From 441b40236f9bc35c1f4a103902072e2b08e7b9c5 Mon Sep 17 00:00:00 2001 From: bitnami-bot Date: Wed, 28 Oct 2026 09:14:35 +0000 Subject: [PATCH] feat: Updated at 20261028083332 Signed-off-by: bitnami-bot --- data/couchdb/BIT-couchdb-2026-107755.json | 63 +++++++++++ data/couchdb/BIT-couchdb-2026-86471.json | 63 +++++++++++ data/couchdb/BIT-couchdb-2026-90797.json | 63 +++++++++++ data/couchdb/BIT-couchdb-2026-90798.json | 63 +++++++++++ data/couchdb/BIT-couchdb-2026-90799.json | 63 +++++++++++ data/couchdb/BIT-couchdb-2026-90800.json | 63 +++++++++++ data/gitlab/BIT-gitlab-2026-103515.json | 76 +++++++++++++ data/gitlab/BIT-gitlab-2026-105711.json | 76 +++++++++++++ data/gitlab/BIT-gitlab-2026-105777.json | 76 +++++++++++++ data/gitlab/BIT-gitlab-2026-110264.json | 100 ++++++++++++++++++ data/gitlab/BIT-gitlab-2026-112212.json | 72 +++++++++++++ data/gitlab/BIT-gitlab-2026-112326.json | 72 +++++++++++++ data/gitlab/BIT-gitlab-2026-112378.json | 72 +++++++++++++ data/gitlab/BIT-gitlab-2026-12664.json | 76 +++++++++++++ data/gitlab/BIT-gitlab-2026-13319.json | 76 +++++++++++++ data/gitlab/BIT-gitlab-2026-14288.json | 76 +++++++++++++ data/gitlab/BIT-gitlab-2026-15723.json | 76 +++++++++++++ data/gitlab/BIT-gitlab-2026-16255.json | 76 +++++++++++++ data/golang/BIT-golang-2026-111943.json | 71 +++++++++++++ data/grafana/BIT-grafana-2026-92539.json | 74 +++++++++++++ data/libphp/BIT-libphp-2026-109618.json | 14 ++- data/libphp/BIT-libphp-2026-109619.json | 14 ++- data/libphp/BIT-libphp-2026-91767.json | 6 +- data/libphp/BIT-libphp-2026-91768.json | 4 +- data/libphp/BIT-libphp-2026-92842.json | 4 +- data/php-min/BIT-php-min-2026-109618.json | 14 ++- data/php-min/BIT-php-min-2026-109619.json | 14 ++- data/php-min/BIT-php-min-2026-91767.json | 6 +- data/php-min/BIT-php-min-2026-91768.json | 4 +- data/php-min/BIT-php-min-2026-92842.json | 4 +- data/php/BIT-php-2026-109618.json | 14 ++- data/php/BIT-php-2026-109619.json | 14 ++- data/php/BIT-php-2026-91767.json | 6 +- data/php/BIT-php-2026-91768.json | 4 +- data/php/BIT-php-2026-92842.json | 4 +- data/pillow/BIT-pillow-2026-112397.json | 8 +- data/pillow/BIT-pillow-2026-112398.json | 8 +- data/pillow/BIT-pillow-2026-112399.json | 8 +- data/pillow/BIT-pillow-2026-112400.json | 8 +- data/pillow/BIT-pillow-2026-112401.json | 14 +-- data/pillow/BIT-pillow-2026-112402.json | 8 +- data/pillow/BIT-pillow-2026-112403.json | 8 +- data/pillow/BIT-pillow-2026-112404.json | 8 +- data/pillow/BIT-pillow-2026-112405.json | 8 +- data/pillow/BIT-pillow-2026-112406.json | 8 +- data/pillow/BIT-pillow-2026-112891.json | 14 +-- data/pillow/BIT-pillow-2026-112892.json | 8 +- data/pillow/BIT-pillow-2026-112893.json | 8 +- data/pillow/BIT-pillow-2026-112894.json | 8 +- data/pillow/BIT-pillow-2026-112895.json | 8 +- data/pillow/BIT-pillow-2026-112896.json | 8 +- data/pillow/BIT-pillow-2026-112897.json | 8 +- data/pillow/BIT-pillow-2026-112898.json | 8 +- data/pillow/BIT-pillow-2026-112900.json | 8 +- data/pillow/BIT-pillow-2026-112901.json | 14 +-- data/pillow/BIT-pillow-2026-114501.json | 67 ++++++++++++ data/pillow/BIT-pillow-2026-96636.json | 67 ++++++++++++ data/pillow/BIT-pillow-2026-96637.json | 67 ++++++++++++ data/pillow/BIT-pillow-2026-96638.json | 67 ++++++++++++ data/pillow/BIT-pillow-2026-96639.json | 67 ++++++++++++ data/pillow/BIT-pillow-2026-96640.json | 67 ++++++++++++ data/pillow/BIT-pillow-2026-96641.json | 67 ++++++++++++ data/pillow/BIT-pillow-2026-96642.json | 67 ++++++++++++ data/pillow/BIT-pillow-2026-96643.json | 67 ++++++++++++ data/pillow/BIT-pillow-2026-96644.json | 67 ++++++++++++ data/pillow/BIT-pillow-2026-96778.json | 67 ++++++++++++ data/rclone/BIT-rclone-2026-116191.json | 59 +++++++++++ data/rclone/BIT-rclone-2026-116192.json | 59 +++++++++++ data/rclone/BIT-rclone-2026-116193.json | 59 +++++++++++ data/rclone/BIT-rclone-2026-116194.json | 59 +++++++++++ data/rclone/BIT-rclone-2026-116195.json | 59 +++++++++++ data/rclone/BIT-rclone-2026-116196.json | 59 +++++++++++ data/tomcat/BIT-tomcat-2026-101356.json | 72 +++++++++++++ data/tomcat/BIT-tomcat-2026-80353.json | 50 +++++++++ .../BIT-virtualenv-2026-113713.json | 67 ++++++++++++ .../BIT-virtualenv-2026-113714.json | 67 ++++++++++++ .../BIT-virtualenv-2026-113715.json | 67 ++++++++++++ .../BIT-virtualenv-2026-113716.json | 67 ++++++++++++ .../BIT-virtualenv-2026-113717.json | 67 ++++++++++++ .../BIT-virtualenv-2026-113718.json | 67 ++++++++++++ .../BIT-virtualenv-2026-113719.json | 67 ++++++++++++ .../BIT-virtualenv-2026-113720.json | 67 ++++++++++++ .../BIT-virtualenv-2026-113721.json | 67 ++++++++++++ .../BIT-virtualenv-2026-113722.json | 67 ++++++++++++ .../BIT-virtualenv-2026-113723.json | 67 ++++++++++++ .../BIT-virtualenv-2026-113724.json | 67 ++++++++++++ .../BIT-virtualenv-2026-113725.json | 63 +++++++++++ .../BIT-virtualenv-2026-113726.json | 63 +++++++++++ .../BIT-virtualenv-2026-113732.json | 63 +++++++++++ .../BIT-virtualenv-2026-113776.json | 63 +++++++++++ 90 files changed, 3904 insertions(+), 116 deletions(-) create mode 100644 data/couchdb/BIT-couchdb-2026-107755.json create mode 100644 data/couchdb/BIT-couchdb-2026-86471.json create mode 100644 data/couchdb/BIT-couchdb-2026-90797.json create mode 100644 data/couchdb/BIT-couchdb-2026-90798.json create mode 100644 data/couchdb/BIT-couchdb-2026-90799.json create mode 100644 data/couchdb/BIT-couchdb-2026-90800.json create mode 100644 data/gitlab/BIT-gitlab-2026-103515.json create mode 100644 data/gitlab/BIT-gitlab-2026-105711.json create mode 100644 data/gitlab/BIT-gitlab-2026-105777.json create mode 100644 data/gitlab/BIT-gitlab-2026-110264.json create mode 100644 data/gitlab/BIT-gitlab-2026-112212.json create mode 100644 data/gitlab/BIT-gitlab-2026-112326.json create mode 100644 data/gitlab/BIT-gitlab-2026-112378.json create mode 100644 data/gitlab/BIT-gitlab-2026-12664.json create mode 100644 data/gitlab/BIT-gitlab-2026-13319.json create mode 100644 data/gitlab/BIT-gitlab-2026-14288.json create mode 100644 data/gitlab/BIT-gitlab-2026-15723.json create mode 100644 data/gitlab/BIT-gitlab-2026-16255.json create mode 100644 data/golang/BIT-golang-2026-111943.json create mode 100644 data/grafana/BIT-grafana-2026-92539.json create mode 100644 data/pillow/BIT-pillow-2026-114501.json create mode 100644 data/pillow/BIT-pillow-2026-96636.json create mode 100644 data/pillow/BIT-pillow-2026-96637.json create mode 100644 data/pillow/BIT-pillow-2026-96638.json create mode 100644 data/pillow/BIT-pillow-2026-96639.json create mode 100644 data/pillow/BIT-pillow-2026-96640.json create mode 100644 data/pillow/BIT-pillow-2026-96641.json create mode 100644 data/pillow/BIT-pillow-2026-96642.json create mode 100644 data/pillow/BIT-pillow-2026-96643.json create mode 100644 data/pillow/BIT-pillow-2026-96644.json create mode 100644 data/pillow/BIT-pillow-2026-96778.json create mode 100644 data/rclone/BIT-rclone-2026-116191.json create mode 100644 data/rclone/BIT-rclone-2026-116192.json create mode 100644 data/rclone/BIT-rclone-2026-116193.json create mode 100644 data/rclone/BIT-rclone-2026-116194.json create mode 100644 data/rclone/BIT-rclone-2026-116195.json create mode 100644 data/rclone/BIT-rclone-2026-116196.json create mode 100644 data/tomcat/BIT-tomcat-2026-101356.json create mode 100644 data/tomcat/BIT-tomcat-2026-80353.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113713.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113714.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113715.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113716.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113717.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113718.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113719.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113720.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113721.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113722.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113723.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113724.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113725.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113726.