{"entries":[{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, <= 4.5.6"],"ecosystem":null,"fixed_versions":[],"package_name":"advanced-post-manager","purl":null}],"anchor_state":"anchored","automation":"deterministic","check":true,"check_claim":{"confidence_basis":"upstream","evidence":"inferred","label":"build fingerprint"},"check_confidence_basis":"upstream","cve_id":"CVE-2026-111396","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":7.1,"cvss_src":"cna_vendor","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","cvss_version":"3.1","cwes":[862],"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-111396","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2262","euvd_id":null,"exploit":false,"first_run_started_at":"2026-10-21T02:06:46.106773+00:00","ghsa_id":null,"had_prior_signal":false,"last_run_finished_at":"2026-10-21T02:06:46.641484+00:00","last_run_started_at":"2026-10-21T02:06:46.106773+00:00","logo_key":"wp:advanced-post-manager","mitigation":"Disable the plugin or restrict its use to trusted, least-privileged accounts until the vendor publishes an update. Review plugin-related roles and remove unnecessary user access.","pipeline_minutes":0.00891185,"product":"Advanced Post Manager","published_at":"2026-10-21T02:06:40.771125+00:00","seq":2293,"signals":{"check":{"at":"2026-10-21T02:06:46.596918+00:00","days":4.549957649513889,"is_lower_bound":false,"measured_at":"2026-10-16T12:54:50.256000+00:00","url":null},"trigger_signal":{"at":"2026-10-16T12:54:50.256000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-16T12:54:50.256000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-111396"}},"status":"published","summary":"Advanced Post Manager versions through 4.5.6 contain an authorization control flaw. An authenticated attacker may be able to perform actions beyond their intended permissions, potentially affecting site integrity or availability.","superseded_by_etk_id":null,"t0_at":"2026-10-16T12:54:50.256000+00:00","title":"Authorization bypass in Advanced Post Manager","updated_at":"2026-10-21T02:06:51.404706+00:00","vendor":"Liquid Web / StellarWP","withdrawal_reason":null,"withdrawn_at":null},{"affected":[],"anchor_state":"anchored","automation":null,"check":false,"check_claim":null,"check_confidence_basis":null,"cve_id":"CVE-2026-110873","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":7.1,"cvss_src":"cna_vendor","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_version":"3.1","cwes":null,"delta_is_lower_bound":false,"details_pending":true,"display_id":"CVE-2026-110873","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2261","euvd_id":null,"exploit":false,"first_run_started_at":"2026-10-21T01:57:46.312439+00:00","ghsa_id":"GHSA-wh8c-wx4r-x3rj","had_prior_signal":false,"last_run_finished_at":null,"last_run_started_at":"2026-10-21T01:57:46.312439+00:00","logo_key":null,"mitigation":"Upgrade Heym to version 0.0.121 or later. Until upgraded, limit collaborator access and review error-handler assignments on shared workflows.","pipeline_minutes":null,"product":"heym","published_at":"2026-10-21T01:57:41.651746+00:00","seq":2292,"signals":{"trigger_signal":{"at":"2026-10-14T22:53:01.452000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-14T22:53:01.452000+00:00","url":"https://github.com/advisories/GHSA-wh8c-wx4r-x3rj"}},"status":"in_pipeline","summary":"Heym versions 0.0.55 through 0.0.120 do not adequately restrict changes to a workflow's error-handler configuration. A shared collaborator can redirect error handling to a workflow they control and may obtain credentials when the affected workflow encounters an error. Exploitation requires collaborator access to the workflow and a triggering workflow failure.","superseded_by_etk_id":null,"t0_at":"2026-10-14T22:53:01.452000+00:00","title":"Privilege escalation through workflow error handling in Heym","updated_at":"2026-10-21T01:57:46.321614+00:00","vendor":"heymrun","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":["<= 0.57.1"],"ecosystem":"npm","fixed_versions":["0.57.2"],"package_name":"@happyvertical/smrt-core","purl":"pkg:npm/@happyvertical/smrt-core"},{"affected_notes":[],"affected_ranges":["<= 0.57.1"],"ecosystem":"npm","fixed_versions":["0.57.2"],"package_name":"@happyvertical/smrt-cli","purl":"pkg:npm/@happyvertical/smrt-cli"}],"anchor_state":"awaiting_cve","automation":"contextual","check":false,"check_claim":null,"check_confidence_basis":null,"cve_id":null,"cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":7.0,"cvss_src":"ethiack_provisional","cvss_vector":null,"cvss_version":null,"cwes":[284],"delta_is_lower_bound":true,"details_pending":false,"display_id":"ETK-2026-2260","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2260","euvd_id":null,"exploit":false,"first_run_started_at":"2026-10-21T01:53:33.056902+00:00","ghsa_id":"GHSA-65xv-xgpv-gvqv","had_prior_signal":true,"last_run_finished_at":"2026-10-21T02:06:32.365091+00:00","last_run_started_at":"2026-10-21T01:53:33.056902+00:00","logo_key":"gh:happyvertical:smrt","mitigation":"Upgrade all @happyvertical/smrt-* packages together, including @happyvertical/smrt-core and @happyvertical/smrt-cli, to 0.57.2. Until then, explicitly restate or tighten the parent model's API, MCP, CLI, and sensitive-data settings on every subclass, then review the generated interfaces.","pipeline_minutes":12.988469816666667,"product":"npm:@happyvertical/smrt-core","published_at":"2026-10-21T01:53:27.999523+00:00","seq":2291,"signals":{"trigger_signal":{"at":"2026-10-16T17:54:48+00:00","days":-4.342155801736111,"is_lower_bound":true,"measured_at":"2026-10-21T02:07:30.286909+00:00","url":"https://github.com/happyvertical/smrt/security/advisories/GHSA-65xv-xgpv-gvqv"}},"status":"published","summary":"@happyvertical/smrt-core and @happyvertical/smrt-cli through 0.57.1 can apply permissive interface settings to model subclasses that do not fully declare their own exposure configuration. In affected deployments, a tenant user with MCP access may reach REST or MCP operations that the parent model was intended to restrict, potentially allowing unauthorized changes or deletion. Exploitation requires an affected subclass and access to the relevant tenant interface.","superseded_by_etk_id":null,"t0_at":null,"title":"Model subclass exposure inheritance flaw in smrt-core","updated_at":"2026-10-21T02:06:40.670819+00:00","vendor":"npm","withdrawal_reason":null,"withdrawn_at":null},{"affected":[],"anchor_state":"anchored","automation":"deterministic","check":true,"check_claim":{"confidence_basis":"upstream","evidence":"inferred","label":"build