/app/Models/Customer.php#L126"
        },
        {
          "url": "https://wordpress.org/plugins/fluent-support/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3780020/fluent-support/trunk/app/Services/Integrations/FluentForm/FeedIntegration.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-29T16:32:55.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T13:47:32.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Fluent Support \u003c= 2.4.7 \u2014 Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-119213",
    "datePublished": "2026-11-07T02:29:15.139Z",
    "dateReserved": "2026-10-29T16:14:50.099Z",
    "dateUpdated": "2026-11-08T19:05:25.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119049",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T14:02:16.305255Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T14:02:26.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeMail",
          "repo": "https://github.com/idinging/freemail",
          "vendor": "idinging",
          "versions": [
            {
              "lessThan": "5.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iding2959"
        }
      ],
      "datePublic": "2026-10-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user\u0027s existing mailbox via the POST /api/create endpoint. Attackers who know a victim\u0027s address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T13:08:50.838Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #73",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/idinging/freemail/issues/73"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/idinging/freemail"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/idinging/freemail/commit/62ed3afdbb4de90a135c12de928e586caf01b5a1"
        },
        {
          "name": "FreeMail v5.3.2 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/idinging/freemail/releases/tag/v5.3.2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/idinging/freemail/blob/a95c1710e7eeb9f2c74a49ef962f4f43a36695b3/src/db/users.js#L137-L163"
        },
        {
          "name": "VulnCheck Advisory: FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freemail-before-5.3.2-authorization-bypass-via-api-create-mailbox-claiming"
        }
      ],
      "title": "FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119049",
    "datePublished": "2026-10-29T13:08:50.838Z",
    "dateReserved": "2026-10-29T11:51:50.482Z",
    "dateUpdated": "2026-10-29T14:02:26.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119048",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T15:30:16.499790Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T17:20:03.681Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/thinkgem/jeesite5",
          "product": "JeeSite",
          "repo": "https://github.com/thinkgem/jeesite5",
          "vendor": "thinkgem",
          "versions": [
            {
              "lessThanOrEqual": "5.19.1",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:jeesite:jeesite:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "5.19.1",
                  "versionStartIncluding": "5.11.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "ThinkGem"
        }
      ],
      "datePublic": "2026-10-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users\u0027 conversations due to missing and reversed ownership checks. Attackers who know or derive a victim\u0027s conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim\u0027s AI chat transcripts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T13:08:50.215Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #43",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/thinkgem/jeesite5/issues/43"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/thinkgem/jeesite5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/thinkgem/jeesite5/commit/cbc5ba7a37fd93f38c46ef656bd31442fe6f8015"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/thinkgem/jeesite5/blob/5b5e2cf0adc45a1abe33d0f4ca149590d149b82d/modules/ai/ai-cms/src/main/java/com/jeesite/modules/ai/cms/service/CacheChatMemoryRepository.java#L59-L62"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/thinkgem/jeesite5/blob/5b5e2cf0adc45a1abe33d0f4ca149590d149b82d/modules/ai/ai-cms/src/main/java/com/jeesite/modules/ai/cms/service/AiCmsChatService.java#L111-L116"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@hieund/jeesite5-ai-cms-chat-conversation-idor"
        },
        {
          "name": "VulnCheck Advisory: JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/jeesite-5.11.0-through-5.19.1-idor-in-ai-cms-chat-module"
        }
      ],
      "title": "JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119048",
    "datePublished": "2026-10-29T13:08:50.215Z",
    "dateReserved": "2026-10-29T11:51:50.043Z",
    "dateUpdated": "2026-10-29T17:20:03.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-119038",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T16:55:40.489951Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T16:56:31.973Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "Business::GoCardless"
          ],
          "packageName": "Business-GoCardless",
          "packageURL": "pkg:cpan/Business-GoCardless",
          "programFiles": [
            "lib/Business/GoCardless/Pro.pm",
            "lib/Business/GoCardless/Client.pm"
          ],
          "programRoutines": [
            {
              "name": "Business::GoCardless::Pro::confirm_resource"
            },
            {
              "name": "Business::GoCardless::Client::_confirm_redirect_flow"
            }
          ],
          "repo": "https://github.com/payprop/business-gocardless",
          "versions": [
            {
              "lessThan": "1.01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer\u0027s mandate.\n\nconfirm_resource takes no session token from the caller. It reads the redirect flow back from the GoCardless API and completes it with the token from that response, so the check that the flow is completed by the session that started it always passes. It then creates the requested payment or subscription against the flow\u0027s mandate. Since version 1.00, a flow that already has a mandate is returned as confirmed without being completed again, so the same ID creates a new payment on every call.\n\nA remote attacker who obtains another customer\u0027s redirect flow ID can create payments or subscriptions against that customer\u0027s mandate."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:56:46.887Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/LEEJO/Business-GoCardless-1.01/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Business-GoCardless 1.01 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer\u0027s mandate",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-119038",
    "datePublished": "2026-10-30T12:56:46.887Z",
    "dateReserved": "2026-10-29T11:38:31.745Z",
    "dateUpdated": "2026-11-06T16:56:31.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118947",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T02:02:48.372993Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T02:02:58.093Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ],
          "defaultStatus": "affected",
          "packageName": "keycloak-services",
          "product": "Red Hat Build of Keycloak",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat Build of Keycloak",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat Single Sign-On 7",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-10-28T20:58:24.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak\u0027s authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authenticated user with specific permissions to update resources they do not own by providing a target resource ID in a request. This can lead to unauthorized modification of resource configurations, such as names, URIs, and scopes."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T00:13:56.153Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-118947"
        },
        {
          "name": "RHBZ#2563274",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563274"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-28T20:58:24.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-28T20:58:24.000Z",
          "value": "Made public."