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113732.json create mode 100644 data/virtualenv/BIT-virtualenv-2026-113776.json diff --git a/data/couchdb/BIT-couchdb-2026-107755.json b/data/couchdb/BIT-couchdb-2026-107755.json new file mode 100644 index 0000000000..dbe1f17621 --- /dev/null +++ b/data/couchdb/BIT-couchdb-2026-107755.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-couchdb-2026-107755", + "summary": "Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs", + "details": "Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.", + "aliases": [ + "CVE-2026-107755" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "couchdb", + "purl": "pkg:bitnami/couchdb" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.5.3" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/10/20/16" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/ro57p4r2lhxn2n4712ppx7r11oqq900n" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107755" + } + ], + "published": "2026-10-28T08:40:16.859Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/couchdb/BIT-couchdb-2026-86471.json b/data/couchdb/BIT-couchdb-2026-86471.json new file mode 100644 index 0000000000..17d31fb5e1 --- /dev/null +++ b/data/couchdb/BIT-couchdb-2026-86471.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-couchdb-2026-86471", + "summary": "Apache CouchDB: Admin credentials leading to code execution as operating system user", + "details": "An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.", + "aliases": [ + "CVE-2026-86471" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "couchdb", + "purl": "pkg:bitnami/couchdb" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Red" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.5.3" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Critical", + "cpes": [ + "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/10/20/11" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/c8p73gswgogtnzvk7hpw8jb8d4mnosdp" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86471" + } + ], + "published": "2026-10-28T08:40:18.062Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/couchdb/BIT-couchdb-2026-90797.json b/data/couchdb/BIT-couchdb-2026-90797.json new file mode 100644 index 0000000000..5862722f7f --- /dev/null +++ b/data/couchdb/BIT-couchdb-2026-90797.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-couchdb-2026-90797", + "summary": "Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session", + "details": "An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion.\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.", + "aliases": [ + "CVE-2026-90797" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "couchdb", + "purl": "pkg:bitnami/couchdb" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:M/U:Red" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.5.3" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/10/20/12" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/gsbotof0qn8x6zlpd7t568ny4053jo0n" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90797" + } + ], + "published": "2026-10-28T08:40:19.364Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/couchdb/BIT-couchdb-2026-90798.json b/data/couchdb/BIT-couchdb-2026-90798.json new file mode 100644 index 0000000000..3f088622d6 --- /dev/null +++ b/data/couchdb/BIT-couchdb-2026-90798.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-couchdb-2026-90798", + "summary": "Apache CouchDB: Replicator follows redirects indefinitely", + "details": "A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.", + "aliases": [ + "CVE-2026-90798" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "couchdb", + "purl": "pkg:bitnami/couchdb" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.5.3" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Low", + "cpes": [ + "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/10/20/13" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/m6d526fj57pvq5pswm2lp1shbdz3f417" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90798" + } + ], + "published": "2026-10-28T08:40:20.590Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/couchdb/BIT-couchdb-2026-90799.json b/data/couchdb/BIT-couchdb-2026-90799.json new file mode 100644 index 0000000000..447a1fa097 --- /dev/null +++ b/data/couchdb/BIT-couchdb-2026-90799.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-couchdb-2026-90799", + "summary": "Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values", + "details": "Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.", + "aliases": [ + "CVE-2026-90799" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "couchdb", + "purl": "pkg:bitnami/couchdb" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:M/U:Amber" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.5.3" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Low", + "cpes": [ + "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/10/20/14" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/bqxkm19hw8985t7opz675b29hs1zl4z9" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90799" + } + ], + "published": "2026-10-28T08:40:21.739Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/couchdb/BIT-couchdb-2026-90800.json b/data/couchdb/BIT-couchdb-2026-90800.json new file mode 100644 index 0000000000..d0bbcba67e --- /dev/null +++ b/data/couchdb/BIT-couchdb-2026-90800.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-couchdb-2026-90800", + "summary": "Apache CouchDB: Auth bypass in prefixed _users and _replicator databases", + "details": "Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint.\n\n\nThe use of prefixed system databases is very rare.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.", + "aliases": [ + "CVE-2026-90800" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "couchdb", + "purl": "pkg:bitnami/couchdb" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.5.3" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/10/20/15" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/vng8vqjwgy1qlrv14wzrgs7pv4gj7gwr" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90800" + } + ], + "published": "2026-10-28T08:40:23.002Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/gitlab/BIT-gitlab-2026-103515.json b/data/gitlab/BIT-gitlab-2026-103515.json new file mode 100644 index 0000000000..2396b54562 --- /dev/null +++ b/data/gitlab/BIT-gitlab-2026-103515.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-gitlab-2026-103515", + "summary": "Incorrect Authorization in GitLab", + "details": "GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls.", + "aliases": [ + "CVE-2026-103515" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "19.2.0" + }, + { + "fixed": "19.3.6" + }, + { + "introduced": "19.4.0" + }, + { + "fixed": "19.4.3" + }, + { + "introduced": "19.5.0" + }, + { + "fixed": "19.5.1" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Low", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/631564" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/3871692" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103515" + } + ], + "published": "2026-10-28T09:08:09.579Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/gitlab/BIT-gitlab-2026-105711.json b/data/gitlab/BIT-gitlab-2026-105711.json new file mode 100644 index 0000000000..20d201b58e --- /dev/null +++ b/data/gitlab/BIT-gitlab-2026-105711.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-gitlab-2026-105711", + "summary": "Use of Cache Containing Sensitive Information in GitLab", + "details": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.", + "aliases": [ + "CVE-2026-105711" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "15.0.0" + }, + { + "fixed": "19.3.6" + }, + { + "introduced": "19.4.0" + }, + { + "fixed": "19.4.3" + }, + { + "introduced": "19.5.0" + }, + { + "fixed": "19.5.1" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Low", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/632207" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/3963293" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105711" + } + ], + "published": "2026-10-28T09:08:16.914Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/gitlab/BIT-gitlab-2026-105777.json b/data/gitlab/BIT-gitlab-2026-105777.json new file mode 100644 index 0000000000..bdf176484d --- /dev/null +++ b/data/gitlab/BIT-gitlab-2026-105777.