fingerprint"},"check_confidence_basis":"upstream","cve_id":"CVE-2026-108483","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":7.1,"cvss_src":"cna_vendor","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_version":"3.1","cwes":null,"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-108483","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2259","euvd_id":null,"exploit":false,"first_run_started_at":"2026-10-21T01:53:19.764643+00:00","ghsa_id":"GHSA-98q4-gx69-55fm","had_prior_signal":false,"last_run_finished_at":"2026-10-21T01:53:20.349414+00:00","last_run_started_at":"2026-10-21T01:53:19.764643+00:00","logo_key":null,"mitigation":"No fixed release is identified in the available evidence. Disable the affected plugin where practical, or restrict exposure to its affected functionality, and apply a vendor-verified update when one is available.","pipeline_minutes":0.009746183333333333,"product":"Hippoo Mobile App for WooCommerce","published_at":"2026-10-21T01:53:12.479250+00:00","seq":2290,"signals":{"check":{"at":"2026-10-21T01:53:20.303265+00:00","days":6.322047977604167,"is_lower_bound":false,"measured_at":"2026-10-14T18:09:35.358000+00:00","url":null},"trigger_signal":{"at":"2026-10-14T18:09:35.358000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-14T18:09:35.358000+00:00","url":"https://github.com/advisories/GHSA-98q4-gx69-55fm"}},"status":"published","summary":"Hippoo Mobile App for WooCommerce versions through 1.12.0 are affected by reflected cross-site scripting. An unauthenticated attacker may cause script to run in a visitor's browser if that visitor is induced to interact with a crafted request.","superseded_by_etk_id":null,"t0_at":"2026-10-14T18:09:35.358000+00:00","title":"Reflected cross-site scripting in Hippoo Mobile App for WooCommerce","updated_at":"2026-10-21T01:53:27.954176+00:00","vendor":"hippooo","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, < 1.26.10",">= 1.27.0-0, < 1.27.3"],"ecosystem":null,"fixed_versions":["1.26.10","1.27.3"],"package_name":"crypto/x509","purl":null}],"anchor_state":"anchored","automation":"contextual","check":false,"check_claim":null,"check_confidence_basis":null,"cve_id":"CVE-2026-111943","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":null,"cvss_src":null,"cvss_vector":null,"cvss_version":null,"cwes":null,"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-111943","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2258","euvd_id":null,"exploit":false,"first_run_started_at":"2026-10-21T01:48:24.814929+00:00","ghsa_id":null,"had_prior_signal":false,"last_run_finished_at":"2026-10-21T01:57:35.629198+00:00","last_run_started_at":"2026-10-21T01:48:24.814929+00:00","logo_key":"domain:go.dev","mitigation":"Upgrade Go to 1.26.10 or 1.27.3. Ensure systems also keep their operating-system certificate trust stores current.","pipeline_minutes":9.180237816666667,"product":"crypto/x509","published_at":"2026-10-21T01:48:20.693789+00:00","seq":2289,"signals":{"trigger_signal":{"at":"2026-10-21T00:52:18.359000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-21T00:52:18.359000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-111943"}},"status":"published","summary":"Go crypto/x509 before 1.26.10 or 1.27.3 can continue to accept certificate chains involving intermediates that should no longer be trusted. An attacker may be able to rely on such a chain where the system trust store has not incorporated the relevant trust removal and the application performs certificate verification.","superseded_by_etk_id":null,"t0_at":"2026-10-21T00:52:18.359000+00:00","title":"Certificate trust revocation gap in Go crypto/x509","updated_at":"2026-10-21T01:57:41.580980+00:00","vendor":"Go standard library","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":["12.2.1.4.0","14.1.1.0.0","14.1.2.0.0","15.1.1.0.0"],"ecosystem":null,"fixed_versions":[],"package_name":"Oracle WebLogic Server","purl":null}],"anchor_state":"anchored","automation":"contextual","check":true,"check_claim":{"confidence_basis":"assessed","evidence":"observed","label":"active validation"},"check_confidence_basis":"assessed","cve_id":"CVE-2026-83399","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":9.8,"cvss_src":"cna_vendor","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":"3.1","cwes":null,"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-83399","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2257","euvd_id":"EUVD-2026-106317","exploit":false,"first_run_started_at":"2026-10-21T01:09:34.307096+00:00","ghsa_id":"GHSA-xphr-m446-69p7","had_prior_signal":false,"last_run_finished_at":"2026-10-21T01:17:26.304329+00:00","last_run_started_at":"2026-10-21T01:09:34.307096+00:00","logo_key":"domain:oracle.com","mitigation":"Apply the Oracle October 2026 Critical Patch Update following Oracle's instructions. Restrict T3 and IIOP exposure to trusted hosts and networks until updates are deployed.","pipeline_minutes":7.86662055,"product":"Oracle WebLogic Server","published_at":"2026-10-21T01:09:26.189311+00:00","seq":2288,"signals":{"check":{"at":"2026-10-21T01:17:26.304329+00:00","days":0.16226987649305555,"is_lower_bound":false,"measured_at":"2026-10-20T21:23:46.187000+00:00","url":null},"trigger_signal":{"at":"2026-10-20T21:23:46.187000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-20T21:23:46.187000+00:00","url":"https://github.com/advisories/GHSA-xphr-m446-69p7"}},"status":"published","summary":"Oracle WebLogic Server Core releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected. An unauthenticated attacker able to connect to T3 or IIOP may take control of the WebLogic Server instance.","superseded_by_etk_id":null,"t0_at":"2026-10-20T21:23:46.187000+00:00","title":"Unauthenticated T3/IIOP server takeover in Oracle WebLogic Server","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":"Oracle Corporation","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0.1.0, < 0.1.7"],"ecosystem":"pip","fixed_versions":["0.1.7"],"package_name":"vibe-trading-ai","purl":"pkg:pypi/vibe-trading-ai"}],"anchor_state":"anchored","automation":"deterministic","check":false,"check_claim":null,"check_confidence_basis":null,"cve_id":"CVE-2026-114108","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":9.3,"cvss_src":"cna_vendor","cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvss_version":"4.0","cwes":[306],"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-114108","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2256","euvd_id":null,"exploit":false,"first_run_started_at":"2026-10-21T01:06:35.917977+00:00","ghsa_id":null,"had_prior_signal":false,"last_run_finished_at":"2026-10-21T01:18:23.506866+00:00","last_run_started_at":"2026-10-21T01:06:35.917977+00:00","logo_key":"gh:hkuds:vibe-trading","mitigation":"Upgrade