        }
      ],
      "title": "Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-639: Authorization Bypass Through User-Controlled Key"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-118947",
    "datePublished": "2026-10-30T00:13:56.153Z",
    "dateReserved": "2026-10-29T06:37:51.109Z",
    "dateUpdated": "2026-11-04T02:02:58.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118760",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T16:03:36.414605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T16:03:50.453Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pipelines",
          "vendor": "kubeflow",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.17.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an artifact location can select another tenant\u0027s namespace, or omit the namespace and reach an unguarded direct handler, to read artifact contents such as datasets, models, or pipeline outputs. The issue applies to multi-user deployments that rely on Kubeflow Pipelines authorization for tenant isolation. Authentication at ingress identifies the caller but does not authorize access to the selected artifact namespace. The issue does not establish arbitrary Kubernetes Secret disclosure, storage modification, or server-side code execution. This issue is fixed in version 2.17.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T16:35:05.192Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-vjhf-6c8f-qhwj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-vjhf-6c8f-qhwj"
        },
        {
          "name": "https://github.com/kubeflow/pipelines/issues/9889",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeflow/pipelines/issues/9889"
        },
        {
          "name": "https://github.com/kubeflow/pipelines/pull/12860",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeflow/pipelines/pull/12860"
        },
        {
          "name": "https://github.com/kubeflow/pipelines/commit/fb69119c997402ebddab4f6410c617cb3d3634ba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeflow/pipelines/commit/fb69119c997402ebddab4f6410c617cb3d3634ba"
        },
        {
          "name": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeflow/pipelines/releases/tag/2.17.0"
        }
      ],
      "source": {
        "advisory": "GHSA-vjhf-6c8f-qhwj",
        "discovery": "UNKNOWN"
      },
      "title": "Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118760",
    "datePublished": "2026-10-29T16:35:05.192Z",
    "dateReserved": "2026-10-28T19:20:05.017Z",
    "dateUpdated": "2026-11-03T16:03:50.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118668",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T15:36:58.517052Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T17:22:55.674Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "langgraph-api",
          "vendor": "langchain-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.2, \u003c 0.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operation. An authenticated user can therefore access another user\u0027s Store namespace when a deployment relies on namespace rewriting for isolation, allowing unauthorized reads, overwrites, searches, or deletions. Python custom authentication and handlers that reject unauthorized namespaces instead of rewriting them are not affected. This issue is fixed in version 0.15.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T21:06:43.157Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/langchain-ai/langgraph/security/advisories/GHSA-4hm6-w6qq-w73v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/langchain-ai/langgraph/security/advisories/GHSA-4hm6-w6qq-w73v"
        }
      ],
      "source": {
        "advisory": "GHSA-4hm6-w6qq-w73v",
        "discovery": "UNKNOWN"
      },
      "title": "LangGraph JavaScript custom authentication may permit cross-user Store access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118668",
    "datePublished": "2026-10-28T21:06:43.157Z",
    "dateReserved": "2026-10-28T17:25:37.562Z",
    "dateUpdated": "2026-10-29T17:22:55.674Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118084",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T18:33:48.360356Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T18:39:14.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "nd-booking",
          "product": "Hotel Booking",
          "vendor": "nicdark",
          "versions": [
            {
              "lessThanOrEqual": "3.8",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Subscriber Insecure Direct Object References (IDOR) in Hotel Booking \u003c= 3.8 versions."
            }
          ],
          "value": "Subscriber Insecure Direct Object References (IDOR) in Hotel Booking \u003c= 3.8 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T15:24:41.085Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/nd-booking/vulnerability/wordpress-hotel-booking-plugin-3-8-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Hotel Booking plugin \u003c= 3.8 - Insecure Direct Object References (IDOR) vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-118084",
    "datePublished": "2026-10-29T15:24:41.085Z",
    "dateReserved": "2026-10-27T16:00:44.817Z",
    "dateUpdated": "2026-10-30T18:39:14.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}