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-gitlab-2026-105777", + "summary": "Insertion of Sensitive Information Into Sent Data in GitLab", + "details": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.", + "aliases": [ + "CVE-2026-105777" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "17.6.5" + }, + { + "fixed": "19.3.6" + }, + { + "introduced": "19.4.0" + }, + { + "fixed": "19.4.3" + }, + { + "introduced": "19.5.0" + }, + { + "fixed": "19.5.1" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/597022" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/3657282" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105777" + } + ], + "published": "2026-10-28T09:08:18.373Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/gitlab/BIT-gitlab-2026-110264.json b/data/gitlab/BIT-gitlab-2026-110264.json new file mode 100644 index 0000000000..0f6fd6cbf7 --- /dev/null +++ b/data/gitlab/BIT-gitlab-2026-110264.json @@ -0,0 +1,100 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-gitlab-2026-110264", + "summary": "Integer Overflow or Wraparound in GitLab", + "details": "An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.", + "aliases": [ + "CVE-2026-110264" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "18.11.13" + }, + { + "introduced": "19.0.0" + }, + { + "fixed": "19.0.10" + }, + { + "introduced": "19.1.0" + }, + { + "fixed": "19.1.9" + }, + { + "introduced": "19.2.0" + }, + { + "fixed": "19.2.9" + }, + { + "introduced": "19.3.0" + }, + { + "fixed": "19.3.6" + }, + { + "introduced": "19.4.0" + }, + { + "fixed": "19.4.3" + }, + { + "introduced": "19.5.0" + }, + { + "fixed": "19.5.1" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Critical", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/633633" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/4093475" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110264" + } + ], + "published": "2026-10-28T09:08:31.956Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/gitlab/BIT-gitlab-2026-112212.json b/data/gitlab/BIT-gitlab-2026-112212.json new file mode 100644 index 0000000000..1fd42b1cb6 --- /dev/null +++ b/data/gitlab/BIT-gitlab-2026-112212.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-gitlab-2026-112212", + "summary": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab", + "details": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.", + "aliases": [ + "CVE-2026-112212" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "18.3.0" + }, + { + "fixed": "19.3.6" + }, + { + "introduced": "19.4.0" + }, + { + "fixed": "19.4.3" + }, + { + "introduced": "19.5.0" + }, + { + "fixed": "19.5.1" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/627499" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112212" + } + ], + "published": "2026-10-28T09:08:33.422Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/gitlab/BIT-gitlab-2026-112326.json b/data/gitlab/BIT-gitlab-2026-112326.json new file mode 100644 index 0000000000..5740767bfb --- /dev/null +++ b/data/gitlab/BIT-gitlab-2026-112326.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-gitlab-2026-112326", + "summary": "Improper Cleanup on Thrown Exception in GitLab", + "details": "GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to improper cleanup logic that failed to distinguish between pre-existing records from newly created ones during error handling.", + "aliases": [ + "CVE-2026-112326" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "17.8.0" + }, + { + "fixed": "19.3.6" + }, + { + "introduced": "19.4.0" + }, + { + "fixed": "19.4.3" + }, + { + "introduced": "19.5.0" + }, + { + "fixed": "19.5.1" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Low", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/633147" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112326" + } + ], + "published": "2026-10-28T09:08:34.909Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/gitlab/BIT-gitlab-2026-112378.json b/data/gitlab/BIT-gitlab-2026-112378.json new file mode 100644 index 0000000000..b0460204ca --- /dev/null +++ b/data/gitlab/BIT-gitlab-2026-112378.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-gitlab-2026-112378", + "summary": "Use of Less Trusted Source in GitLab", + "details": "GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.", + "aliases": [ + "CVE-2026-112378" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "17.8.0" + }, + { + "fixed": "19.3.6" + }, + { + "introduced": "19.4.0" + }, + { + "fixed": "19.4.3" + }, + { + "introduced": "19.5.0" + }, + { + "fixed": "19.5.1" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/634027" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112378" + } + ], + "published": "2026-10-28T09:08:36.400Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/gitlab/BIT-gitlab-2026-12664.json b/data/gitlab/BIT-gitlab-2026-12664.json new file mode 100644 index 0000000000..2f5003530b --- /dev/null +++ b/data/gitlab/BIT-gitlab-2026-12664.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-gitlab-2026-12664", + "summary": "Incorrect Authorization in GitLab", + "details": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a project's incoming email address and create work items, bypassing the token's restrictions, due to insufficient scope enforcement on a GraphQL field.", + "aliases": [ + "CVE-2026-12664" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "18.2.0" + }, + { + "fixed": "19.3.6" + }, + { + "introduced": "19.4.0" + }, + { + "fixed": "19.4.3" + }, + { + "introduced": "19.5.0" + }, + { + "fixed": "19.5.1" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/603510" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/3735499" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12664" + } + ], + "published": "2026-10-28T09:08:51.191Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/gitlab/BIT-gitlab-2026-13319.json b/data/gitlab/BIT-gitlab-2026-13319.json new file mode 100644 index 0000000000..614e1edc7f --- /dev/null +++ b/data/gitlab/BIT-gitlab-2026-13319.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-gitlab-2026-13319", + "summary": "Authorization Bypass Through User-Controlled Key in GitLab", + "details": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API.", + "aliases": [ + "CVE-2026-13319" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "15.10.0" + }, + { + "fixed": "19.3.6" + }, + { + "introduced": "19.4.0" + }, + { + "fixed": "19.4.3" + }, + { + "introduced": "19.5.0" + }, + { + "fixed": "19.5.1" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/604064" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/3792168" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13319" + } + ], + "published": "2026-10-28T09:08:59.937Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/gitlab/BIT-gitlab-2026-14288.json b/data/gitlab/BIT-gitlab-2026-14288.json new file mode 100644 index 0000000000..b1874894bf --- /dev/null +++ b/data/gitlab/BIT-gitlab-2026-14288.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-gitlab-2026-14288", + "summary": "Use of Incorrectly-Resolved Name or Reference in GitLab", + "details": "GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.", + "aliases": [ + "CVE-2026-14288" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "17.4.0" + }, + { + "fixed": "19.3.6" + }, + { + "introduced": "19.4.0" + }, + { + "fixed": "19.4.3" + }, + { + "introduced": "19.5.0" + }, + { + "fixed": "19.5.1" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Low", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/604630" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/3797008" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14288" + } + ], + "published": "2026-10-28T09:09:10.393Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/gitlab/BIT-gitlab-2026-15723.json b/data/gitlab/BIT-gitlab-2026-15723.json new file mode 100644 index 0000000000..4fbda8b499 --- /dev/null +++ b/data/gitlab/BIT-gitlab-2026-15723.