Vibe-Trading to version 0.1.7. Until upgraded, configure a nonempty API_AUTH_KEY and limit network access to the FastAPI service.","pipeline_minutes":11.79314815,"product":"Vibe-Trading","published_at":"2026-10-21T01:06:31.708239+00:00","seq":2287,"signals":{"trigger_signal":{"at":"2026-10-21T00:37:08.183000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-21T00:37:08.183000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-114108"}},"status":"published","summary":"HKUDS Vibe-Trading versions 0.1.0 through 0.1.6 can leave the FastAPI interface accessible without authentication when API_AUTH_KEY is unset. An unauthenticated remote attacker may access application functions that can run commands, upload files, expose session history, or disclose portions of API credentials. The issue requires the authentication key configuration to be absent.","superseded_by_etk_id":null,"t0_at":"2026-10-21T00:37:08.183000+00:00","title":"Missing authentication in HKUDS Vibe-Trading","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":"HKUDS","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":["12.2.1.4.0","14.1.1.0.0","14.1.2.0.0","15.1.1.0.0"],"ecosystem":null,"fixed_versions":[],"package_name":"Oracle WebLogic Server","purl":null}],"anchor_state":"anchored","automation":"contextual","check":false,"check_claim":null,"check_confidence_basis":null,"cve_id":"CVE-2026-91323","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":9.8,"cvss_src":"cna_vendor","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":"3.1","cwes":null,"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-91323","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2255","euvd_id":"EUVD-2026-106577","exploit":false,"first_run_started_at":"2026-10-21T01:06:41.504123+00:00","ghsa_id":"GHSA-x85m-p8wc-pg7r","had_prior_signal":false,"last_run_finished_at":"2026-10-21T01:20:49.315646+00:00","last_run_started_at":"2026-10-21T01:06:41.504123+00:00","logo_key":"domain:oracle.com","mitigation":"Install the Oracle October 2026 Critical Patch Update applicable to WebLogic Server. Until updates are deployed, restrict HTTP access to the service to trusted networks and authorized clients.","pipeline_minutes":14.13019205,"product":"Oracle WebLogic Server","published_at":"2026-10-21T01:06:31.694022+00:00","seq":2286,"signals":{"trigger_signal":{"at":"2026-10-20T21:25:18.765000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-20T21:25:18.765000+00:00","url":"https://github.com/advisories/GHSA-x85m-p8wc-pg7r"}},"status":"published","summary":"Oracle WebLogic Server Core versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected. An attacker who can reach a vulnerable server over HTTP without authenticating may be able to take control of that server.","superseded_by_etk_id":null,"t0_at":"2026-10-20T21:25:18.765000+00:00","title":"Unauthenticated HTTP server takeover in Oracle WebLogic Server","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":"Oracle Corporation","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, < 7.37.0"],"ecosystem":null,"fixed_versions":["7.37.0"],"package_name":"Modern Events Calendar Lite","purl":null}],"anchor_state":"anchored","automation":"deterministic","check":true,"check_claim":{"confidence_basis":"upstream","evidence":"inferred","label":"build fingerprint"},"check_confidence_basis":"upstream","cve_id":"CVE-2026-110069","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":null,"cvss_src":null,"cvss_vector":null,"cvss_version":null,"cwes":null,"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-110069","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2254","euvd_id":"EUVD-2026-103396","exploit":false,"first_run_started_at":"2026-10-21T00:59:12.505688+00:00","ghsa_id":"GHSA-7w3g-hjq7-wm77","had_prior_signal":false,"last_run_finished_at":"2026-10-21T00:59:13.010282+00:00","last_run_started_at":"2026-10-21T00:59:12.505688+00:00","logo_key":null,"mitigation":"Upgrade Modern Events Calendar Lite to version 7.37.0 or later. Review existing low-privilege WordPress accounts and remove unnecessary access while updating.","pipeline_minutes":0.0084099,"product":"Modern Events Calendar Lite","published_at":"2026-10-21T00:59:09.220946+00:00","seq":2285,"signals":{"check":{"at":"2026-10-21T00:59:12.965479+00:00","days":2.7909351444328703,"is_lower_bound":false,"measured_at":"2026-10-18T06:00:16.169000+00:00","url":null},"trigger_signal":{"at":"2026-10-18T06:00:16.169000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-18T06:00:16.169000+00:00","url":"https://github.com/advisories/GHSA-7w3g-hjq7-wm77"}},"status":"published","summary":"Modern Events Calendar Lite releases earlier than 7.37.0 can expose booking and attendee records to insufficiently privileged WordPress accounts. An authenticated user, including a Subscriber, may access contact details and booking payment information when the plugin is installed.","superseded_by_etk_id":null,"t0_at":"2026-10-18T06:00:16.169000+00:00","title":"Improper authorization in Modern Events Calendar Lite","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":null,"withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, < 7.36.4"],"ecosystem":null,"fixed_versions":["7.36.4"],"package_name":"Modern Events Calendar Lite","purl":null}],"anchor_state":"anchored","automation":"deterministic","check":true,"check_claim":{"confidence_basis":"differential","evidence":"inferred","label":"version inference"},"check_confidence_basis":"differential","cve_id":"CVE-2026-110070","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":6.5,"cvss_src":"cna_vendor","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_version":"3.1","cwes":null,"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-110070","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2253","euvd_id":"EUVD-2026-103397","exploit":false,"first_run_started_at":"2026-10-21T00:36:14.060503+00:00","ghsa_id":"GHSA-45vg-m9hg-qm9v","had_prior_signal":false,"last_run_finished_at":"2026-10-21T00:58:41.733902+00:00","last_run_started_at":"2026-10-21T00:36:14.060503+00:00","logo_key":null,"mitigation":"Upgrade Modern Events Calendar Lite to version 7.36.4 or later. Until upgraded, restrict Subscriber accounts and review unexpected changes to published content.","pipeline_minutes":22.46122331666667,"product":"Modern Events Calendar Lite","published_at":"2026-10-21T00:36:11.046512+00:00","seq":2284,"signals":{"check":{"at":"2026-10-21T00:58:41.733902+00:00","days":2.790571653958333,"is_lower_bound":false,"measured_at":"2026-10-18T06:00:16.343000+00:00","url":null},"trigger_signal":{"at":"2026-10-18T06:00:16.343000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-18T06:00:16.343000+00:00","url":"https://github.com/advisories/GHSA-45vg-m9hg-qm9v"}},"status":"published","summary":"Modern Events Calendar Lite versions before 7.36.4 do not properly authorize edits to the targeted post. An authenticated user with the Subscriber role can modify selected fields of posts, pages, and custom post types belonging to other users.","superseded_by_etk_id":null,"t0_at":"2026-10-18T06:00:16.343000+00:00","title":"Improper post-edit authorization in Modern Events Calendar Lite","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":null,"withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, < 2026.3.10"],"ecosystem":null,"fixed_versions":["2026.3.10"],"package_name":"Server","purl":null}],"anchor_state":"anchored","automation":"deterministic","check":true,"check_claim":{"confidence_basis":"differential","evidence":"inferred","label":"build fingerprint"},"check_confidence_basis":"differential","cve_id":"CVE-2026-110806","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":6.5,"cvss_src":"cna_vendor","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_version":"3.1","cwes":[863],"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-110806","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2252","euvd_id":"EUVD-2026-102875","exploit":false,"first_run_started_at":"2026-10-21T00:31:52.139097+00:00","ghsa_id":"GHSA-hrwp-c296-c5g8","had_prior_signal":false,"last_run_finished_at":"2026-10-21T01:13:18.659642+00:00","last_run_started_at":"2026-10-21T00:31:52.139097+00:00","logo_key":"domain:devolutions.net","mitigation":"Upgrade Devolutions Server to version 2026.3.10 or later. Until upgraded, restrict View access to connections containing sensitive add-on credentials.","pipeline_minutes":41.44200908333333,"product":"Server","published_at":"2026-10-21T00:31:49.349699+00:00","seq":2283,"signals":{"check":{"at":"2026-10-21T01:13:18.659642+00:00","days":4.478451141689815,"is_lower_bound":false,"measured_at":"2026-10-16T13:44:20.481000+00:00","url":null},"trigger_signal":{"at":"2026-10-16T13:44:20.481000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-16T13:44:20.481000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-110806"}},"status":"published","summary":"Devolutions Server versions through 2026.3.8.0 may disclose add-on passwords in connection data because access checks for add-on properties are insufficient. An authenticated user with only View permission may be able to obtain those credentials.","superseded_by_etk_id":null,"t0_at":"2026-10-16T13:44:20.481000+00:00","title":"Improper authorization exposes add-on passwords in Devolutions Server","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":"Devolutions","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, < 2026.3.10"],"ecosystem":null,"fixed_versions":["2026.3.10"],"package_name":"Server","purl":null}],"anchor_state":"anchored","automation":"contextual","check":false,"check_claim":null,"check_confidence_basis":null,"cve_id":"CVE-2026-110804","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":4.3,"cvss_src":"cna_vendor","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_version":"3.1","cwes":[915],"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-110804","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2251","euvd_id":"EUVD-2026-102876","exploit":false,"first_run_started_at":"2026-10-21T00:31:49.185993+00:00","ghsa_id":"GHSA-jhmq-jch2-cv3p","had_prior_signal":false,"last_run_finished_at":"2026-10-21T01:09:21.274581+00:00","last_run_started_at":"2026-10-21T00:31:49.185993+00:00","logo_key":"domain:devolutions.net","mitigation":"Upgrade Devolutions Server to version 2026.3.10. Limit PAM checkout access to trusted users until the update is complete.","pipeline_minutes":37.5348098,"product":"Server","published_at":"2026-10-21T00:31:44.393908+00:00","seq":2282,"signals":{"trigger_signal":{"at":"2026-10-16T13:45:38.143000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-16T13:45:38.143000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-110804"}},"status":"published","summary":"Devolutions Server versions through 2026.3.8.0 can accept improperly controlled JIT elevation settings during PAM checkout updates. An authenticated user with PAM checkout access may be able to preserve elevated access or remove Active Directory groups.","superseded_by_etk_id":null,"t0_at":"2026-10-16T13:45:38.143000+00:00","title":"JIT elevation setting manipulation in Devolutions Server PAM checkout","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":"Devolutions","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, < 2026.3.10"],"ecosystem":null,"fixed_versions":["2026.3.10"],"package_name":"Server","purl":null}],"anchor_state":"anchored","automation":"deterministic","check":true,"check_claim":{"confidence_basis":"differential","evidence":"inferred","label":"build fingerprint"},"check_confidence_basis":"differential","cve_id":"CVE-2026-110805","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":2.6,"cvss_src":"cna_vendor","cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","cvss_version":"3.1","cwes":[918],"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-110805","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2250","euvd_id":"EUVD-2026-102877","exploit":false,"first_run_started_at":"2026-10-21T00:29:53.143820+00:00","ghsa_id":"GHSA-qh8g-mmrv-wjr8","had_prior_signal":false,"last_run_finished_at":"2026-10-21T01:04:05.111755+00:00","last_run_started_at":"2026-10-21T00:29:53.143820+00:00","logo_key":"domain:devolutions.net","mitigation":"Upgrade Devolutions Server to version 2026.3.10. Restrict low-privileged access to the affected PingOne functionality until the update is applied.","pipeline_minutes":34.199465583333335,"product":"Server","published_at":"2026-10-21T00:29:49.860202+00:00","seq":2281,"signals":{"check":{"at":"2026-10-21T01:04:05.111755+00:00","days":4.470276617534722,"is_lower_bound":false,"measured_at":"2026-10-16T13:46:53.212000+00:00","url":null},"trigger_signal":{"at":"2026-10-16T13:46:53.212000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-16T13:46:53.212000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-110805"}},"status":"published","summary":"Devolutions