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-gitlab-2026-15723", + "summary": "Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab", + "details": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.", + "aliases": [ + "CVE-2026-15723" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "10.1.0" + }, + { + "fixed": "19.3.6" + }, + { + "introduced": "19.4.0" + }, + { + "fixed": "19.4.3" + }, + { + "introduced": "19.5.0" + }, + { + "fixed": "19.5.1" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/605977" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/3852192" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15723" + } + ], + "published": "2026-10-28T09:09:30.801Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/gitlab/BIT-gitlab-2026-16255.json b/data/gitlab/BIT-gitlab-2026-16255.json new file mode 100644 index 0000000000..b1bb2f18c3 --- /dev/null +++ b/data/gitlab/BIT-gitlab-2026-16255.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-gitlab-2026-16255", + "summary": "Incorrect Authorization in GitLab", + "details": "GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the identity provider's control, due to incomplete enforcement of the membership lock on requests created before the lock was enabled.", + "aliases": [ + "CVE-2026-16255" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "12.0.0" + }, + { + "fixed": "19.3.6" + }, + { + "introduced": "19.4.0" + }, + { + "fixed": "19.4.3" + }, + { + "introduced": "19.5.0" + }, + { + "fixed": "19.5.1" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*", + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/606479" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/3809350" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16255" + } + ], + "published": "2026-10-28T09:09:36.652Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/golang/BIT-golang-2026-111943.json b/data/golang/BIT-golang-2026-111943.json new file mode 100644 index 0000000000..4788c77e09 --- /dev/null +++ b/data/golang/BIT-golang-2026-111943.json @@ -0,0 +1,71 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-golang-2026-111943", + "summary": "Distrust compromised intermediate certificates in crypto/x509", + "details": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.", + "aliases": [ + "CVE-2026-111943" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "golang", + "purl": "pkg:bitnami/golang" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.26.10" + }, + { + "introduced": "1.27.0-0" + }, + { + "fixed": "1.27.3" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Unknown", + "cpes": [ + "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/10/20/29" + }, + { + "type": "WEB", + "url": "https://go.dev/cl/851047" + }, + { + "type": "WEB", + "url": "https://go.dev/issue/82345" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/golang-announce/c/66pojueaQek" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943" + }, + { + "type": "WEB", + "url": "https://pkg.go.dev/vuln/GO-2026-6809" + } + ], + "published": "2026-10-28T08:46:44.863Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/grafana/BIT-grafana-2026-92539.json b/data/grafana/BIT-grafana-2026-92539.json new file mode 100644 index 0000000000..432cbc3f41 --- /dev/null +++ b/data/grafana/BIT-grafana-2026-92539.json @@ -0,0 +1,74 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-grafana-2026-92539", + "summary": "Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise", + "details": "A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.", + "aliases": [ + "CVE-2026-92539" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "grafana", + "purl": "pkg:bitnami/grafana" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "11.6.0" + }, + { + "fixed": "12.4.13" + }, + { + "introduced": "13.0.0" + }, + { + "fixed": "13.0.11" + }, + { + "introduced": "13.1.0" + }, + { + "fixed": "13.1.8" + }, + { + "introduced": "13.2.0" + }, + { + "fixed": "13.2.4" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*", + "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:go:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://grafana.com/security/security-advisories/cve-2026-92539" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92539" + } + ], + "published": "2026-10-28T08:46:34.616Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/libphp/BIT-libphp-2026-109618.json b/data/libphp/BIT-libphp-2026-109618.json index 6ff9421cc6..f755ec3352 100644 --- a/data/libphp/BIT-libphp-2026-109618.json +++ b/data/libphp/BIT-libphp-2026-109618.json @@ -78,8 +78,20 @@ { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2026/10/23/5" + }, + { + "type": "ADVISORY", + "url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/" + }, + { + "type": "ADVISORY", + "url": "https://php2shell.delftintellab.com" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618" } ], "published": "2026-10-22T08:04:26.105Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/libphp/BIT-libphp-2026-109619.json b/data/libphp/BIT-libphp-2026-109619.json index b3227a8023..f717bbffca 100644 --- a/data/libphp/BIT-libphp-2026-109619.json +++ b/data/libphp/BIT-libphp-2026-109619.json @@ -114,8 +114,20 @@ { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2026/10/23/4" + }, + { + "type": "ADVISORY", + "url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/" + }, + { + "type": "ADVISORY", + "url": "https://php2shell.delftintellab.com/" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619" } ], "published": "2026-10-22T08:04:27.070Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/libphp/BIT-libphp-2026-91767.json b/data/libphp/BIT-libphp-2026-91767.json index 4238532468..60a5025007 100644 --- a/data/libphp/BIT-libphp-2026-91767.json +++ b/data/libphp/BIT-libphp-2026-91767.json @@ -16,7 +16,7 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "ranges": [ @@ -60,7 +60,7 @@ }, "references": [ { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p" }, { @@ -69,5 +69,5 @@ } ], "published": "2026-10-01T09:29:25.110Z", - "modified": "2026-10-01T09:55:18.588Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/libphp/BIT-libphp-2026-91768.json b/data/libphp/BIT-libphp-2026-91768.json index 5b03386f99..4222daa688 100644 --- a/data/libphp/BIT-libphp-2026-91768.json +++ b/data/libphp/BIT-libphp-2026-91768.json @@ -60,7 +60,7 @@ }, "references": [ { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637" }, { @@ -69,5 +69,5 @@ } ], "published": "2026-10-01T09:29:26.219Z", - "modified": "2026-10-01T09:55:18.588Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/libphp/BIT-libphp-2026-92842.json b/data/libphp/BIT-libphp-2026-92842.json index f8fa91cc83..b4c9506510 100644 --- a/data/libphp/BIT-libphp-2026-92842.json +++ b/data/libphp/BIT-libphp-2026-92842.json @@ -60,7 +60,7 @@ }, "references": [ { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6" }, { @@ -69,5 +69,5 @@ } ], "published": "2026-10-01T09:29:28.495Z", - "modified": "2026-10-01T09:55:18.588Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/php-min/BIT-php-min-2026-109618.json b/data/php-min/BIT-php-min-2026-109618.json index 3221731820..b826ec178b 100644 --- a/data/php-min/BIT-php-min-2026-109618.json +++ b/data/php-min/BIT-php-min-2026-109618.json @@ -78,8 +78,20 @@ { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2026/10/23/5" + }, + { + "type": "ADVISORY", + "url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/" + }, + { + "type": "ADVISORY", + "url": "https://php2shell.delftintellab.com" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618" } ], "published": "2026-10-22T08:08:28.663Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/php-min/BIT-php-min-2026-109619.json b/data/php-min/BIT-php-min-2026-109619.json index 3eced04b59..7dd0fa4f36 100644 --- a/data/php-min/BIT-php-min-2026-109619.json +++ b/data/php-min/BIT-php-min-2026-109619.json @@ -114,8 +114,20 @@ { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2026/10/23/4" + }, + { + "type": "ADVISORY", + "url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/" + }, + { + "type": "ADVISORY", + "url": "https://php2shell.delftintellab.com/" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619" } ], "published": "2026-10-22T08:08:29.805Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/php-min/BIT-php-min-2026-91767.json b/data/php-min/BIT-php-min-2026-91767.json index 9e552d35ef..2fef2adb93 100644 --- a/data/php-min/BIT-php-min-2026-91767.json +++ b/data/php-min/BIT-php-min-2026-91767.json @@ -16,7 +16,7 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "ranges": [ @@ -60,7 +60,7 @@ }, "references": [ { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p" }, { @@ -69,5 +69,5 @@ } ], "published": "2026-10-01T09:34:20.769Z", - "modified": "2026-10-01T09:55:18.588Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/php-min/BIT-php-min-2026-91768.json b/data/php-min/BIT-php-min-2026-91768.json index b6ebb446cb..858be62ead 100644 --- a/data/php-min/BIT-php-min-2026-91768.json +++ b/data/php-min/BIT-php-min-2026-91768.json @@ -60,7 +60,7 @@ }, "references": [ { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637" }, { @@ -69,5 +69,5 @@ } ], "published": "2026-10-01T09:34:22.148Z", - "modified": "2026-10-01T09:55:18.588Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/php-min/BIT-php-min-2026-92842.json b/data/php-min/BIT-php-min-2026-92842.json index 4eec7ebfd0..34ede91eaa 100644 --- a/data/php-min/BIT-php-min-2026-92842.json +++ b/data/php-min/BIT-php-min-2026-92842.json @@ -60,7 +60,7 @@ }, "references": [ { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6" }, { @@ -69,5 +69,5 @@ } ], "published": "2026-10-01T09:34:25.216Z", - "modified": "2026-10-01T09:55:18.588Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/php/BIT-php-2026-109618.json b/data/php/BIT-php-2026-109618.json index 2bedadc195..90bd3f1085 100644 --- a/data/php/BIT-php-2026-109618.json +++ b/data/php/BIT-php-2026-109618.json @@ -78,8 +78,20 @@ { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2026/10/23/5" + }, + { + "type": "ADVISORY", + "url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/" + }, + { + "type": "ADVISORY", + "url": "https://php2shell.delftintellab.com" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618" } ], "published": "2026-10-22T08:08:19.155Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/php/BIT-php-2026-109619.json b/data/php/BIT-php-2026-109619.json index 4ba3d887a4..9f0ee1212d 100644 --- a/data/php/BIT-php-2026-109619.json +++ b/data/php/BIT-php-2026-109619.json @@ -114,8 +114,20 @@ { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2026/10/23/4" + }, + { + "type": "ADVISORY", + "url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/" + }, + { + "type": "ADVISORY", + "url": "https://php2shell.delftintellab.com/" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619" } ], "published": "2026-10-22T08:08:20.097Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/php/BIT-php-2026-91767.json b/data/php/BIT-php-2026-91767.json index c9e924e7f9..92c275d1ef 100644 --- a/data/php/BIT-php-2026-91767.json +++ b/data/php/BIT-php-2026-91767.json @@ -16,7 +16,7 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "ranges": [ @@ -60,7 +60,7 @@ }, "references": [ { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p" }, { @@ -69,5 +69,5 @@ } ], "published": "2026-10-01T09:34:08.275Z", - "modified": "2026-10-01T09:55:18.588Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/php/BIT-php-2026-91768.json b/data/php/BIT-php-2026-91768.json index 20cd6a084f..3a01d4d5e1 100644 --- a/data/php/BIT-php-2026-91768.json +++ b/data/php/BIT-php-2026-91768.json @@ -60,7 +60,7 @@ }, "references": [ { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637" }, { @@ -69,5 +69,5 @@ } ], "published": "2026-10-01T09:34:09.436Z", - "modified": "2026-10-01T09:55:18.588Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/php/BIT-php-2026-92842.json b/data/php/BIT-php-2026-92842.json index 1fcff482fa..d6e19f3533 100644 --- a/data/php/BIT-php-2026-92842.json +++ b/data/php/BIT-php-2026-92842.json @@ -60,7 +60,7 @@ }, "references": [ { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6" }, { @@ -69,5 +69,5 @@ } ], "published": "2026-10-01T09:34:11.972Z", - "modified": "2026-10-01T09:55:18.588Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112397.json b/data/pillow/BIT-pillow-2026-112397.json index 783fb19cd1..b48ba45bd3 100644 --- a/data/pillow/BIT-pillow-2026-112397.json +++ b/data/pillow/BIT-pillow-2026-112397.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:39.643Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112398.json b/data/pillow/BIT-pillow-2026-112398.json index 143b425c8e..95fb1ae03f 100644 --- a/data/pillow/BIT-pillow-2026-112398.json +++ b/data/pillow/BIT-pillow-2026-112398.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:40.925Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112399.json b/data/pillow/BIT-pillow-2026-112399.json index 98a00fa2c0..bd493bed8d 100644 --- a/data/pillow/BIT-pillow-2026-112399.json +++ b/data/pillow/BIT-pillow-2026-112399.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:42.079Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112400.json b/data/pillow/BIT-pillow-2026-112400.json index 1290d0c012..6d77d5bf8d 100644 --- a/data/pillow/BIT-pillow-2026-112400.json +++ b/data/pillow/BIT-pillow-2026-112400.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:43.287Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112401.json b/data/pillow/BIT-pillow-2026-112401.json index c5e60512b4..fd0dd6e97c 100644 --- a/data/pillow/BIT-pillow-2026-112401.json +++ b/data/pillow/BIT-pillow-2026-112401.json @@ -15,8 +15,8 @@ }, "severity": [ { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "ranges": [ @@ -35,22 +35,22 @@ } ], "database_specific": { - "severity": "Medium", + "severity": "High", "cpes": [ "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" ] }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-74r2-7ff9-mjj2" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:44.458Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112402.json b/data/pillow/BIT-pillow-2026-112402.json index 841599b73f..1389d9164c 100644 --- a/data/pillow/BIT-pillow-2026-112402.json +++ b/data/pillow/BIT-pillow-2026-112402.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:45.646Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112403.json b/data/pillow/BIT-pillow-2026-112403.json index f7d3405b43..7cd490d05b 100644 --- a/data/pillow/BIT-pillow-2026-112403.json +++ b/data/pillow/BIT-pillow-2026-112403.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:46.895Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112404.json b/data/pillow/BIT-pillow-2026-112404.json index ff1454c7a3..ca1dd37220 100644 --- a/data/pillow/BIT-pillow-2026-112404.json +++ b/data/pillow/BIT-pillow-2026-112404.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:48.125Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112405.json b/data/pillow/BIT-pillow-2026-112405.json index 5532131acf..9882c969a3 100644 --- a/data/pillow/BIT-pillow-2026-112405.json +++ b/data/pillow/BIT-pillow-2026-112405.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/b6ee66e8b2c2c0932bdf65f963268d9f2927ef86" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-cp9v-662q-vvx9" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:49.352Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112406.json b/data/pillow/BIT-pillow-2026-112406.json index 18a1e54759..b789a45b34 100644 --- a/data/pillow/BIT-pillow-2026-112406.json +++ b/data/pillow/BIT-pillow-2026-112406.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:50.663Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112891.json b/data/pillow/BIT-pillow-2026-112891.json index e1132c95d3..14493e20d7 100644 --- a/data/pillow/BIT-pillow-2026-112891.json +++ b/data/pillow/BIT-pillow-2026-112891.json @@ -15,8 +15,8 @@ }, "severity": [ { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "ranges": [ @@ -35,22 +35,22 @@ } ], "database_specific": { - "severity": "Medium", + "severity": "High", "cpes": [ "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" ] }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-fc9g-5qg7-mf45" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:51.869Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112892.json b/data/pillow/BIT-pillow-2026-112892.json index a305ffcdb9..35a8ae09df 100644 --- a/data/pillow/BIT-pillow-2026-112892.json +++ b/data/pillow/BIT-pillow-2026-112892.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:53.070Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112893.json b/data/pillow/BIT-pillow-2026-112893.json index 1dce6c9369..8d7e452540 100644 --- a/data/pillow/BIT-pillow-2026-112893.json +++ b/data/pillow/BIT-pillow-2026-112893.