Server versions through 2026.3.8.0 are affected by a server-side request forgery issue in the PingOne groups endpoint. An authenticated low-privileged user who can supply PingOne configuration in a request may cause disclosure of the stored PingOne application secret.","superseded_by_etk_id":null,"t0_at":"2026-10-16T13:46:53.212000+00:00","title":"Server-side request forgery in Devolutions Server PingOne groups","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":"Devolutions","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= ea174a91893956450510945a0c5d1a10b5323656, < c99ea7855124ca1428a1e59c2b4590aaef34eacf",">= ea174a91893956450510945a0c5d1a10b5323656, < d7fd1f98607f2cd358e583f9548bdf0173090a86","a6a9601ba995d0fec635324cb9fd8d14f9bea14e","1fc8a2b14ef5223f8e0b95faba2ee0a6e4d0f99d","750a2d772e9d9ff377fd32e3b6797bf2cd847a7a","6775ee7ef4b37c521aa4cf3730f54554c4875542",">= 5.15.145, < 5.16",">= 6.1.29, < 6.2",">= 6.2.16, < 6.3",">= 6.3.2, < 6.4"],"ecosystem":null,"fixed_versions":["c99ea7855124ca1428a1e59c2b4590aaef34eacf","d7fd1f98607f2cd358e583f9548bdf0173090a86","5.16","6.2","6.3","6.4"],"package_name":"Linux","purl":null},{"affected_notes":[],"affected_ranges":["6.4"],"ecosystem":null,"fixed_versions":[],"package_name":"Linux","purl":null}],"anchor_state":"anchored","automation":"contextual","check":false,"check_claim":null,"check_confidence_basis":null,"cve_id":"CVE-2026-98420","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":null,"cvss_src":null,"cvss_vector":null,"cvss_version":null,"cwes":null,"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-98420","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2249","euvd_id":"EUVD-2026-101069","exploit":false,"first_run_started_at":"2026-10-21T00:24:09.108883+00:00","ghsa_id":"GHSA-h7rp-r63v-fmfm","had_prior_signal":false,"last_run_finished_at":"2026-10-21T00:31:34.951136+00:00","last_run_started_at":"2026-10-21T00:24:09.108883+00:00","logo_key":null,"mitigation":"Update to a kernel release containing the fix; the advisory lists fixed versions 5.16, 6.2, 6.3, and 6.4. Until updates are deployed, disable ksmbd where it is not required or limit SMB access to trusted clients.","pipeline_minutes":7.430704216666666,"product":"Linux","published_at":"2026-10-21T00:24:01.751943+00:00","seq":2280,"signals":{"trigger_signal":{"at":"2026-10-14T13:27:49.599000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-14T13:27:49.599000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-98420"}},"status":"published","summary":"Linux kernels running the ksmbd SMB server can incorrectly handle SMB2 session lifetime during SessionSetup exchanges. A remote client can trigger resource consumption through abandoned setup sessions, while additional authenticated session setup can disrupt existing SMB connections; exposure requires ksmbd to be enabled and reachable.","superseded_by_etk_id":null,"t0_at":"2026-10-14T13:27:49.599000+00:00","title":"Improper SMB2 session expiration in Linux ksmbd","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":"Linux","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, <= 3.8"],"ecosystem":null,"fixed_versions":[],"package_name":"Hotel Booking","purl":null}],"anchor_state":"anchored","automation":"deterministic","check":true,"check_claim":{"confidence_basis":"upstream","evidence":"inferred","label":"build fingerprint"},"check_confidence_basis":"upstream","cve_id":"CVE-2026-84167","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":null,"cvss_src":null,"cvss_vector":null,"cvss_version":null,"cwes":null,"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-84167","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2248","euvd_id":"EUVD-2026-97242","exploit":false,"first_run_started_at":"2026-10-21T00:23:57.019364+00:00","ghsa_id":"GHSA-m5mm-2642-h6gv","had_prior_signal":false,"last_run_finished_at":"2026-10-21T00:23:57.638158+00:00","last_run_started_at":"2026-10-21T00:23:57.019364+00:00","logo_key":null,"mitigation":"Restrict or remove untrusted WordPress accounts and limit access to booking data to staff who require it. Apply a vendor update when a fixed Hotel Booking release is published.","pipeline_minutes":0.010313233333333333,"product":"Hotel Booking","published_at":"2026-10-21T00:23:53.741153+00:00","seq":2279,"signals":{"check":{"at":"2026-10-21T00:23:57.593524+00:00","days":8.766543212083333,"is_lower_bound":false,"measured_at":"2026-10-12T06:00:08.260000+00:00","url":null},"trigger_signal":{"at":"2026-10-12T06:00:08.260000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-12T06:00:08.260000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-84167"}},"status":"published","summary":"Hotel Booking through version 3.8 fails to enforce ownership checks when users access booking records. An authenticated low-privilege WordPress account may view other customers' booking information, including personal contact and address details.","superseded_by_etk_id":null,"t0_at":"2026-10-12T06:00:08.260000+00:00","title":"Improper authorization in Hotel Booking","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":null,"withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, <= 6.9"],"ecosystem":null,"fixed_versions":[],"package_name":"MemberHero","purl":null}],"anchor_state":"anchored","automation":"deterministic","check":true,"check_claim":{"confidence_basis":"upstream","evidence":"inferred","label":"build fingerprint"},"check_confidence_basis":"upstream","cve_id":"CVE-2026-94235","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":null,"cvss_src":null,"cvss_vector":null,"cvss_version":null,"cwes":null,"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-94235","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2247","euvd_id":"EUVD-2026-96734","exploit":false,"first_run_started_at":"2026-10-21T00:23:47.106489+00:00","ghsa_id":"GHSA-544m-gj73-rvcj","had_prior_signal":false,"last_run_finished_at":"2026-10-21T00:23:47.672762+00:00","last_run_started_at":"2026-10-21T00:23:47.106489+00:00","logo_key":null,"mitigation":"Disable MemberHero where feasible, or restrict creation and access of untrusted WordPress accounts until a corrected release is available. Review outbound mail activity for unexpected