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:54.218Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112894.json b/data/pillow/BIT-pillow-2026-112894.json index 2fc8f591b0..b7dea2cf39 100644 --- a/data/pillow/BIT-pillow-2026-112894.json +++ b/data/pillow/BIT-pillow-2026-112894.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:55.425Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112895.json b/data/pillow/BIT-pillow-2026-112895.json index 3b7ccd8102..fcfc5ebcbe 100644 --- a/data/pillow/BIT-pillow-2026-112895.json +++ b/data/pillow/BIT-pillow-2026-112895.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/e2ae7eacad6de68c37eb28b633a97bebacf2c5bf" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-p4wg-p73j-c528" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:56.597Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112896.json b/data/pillow/BIT-pillow-2026-112896.json index 75d7e6289a..daa59f0328 100644 --- a/data/pillow/BIT-pillow-2026-112896.json +++ b/data/pillow/BIT-pillow-2026-112896.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:57.763Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112897.json b/data/pillow/BIT-pillow-2026-112897.json index c5becc04c6..bc5b89f725 100644 --- a/data/pillow/BIT-pillow-2026-112897.json +++ b/data/pillow/BIT-pillow-2026-112897.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-q45j-58j2-45rg" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:55:58.944Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112898.json b/data/pillow/BIT-pillow-2026-112898.json index ad2f4d7f8e..9814ec8e7b 100644 --- a/data/pillow/BIT-pillow-2026-112898.json +++ b/data/pillow/BIT-pillow-2026-112898.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/13943c8f857b22f073d30f0ef9b725a0d255f1a4" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-rfgq-q3w2-pmv2" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:56:00.220Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112900.json b/data/pillow/BIT-pillow-2026-112900.json index be7c9dcbe5..acef4718b9 100644 --- a/data/pillow/BIT-pillow-2026-112900.json +++ b/data/pillow/BIT-pillow-2026-112900.json @@ -42,15 +42,15 @@ }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/a2c363141da31a265dd536c945677db4b64f3ec9" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:56:01.518Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-112901.json b/data/pillow/BIT-pillow-2026-112901.json index 2081b6a4d4..ef38b5d648 100644 --- a/data/pillow/BIT-pillow-2026-112901.json +++ b/data/pillow/BIT-pillow-2026-112901.json @@ -15,8 +15,8 @@ }, "severity": [ { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "ranges": [ @@ -35,22 +35,22 @@ } ], "database_specific": { - "severity": "Medium", + "severity": "High", "cpes": [ "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" ] }, "references": [ { - "type": "WEB", + "type": "FIX", "url": "https://github.com/python-pillow/Pillow/commit/2852a3e3d568997ddec745fc800991f138878f4b" }, { - "type": "WEB", + "type": "ARTICLE", "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" }, { - "type": "WEB", + "type": "ADVISORY", "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xgh8-jp6q-p5x8" }, { @@ -59,5 +59,5 @@ } ], "published": "2026-10-26T05:56:02.790Z", - "modified": "2026-10-26T06:13:43.911Z" + "modified": "2026-10-28T09:14:33.188Z" } \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-114501.json b/data/pillow/BIT-pillow-2026-114501.json new file mode 100644 index 0000000000..968d9c3a53 --- /dev/null +++ b/data/pillow/BIT-pillow-2026-114501.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-pillow-2026-114501", + "summary": "Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1", + "details": "Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an aligned offset before the first row. The resulting Arrow buffer can include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. Applications that configure alignment and export images to Arrow can therefore disclose one user's pixels or other process memory to another user. This issue is fixed in version 13.0.0.", + "aliases": [ + "CVE-2026-114501" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "pillow", + "purl": "pkg:bitnami/pillow" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "11.2.1" + }, + { + "fixed": "13.0.0" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/19f64946eb247b973dd4560be7dea3bf979d2e6a" + }, + { + "type": "REPORT", + "url": "https://github.com/python-pillow/Pillow/pull/10172" + }, + { + "type": "ARTICLE", + "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" + }, + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-654x-cwwv-5j9c" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114501" + } + ], + "published": "2026-10-28T08:57:02.514Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-96636.json b/data/pillow/BIT-pillow-2026-96636.json new file mode 100644 index 0000000000..06689d5f9c --- /dev/null +++ b/data/pillow/BIT-pillow-2026-96636.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-pillow-2026-96636", + "summary": "Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)", + "details": "Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self._size without rerunning Image._decompression_bomb_check(). A crafted multi-frame image can use a tiny first frame to pass Image.open() and then declare an over-limit later frame. Normal frame iteration through seek(), load(), or ImageSequence.Iterator can decode that frame and commit hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0.", + "aliases": [ + "CVE-2026-96636" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "pillow", + "purl": "pkg:bitnami/pillow" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48" + }, + { + "type": "REPORT", + "url": "https://github.com/python-pillow/Pillow/pull/10011" + }, + { + "type": "ARTICLE", + "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" + }, + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-p8hx-v2p6-rp84" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96636" + } + ], + "published": "2026-10-28T08:57:26.449Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-96637.json b/data/pillow/BIT-pillow-2026-96637.json new file mode 100644 index 0000000000..c57e6544fe --- /dev/null +++ b/data/pillow/BIT-pillow-2026-96637.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-pillow-2026-96637", + "summary": "Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS", + "details": "Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.", + "aliases": [ + "CVE-2026-96637" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "pillow", + "purl": "pkg:bitnami/pillow" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/7cb0e02389d8aac2a60896a490f572db0b07b841" + }, + { + "type": "REPORT", + "url": "https://github.com/python-pillow/Pillow/pull/10076" + }, + { + "type": "ARTICLE", + "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" + }, + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g842-9rc4-69pw" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96637" + } + ], + "published": "2026-10-28T08:57:27.707Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-96638.json b/data/pillow/BIT-pillow-2026-96638.json new file mode 100644 index 0000000000..01b746141d --- /dev/null +++ b/data/pillow/BIT-pillow-2026-96638.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-pillow-2026-96638", + "summary": "Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode", + "details": "Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without a per-branch cap. A delta can add roughly 255 image rows in one iteration, so a kilobyte-sized file with a large but permitted width can expand the data bytearray to hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0.", + "aliases": [ + "CVE-2026-96638" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "pillow", + "purl": "pkg:bitnami/pillow" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "9.1.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/e7794835e323ff2691d9b3a974cade1a44301b9a" + }, + { + "type": "REPORT", + "url": "https://github.com/python-pillow/Pillow/pull/10015" + }, + { + "type": "ARTICLE", + "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" + }, + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-24rc-8hj2-v98c" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96638" + } + ], + "published": "2026-10-28T08:57:28.898Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-96639.json b/data/pillow/BIT-pillow-2026-96639.json new file mode 100644 index 0000000000..f234cd35f8 --- /dev/null +++ b/data/pillow/BIT-pillow-2026-96639.