messages.","pipeline_minutes":0.009437883333333333,"product":"MemberHero","published_at":"2026-10-21T00:23:41.297724+00:00","seq":2278,"signals":{"check":{"at":"2026-10-21T00:23:47.626713+00:00","days":9.766428144826389,"is_lower_bound":false,"measured_at":"2026-10-11T06:00:08.235000+00:00","url":null},"trigger_signal":{"at":"2026-10-11T06:00:08.235000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-11T06:00:08.235000+00:00","url":"https://github.com/advisories/GHSA-544m-gj73-rvcj"}},"status":"published","summary":"MemberHero versions through 6.9 include an email-related AJAX action without adequate authorization and request validation. An authenticated low-privilege user can make the WordPress site send HTML email to selected recipients, enabling misuse of the site's mail identity.","superseded_by_etk_id":null,"t0_at":"2026-10-11T06:00:08.235000+00:00","title":"Improper authorization in MemberHero email AJAX action","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":null,"withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, <= 1.1"],"ecosystem":null,"fixed_versions":[],"package_name":"paymendo","purl":null}],"anchor_state":"anchored","automation":"deterministic","check":true,"check_claim":{"confidence_basis":"upstream","evidence":"inferred","label":"build fingerprint"},"check_confidence_basis":"upstream","cve_id":"CVE-2026-89305","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":null,"cvss_src":null,"cvss_vector":null,"cvss_version":null,"cwes":null,"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-89305","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2246","euvd_id":"EUVD-2026-96792","exploit":false,"first_run_started_at":"2026-10-21T00:23:36.772578+00:00","ghsa_id":"GHSA-cc47-x7cq-5www","had_prior_signal":false,"last_run_finished_at":"2026-10-21T00:23:37.503692+00:00","last_run_started_at":"2026-10-21T00:23:36.772578+00:00","logo_key":null,"mitigation":"Update to a vendor-confirmed fixed release when one is available. Until then, disable the plugin or limit access to trusted authenticated users.","pipeline_minutes":0.012185233333333333,"product":"paymendo","published_at":"2026-10-21T00:23:34.085178+00:00","seq":2277,"signals":{"check":{"at":"2026-10-21T00:23:37.458020+00:00","days":9.766186377546296,"is_lower_bound":false,"measured_at":"2026-10-11T06:00:18.955000+00:00","url":null},"trigger_signal":{"at":"2026-10-11T06:00:18.955000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-11T06:00:18.955000+00:00","url":"https://github.com/advisories/GHSA-cc47-x7cq-5www"}},"status":"published","summary":"Paymendo WordPress plugin versions through 1.1 are affected by SQL injection. An authenticated attacker may influence database queries through an insufficiently handled parameter.","superseded_by_etk_id":null,"t0_at":"2026-10-11T06:00:18.955000+00:00","title":"SQL injection in paymendo WordPress plugin","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":null,"withdrawal_reason":null,"withdrawn_at":null},{"affected":[],"anchor_state":"awaiting_cve","automation":"contextual","check":true,"check_claim":{"confidence_basis":"assessed","evidence":"observed","label":"active validation"},"check_confidence_basis":"assessed","cve_id":"CVE-2026-109619","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":null,"cvss_src":null,"cvss_vector":null,"cvss_version":null,"cwes":null,"delta_is_lower_bound":true,"details_pending":false,"display_id":"CVE-2026-109619","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2245","euvd_id":null,"exploit":false,"first_run_started_at":"2026-10-21T00:23:34.574021+00:00","ghsa_id":null,"had_prior_signal":true,"last_run_finished_at":"2026-10-21T00:31:41.722692+00:00","last_run_started_at":"2026-10-21T00:23:34.574021+00:00","logo_key":"domain:php.net","mitigation":"Apply the PHP security update as soon as the emergency release is available. Until then, reduce exposure by limiting public access to PHP applications and restricting untrusted input paths where operationally possible.","pipeline_minutes":8.119144516666667,"product":"PHP","published_at":"2026-10-21T00:23:24.866891+00:00","seq":2276,"signals":{"check":{"at":"2026-10-21T00:31:41.722692+00:00","days":-0.06653401131944445,"is_lower_bound":true,"measured_at":"2026-10-21T02:07:30.287966+00:00","url":null},"trigger_signal":{"at":"2026-10-20T20:56:43+00:00","days":-0.2158247832175926,"is_lower_bound":true,"measured_at":"2026-10-21T02:07:30.287966+00:00","url":"https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/"}},"status":"published","summary":"A reported PHP flaw may allow remote code execution when an affected application processes attacker-controlled input. An attacker must be able to send such input to a vulnerable PHP deployment; affected versions are not specified in the supplied evidence.","superseded_by_etk_id":null,"t0_at":null,"title":"Remote code execution in PHP","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":"PHP security team","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, <= 4.3.1"],"ecosystem":null,"fixed_versions":[],"package_name":"WP-Invoice","purl":null}],"anchor_state":"anchored","automation":"deterministic","check":true,"check_claim":{"confidence_basis":"upstream","evidence":"inferred","label":"build fingerprint"},"check_confidence_basis":"upstream","cve_id":"CVE-2026-97183","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":null,"cvss_src":null,"cvss_vector":null,"cvss_version":null,"cwes":null,"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-97183","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2244","euvd_id":"EUVD-2026-96796","exploit":false,"first_run_started_at":"2026-10-21T00:23:29.002845+00:00","ghsa_id":"GHSA-82r4-qmh5-8qxf","had_prior_signal":false,"last_run_finished_at":"2026-10-21T00:23:29.625649+00:00","last_run_started_at":"2026-10-21T00:23:29.002845+00:00","logo_key":null,"mitigation":"Disable or remove WP-Invoice where it is not required, and restrict creation and use of low-privilege accounts until a vendor update is available. Review accounts and limit plugin access to trusted users.","pipeline_minutes":0.010380066666666667,"product":"WP-Invoice","published_at":"2026-10-21T00:23:24.836810+00:00","seq":2275,"signals":{"check":{"at":"2026-10-21T00:23:29.571951+00:00","days":9.766087082766203,"is_lower_bound":false,"measured_at":"2026-10-11T06:00:19.648000+00:00","url":null},"trigger_signal":{"at":"2026-10-11T06:00:19.648000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-11T06:00:19.648000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-97183"}},"status":"published","summary":"WP-Invoice versions through 4.3.1 contain AJAX functions that do not properly enforce user permissions. An attacker with any authenticated account, including a low-privilege account, may access information about registered users, such as contact and profile data.","superseded_by_etk_id":null,"t0_at":"2026-10-11T06:00:19.648000+00:00","title":"Authorization flaw exposes user data in WP-Invoice","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":null,"withdrawal_reason":null,"withdrawn_at":null},{"affected":[],"anchor_state":"awaiting_cve","automation":"contextual","check":false,"check_claim":null,"check_confidence_basis":null,"cve_id":"CVE-2026-109618","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":9.0,"cvss_src":"ethiack_provisional","cvss_vector":null,"cvss_version":null,"cwes":null,"delta_is_lower_bound":true,"details_pending":false,"display_id":"CVE-2026-109618","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2243","euvd_id":null,"exploit":false,"first_run_started_at":"2026-10-21T00:23:29.188121+00:00","ghsa_id":null,"had_prior_signal":true,"last_run_finished_at":"2026-10-21T00:29:34.662248+00:00","last_run_started_at":"2026-10-21T00:23:29.188121+00:00","logo_key":"domain:php.net","mitigation":"Identify all deployed PHP versions and prepare to apply the emergency updates when released; verify the installed package and version afterward. Restrict public exposure of PHP-hosting services and isolate systems that cannot be updated promptly.","pipeline_minutes":6.09123545,"product":"PHP","published_at":"2026-10-21T00:23:24.693900+00:00","seq":2274,"signals":{"trigger_signal":{"at":"2026-10-20T20:56:43+00:00","days":-0.2158247832175926,"is_lower_bound":true,"measured_at":"2026-10-21T02:07:30.288107+00:00","url":"https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/"}},"status":"published","summary":"PHP deployments may be affected by two vulnerabilities for which emergency patches are being prepared. The available evidence does not disclose the vulnerability classes, affected versions, attacker impact, or conditions required for exploitation.","superseded_by_etk_id":null,"t0_at":null,"title":"PHP flaws requiring emergency updates","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":"PHP security team","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, < 3.4.3"],"ecosystem":null,"fixed_versions":["3.4.3"],"package_name":"org.apache.dolphinscheduler:dolphinscheduler-api","purl":null}],"anchor_state":"anchored","automation":"contextual","check":false,"check_claim":null,"check_confidence_basis":null,"cve_id":"CVE-2026-66082","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":6.5,"cvss_src":"cna_vendor","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_version":"3.1","cwes":[863],"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-66082","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2242","euvd_id":"EUVD-2026-94805","exploit":false,"first_run_started_at":"2026-10-20T23:25:31.574580+00:00","ghsa_id":"GHSA-r995-5488-jh52","had_prior_signal":false,"last_run_finished_at":"2026-10-20T23:58:15.920148+00:00","last_run_started_at":"2026-10-20T23:25:31.574580+00:00","logo_key":"domain:apache.org","mitigation":"Upgrade org.apache.dolphinscheduler:dolphinscheduler-api to version 3.4.3 or later. Restrict access for accounts with workflow-management permissions until the upgrade is complete.","pipeline_minutes":32.7390928,"product":"Apache DolphinScheduler","published_at":"2026-10-20T23:25:28.662451+00:00","seq":2273,"signals":{"trigger_signal":{"at":"2026-10-08T08:16:38.047000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-08T08:16:38.047000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-66082"}},"status":"published","summary":"Apache DolphinScheduler API releases before 3.4.3 can authorize actions using one project's context without confirming that the targeted workflow resource belongs to that project. An authenticated user with relevant access in one project may change workflow scheduling or availability state, and disrupt task activity, in another project.","superseded_by_etk_id":null,"t0_at":"2026-10-08T08:16:38.047000+00:00","title":"Cross-project authorization bypass in Apache DolphinScheduler","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":"Apache Software Foundation","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, < 3.4.3"],"ecosystem":null,"fixed_versions":["3.4.3"],"package_name":"org.apache.dolphinscheduler:dolphinscheduler-api","purl":null}],"anchor_state":"anchored","automation":"contextual","check":false,"check_claim":null,"check_confidence_basis":null,"cve_id":"CVE-2026-66084","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":8.1,"cvss_src":"cna_vendor","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_version":"3.1","cwes":[863],"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-66084","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2241","euvd_id":"EUVD-2026-94806","exploit":false,"first_run_started_at":"2026-10-20T23:16:24.713389+00:00","ghsa_id":"GHSA-26vh-p5jc-q2mg","had_prior_signal":false,"last_run_finished_at":"2026-10-20T23:40:48.865116+00:00","last_run_started_at":"2026-10-20T23:16:24.713389+00:00","logo_key":"domain:apache.org","mitigation":"Upgrade org.apache.dolphinscheduler:dolphinscheduler-api to version 3.4.3 or later.","pipeline_minutes":24.402528783333334,"product":"Apache DolphinScheduler","published_at":"2026-10-20T23:16:22.262339+00:00","seq":2272,"signals":{"trigger_signal":{"at":"2026-10-08T08:18:19.410000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-08T08:18:19.410000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-66084"}},"status":"published","summary":"Apache DolphinScheduler API versions before 3.4.3 do not properly enforce project ownership when updating task definitions. An authenticated user with access to a project may modify task definitions and dependency relationships in a different project, affecting workflow integrity and execution.","superseded_by_etk_id":null,"t0_at":"2026-10-08T08:18:19.410000+00:00","title":"Cross-project authorization bypass in DolphinScheduler","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":"Apache Software Foundation","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, < 3.4.3"],"ecosystem":null,"fixed_versions":["3.4.3"],"package_name":"org.apache.dolphinscheduler:dolphinscheduler-api","purl":null}],"anchor_state":"anchored","automation":"contextual","check":false,"check_claim":null,"check_confidence_basis":null,"cve_id":"CVE-2026-66087","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":8.1,"cvss_src":"cna_vendor","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_version":"3.1","cwes":[863],"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-66087","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2240","euvd_id":"EUVD-2026-94807","exploit":false,"first_run_started_at":"2026-10-20T23:14:48.549134+00:00","ghsa_id":"GHSA-8x8j-rj29-7qph","had_prior_signal":false,"last_run_finished_at":"2026-10-20T23:38:42.456434+00:00","last_run_started_at":"2026-10-20T23:14:48.549134+00:00","logo_key":"domain:apache.org","mitigation":"Upgrade