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-pillow-2026-96639", + "summary": "Pillow multi-frame loaders can reuse stale native image storage after mode transitions", + "details": "Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.", + "aliases": [ + "CVE-2026-96639" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "pillow", + "purl": "pkg:bitnami/pillow" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "11.0.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Critical", + "cpes": [ + "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/78d97d994579aef81aafe123773d525f40f2522a" + }, + { + "type": "REPORT", + "url": "https://github.com/python-pillow/Pillow/pull/10105" + }, + { + "type": "ARTICLE", + "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" + }, + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-v9pv-5gc8-w2m6" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96639" + } + ], + "published": "2026-10-28T08:57:30.104Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-96640.json b/data/pillow/BIT-pillow-2026-96640.json new file mode 100644 index 0000000000..4b8420b7ec --- /dev/null +++ b/data/pillow/BIT-pillow-2026-96640.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-pillow-2026-96640", + "summary": "Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion", + "details": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format=\"PDF\", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct pages. A compact malformed PDF can therefore create exponentially many page references and consume disproportionate CPU before the append completes. This issue is fixed in version 13.0.0.", + "aliases": [ + "CVE-2026-96640" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "pillow", + "purl": "pkg:bitnami/pillow" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "5.1.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7" + }, + { + "type": "REPORT", + "url": "https://github.com/python-pillow/Pillow/pull/10093" + }, + { + "type": "ARTICLE", + "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" + }, + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-mrfp-p49p-3hf2" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96640" + } + ], + "published": "2026-10-28T08:57:31.244Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-96641.json b/data/pillow/BIT-pillow-2026-96641.json new file mode 100644 index 0000000000..c8ec2b242e --- /dev/null +++ b/data/pillow/BIT-pillow-2026-96641.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-pillow-2026-96641", + "summary": "Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise", + "details": "Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX but does not check negative advances against INT_MIN. Repeating a signed 16-bit advance of -32768 can therefore execute a signed C integer overflow in xsize += dx, producing a large positive width from a negative mathematical result. Applications that use getlength(), getsize(), or derived layout, quota, serialization, or allocation calculations can experience logic-integrity errors or resource consumption, while the high-level mask path commonly retains a decompression-bomb check. This issue is fixed in version 13.0.0.", + "aliases": [ + "CVE-2026-96641" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "pillow", + "purl": "pkg:bitnami/pillow" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/80de4be9e38d3a6148dd4d8491eb80cd12b760a4" + }, + { + "type": "REPORT", + "url": "https://github.com/python-pillow/Pillow/pull/10010" + }, + { + "type": "ARTICLE", + "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" + }, + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-4rm8-3hmm-39fg" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96641" + } + ], + "published": "2026-10-28T08:57:32.422Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-96642.json b/data/pillow/BIT-pillow-2026-96642.json new file mode 100644 index 0000000000..6a95b47df3 --- /dev/null +++ b/data/pillow/BIT-pillow-2026-96642.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-pillow-2026-96642", + "summary": "Pillow: TarIO negative size field causes infinite CPU-spin loop", + "details": "Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.", + "aliases": [ + "CVE-2026-96642" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "pillow", + "purl": "pkg:bitnami/pillow" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d" + }, + { + "type": "REPORT", + "url": "https://github.com/python-pillow/Pillow/pull/10012" + }, + { + "type": "ARTICLE", + "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" + }, + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96642" + } + ], + "published": "2026-10-28T08:57:33.641Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-96643.json b/data/pillow/BIT-pillow-2026-96643.json new file mode 100644 index 0000000000..df23101662 --- /dev/null +++ b/data/pillow/BIT-pillow-2026-96643.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-pillow-2026-96643", + "summary": "Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time", + "details": "Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.", + "aliases": [ + "CVE-2026-96643" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "pillow", + "purl": "pkg:bitnami/pillow" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "11.0.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c" + }, + { + "type": "REPORT", + "url": "https://github.com/python-pillow/Pillow/pull/10073" + }, + { + "type": "ARTICLE", + "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" + }, + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96643" + } + ], + "published": "2026-10-28T08:57:34.820Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-96644.json b/data/pillow/BIT-pillow-2026-96644.json new file mode 100644 index 0000000000..c927006dd3 --- /dev/null +++ b/data/pillow/BIT-pillow-2026-96644.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-pillow-2026-96644", + "summary": "Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)", + "details": "Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using the original full dimensions. A crafted wide, short metafile can pass the pixel-count decompression-bomb check and make the Windows-only renderer read beyond the heap buffer, potentially disclosing memory or crashing the process. This issue is fixed in version 13.0.0.", + "aliases": [ + "CVE-2026-96644" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "pillow", + "purl": "pkg:bitnami/pillow" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.0" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/4cf46bee338304c5c8968fd7f132ba0d40c428b7" + }, + { + "type": "REPORT", + "url": "https://github.com/python-pillow/Pillow/pull/10120" + }, + { + "type": "ARTICLE", + "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" + }, + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9v9v-9qvf-h2hj" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96644" + } + ], + "published": "2026-10-28T08:57:35.922Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/pillow/BIT-pillow-2026-96778.json b/data/pillow/BIT-pillow-2026-96778.json new file mode 100644 index 0000000000..d20bde0cc5 --- /dev/null +++ b/data/pillow/BIT-pillow-2026-96778.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-pillow-2026-96778", + "summary": "Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer", + "details": "Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted free_in_buffer counter, which then wraps and permits the attacker-controlled comment and subsequent compressed image data to overwrite adjacent heap memory. Re-saving an untrusted image as JPEG while preserving its ICC profile and forwarded comment can crash the process and may enable code execution in suitable runtime and heap layouts. This issue is fixed in version 13.0.0.", + "aliases": [ + "CVE-2026-96778" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "pillow", + "purl": "pkg:bitnami/pillow" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "9.4.0" + }, + { + "fixed": "13.0.0" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "FIX", + "url": "https://github.com/python-pillow/Pillow/commit/02561b8dc6117d5670d4b469fecdd02c70854f9b" + }, + { + "type": "REPORT", + "url": "https://github.com/python-pillow/Pillow/pull/10124" + }, + { + "type": "ARTICLE", + "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0" + }, + { + "type": "ADVISORY", + "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g7cr-3p24-7wf7" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96778" + } + ], + "published": "2026-10-28T08:57:37.147Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/rclone/BIT-rclone-2026-116191.json b/data/rclone/BIT-rclone-2026-116191.json new file mode 100644 index 0000000000..f5d3c8b1a6 --- /dev/null +++ b/data/rclone/BIT-rclone-2026-116191.