org.apache.dolphinscheduler:dolphinscheduler-api to version 3.4.3 or later.","pipeline_minutes":23.898455,"product":"Apache DolphinScheduler","published_at":"2026-10-20T23:14:45.738632+00:00","seq":2271,"signals":{"trigger_signal":{"at":"2026-10-08T08:29:43.553000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-08T08:29:43.553000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-66087"}},"status":"published","summary":"Apache DolphinScheduler API versions before 3.4.3 do not properly enforce project authorization for certain task-instance operations. An authenticated user may stop task instances or create savepoints in projects they are not permitted to access.","superseded_by_etk_id":null,"t0_at":"2026-10-08T08:29:43.553000+00:00","title":"Authorization bypass in Apache DolphinScheduler task-instance API","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":"Apache Software Foundation","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, <= 6.3.2"],"ecosystem":null,"fixed_versions":[],"package_name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","purl":null}],"anchor_state":"anchored","automation":"deterministic","check":true,"check_claim":{"confidence_basis":"upstream","evidence":"inferred","label":"build fingerprint"},"check_confidence_basis":"upstream","cve_id":"CVE-2026-104734","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":7.2,"cvss_src":"cna_vendor","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_version":"3.1","cwes":[502],"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-104734","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2239","euvd_id":"EUVD-2026-103214","exploit":false,"first_run_started_at":"2026-10-20T23:14:41.291573+00:00","ghsa_id":"GHSA-9858-wmm9-p4jw","had_prior_signal":false,"last_run_finished_at":"2026-10-20T23:14:41.877148+00:00","last_run_started_at":"2026-10-20T23:14:41.291573+00:00","logo_key":"wp:kirki","mitigation":"Restrict the Kirki import endpoint to trusted administrators and remove Editor access granted by the default full-access setting. Review installed plugins and themes for deserialization object chains, and update or disable Kirki when a corrected release is available.","pipeline_minutes":0.009759583333333334,"product":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","published_at":"2026-10-20T23:14:35.514125+00:00","seq":2270,"signals":{"check":{"at":"2026-10-20T23:14:41.830318+00:00","days":3.8636127698842593,"is_lower_bound":false,"measured_at":"2026-10-17T02:31:05.687000+00:00","url":null},"trigger_signal":{"at":"2026-10-17T02:31:05.687000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-17T02:31:05.687000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-104734"}},"status":"published","summary":"Kirki for WordPress through version 6.3.2 accepts untrusted serialized data through its import functionality. An authenticated user with import access, including Editors under the default access setting, can inject PHP objects; harmful outcomes additionally depend on another installed plugin or theme supplying a usable object chain.","superseded_by_etk_id":null,"t0_at":"2026-10-17T02:31:05.687000+00:00","title":"PHP object injection in Kirki","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":"themeum","withdrawal_reason":null,"withdrawn_at":null},{"affected":[{"affected_notes":[],"affected_ranges":[">= 0, < 3.10.0"],"ecosystem":null,"fixed_versions":["3.10.0"],"package_name":"Code Snippets","purl":null}],"anchor_state":"anchored","automation":"deterministic","check":true,"check_claim":{"confidence_basis":"upstream","evidence":"inferred","label":"build fingerprint"},"check_confidence_basis":"upstream","cve_id":"CVE-2026-106095","cvelist_commit_at":null,"cvelist_commit_sha":null,"cvss_score":null,"cvss_src":null,"cvss_vector":null,"cvss_version":null,"cwes":null,"delta_is_lower_bound":false,"details_pending":false,"display_id":"CVE-2026-106095","epss_asof":null,"epss_percentile":null,"epss_score":null,"etk_id":"ETK-2026-2238","euvd_id":"EUVD-2026-95506","exploit":false,"first_run_started_at":"2026-10-20T23:14:31.448741+00:00","ghsa_id":"GHSA-x27w-vpmw-g569","had_prior_signal":false,"last_run_finished_at":"2026-10-20T23:14:32.011131+00:00","last_run_started_at":"2026-10-20T23:14:31.448741+00:00","logo_key":null,"mitigation":"Update Code Snippets to version 3.10.0 or later. Until updated, restrict untrusted users from holding administrator roles on subsites in multisite networks.","pipeline_minutes":0.009373166666666667,"product":"Code Snippets","published_at":"2026-10-20T23:14:28.621071+00:00","seq":2269,"signals":{"check":{"at":"2026-10-20T23:14:31.967615+00:00","days":11.718322588136575,"is_lower_bound":false,"measured_at":"2026-10-09T06:00:08.896000+00:00","url":null},"trigger_signal":{"at":"2026-10-09T06:00:08.896000+00:00","days":0.0,"is_lower_bound":false,"measured_at":"2026-10-09T06:00:08.896000+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-106095"}},"status":"published","summary":"Code Snippets versions before 3.10.0 on WordPress multisite installations are affected. An administrator of one subsite can change the enabled state or ordering of snippets configured for the entire network, potentially affecting every site; the attacker must already hold subsite administrator access.","superseded_by_etk_id":null,"t0_at":"2026-10-09T06:00:08.896000+00:00","title":"Improper authorization for network snippets in Code Snippets","updated_at":"2026-10-21T01:51:59.570456+00:00","vendor":null,"withdrawal_reason":null,"withdrawn_at":null}],"next":"/api/v1/feed?page=2","next_cursor":"2269","page":1,"pages":89,"prev":null,"summary":{"anchored":2018,"awaiting_cve":184,"contextual":1271,"deterministic":927,"entries":2202,"feed_rows":2213,"in_pipeline":3,"median_check_delta_days":0.27825752751157407,"median_exploit_delta_days":0.15951611630787038,"median_first_artifact_days":0.27825752751157407,"median_minutes_to_artifact":543.3803170333333,"median_minutes_to_start":198.43275334166668,"median_sample_size":2018,"no_prior_signal":1848,"watermark":"2026-10-21T02:06:51.404706+00:00","with_check":985,"with_exploit":36},"total":2213}