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-rclone-2026-116191", + "summary": "Rclone before 1.75.2 Path Traversal via serve webdav MKCOL", + "details": "Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.", + "aliases": [ + "CVE-2026-116191" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "rclone", + "purl": "pkg:bitnami/rclone" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.75.2" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116191" + }, + { + "type": "ADVISORY", + "url": "https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-serve-webdav-mkcol" + } + ], + "published": "2026-10-28T08:57:52.700Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/rclone/BIT-rclone-2026-116192.json b/data/rclone/BIT-rclone-2026-116192.json new file mode 100644 index 0000000000..80ffe59133 --- /dev/null +++ b/data/rclone/BIT-rclone-2026-116192.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-rclone-2026-116192", + "summary": "rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots", + "details": "rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.", + "aliases": [ + "CVE-2026-116192" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "rclone", + "purl": "pkg:bitnami/rclone" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "1.37.0" + }, + { + "fixed": "1.74.2" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/rclone/rclone/security/advisories/GHSA-xqmq-v4wj-rw5m" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116192" + }, + { + "type": "ADVISORY", + "url": "https://www.vulncheck.com/advisories/rclone-from-1.37-before-1.74.2-ssrf-via-rc-serve-scheme-relative-remote-roots" + } + ], + "published": "2026-10-28T08:57:53.909Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/rclone/BIT-rclone-2026-116193.json b/data/rclone/BIT-rclone-2026-116193.json new file mode 100644 index 0000000000..d85da20b17 --- /dev/null +++ b/data/rclone/BIT-rclone-2026-116193.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-rclone-2026-116193", + "summary": "Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests", + "details": "Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.", + "aliases": [ + "CVE-2026-116193" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "rclone", + "purl": "pkg:bitnami/rclone" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "1.64.0" + }, + { + "fixed": "1.75.2" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116193" + }, + { + "type": "ADVISORY", + "url": "https://www.vulncheck.com/advisories/rclone-1.64.0-before-1.75.2-serve-webdav-authentication-bypass-via-options-requests" + } + ], + "published": "2026-10-28T08:57:55.102Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/rclone/BIT-rclone-2026-116194.json b/data/rclone/BIT-rclone-2026-116194.json new file mode 100644 index 0000000000..42ddad0ab4 --- /dev/null +++ b/data/rclone/BIT-rclone-2026-116194.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-rclone-2026-116194", + "summary": "Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback", + "details": "Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.", + "aliases": [ + "CVE-2026-116194" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "rclone", + "purl": "pkg:bitnami/rclone" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "1.52.0" + }, + { + "fixed": "1.75.2" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116194" + }, + { + "type": "ADVISORY", + "url": "https://www.vulncheck.com/advisories/rclone-1.52.0-before-1.75.2-csrf-via-pcloud-oauth-callback" + } + ], + "published": "2026-10-28T08:57:56.299Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/rclone/BIT-rclone-2026-116195.json b/data/rclone/BIT-rclone-2026-116195.json new file mode 100644 index 0000000000..f5b07bc628 --- /dev/null +++ b/data/rclone/BIT-rclone-2026-116195.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-rclone-2026-116195", + "summary": "Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim", + "details": "Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.", + "aliases": [ + "CVE-2026-116195" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "rclone", + "purl": "pkg:bitnami/rclone" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.75.2" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116195" + }, + { + "type": "ADVISORY", + "url": "https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-translatelink-rclonelink-suffix-trim" + } + ], + "published": "2026-10-28T08:57:57.491Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/rclone/BIT-rclone-2026-116196.json b/data/rclone/BIT-rclone-2026-116196.json new file mode 100644 index 0000000000..07a03bcec3 --- /dev/null +++ b/data/rclone/BIT-rclone-2026-116196.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-rclone-2026-116196", + "summary": "Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url", + "details": "Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-host redirects disclosing SSE-C customer encryption keys.", + "aliases": [ + "CVE-2026-116196" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "rclone", + "purl": "pkg:bitnami/rclone" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.75.2" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/rclone/rclone/security/advisories/GHSA-gpw7-77cq-9f72" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116196" + }, + { + "type": "ADVISORY", + "url": "https://www.vulncheck.com/advisories/rclone-before-1.75.2-b2-credential-leak-on-redirect-via-b2-download-url" + } + ], + "published": "2026-10-28T08:57:58.716Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/tomcat/BIT-tomcat-2026-101356.json b/data/tomcat/BIT-tomcat-2026-101356.json new file mode 100644 index 0000000000..858adf0503 --- /dev/null +++ b/data/tomcat/BIT-tomcat-2026-101356.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-tomcat-2026-101356", + "summary": "Apache Tomcat: HTTP/2 request/response mix-up after error during async processing", + "details": "Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.", + "aliases": [ + "CVE-2026-101356" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "tomcat", + "purl": "pkg:bitnami/tomcat" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "9.0.118" + }, + { + "fixed": "9.0.123" + }, + { + "introduced": "10.1.55" + }, + { + "fixed": "10.1.61" + }, + { + "introduced": "11.0.22" + }, + { + "fixed": "11.0.27" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Critical", + "cpes": [ + "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "cpe:2.3:a:apache:tomcat:*:*:*:*:*:maven:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/10/20/27" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101356" + } + ], + "published": "2026-10-28T09:00:37.156Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/tomcat/BIT-tomcat-2026-80353.json b/data/tomcat/BIT-tomcat-2026-80353.json new file mode 100644 index 0000000000..52d660b7b2 --- /dev/null +++ b/data/tomcat/BIT-tomcat-2026-80353.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-tomcat-2026-80353", + "summary": "Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector", + "details": "Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector.\n\n\n\nThis issue affects Apache Tomcat: from 9.0.47 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 9.0.123, which fixes the issue.", + "aliases": [ + "CVE-2026-80353" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "tomcat", + "purl": "pkg:bitnami/tomcat" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "9.0.47" + }, + { + "fixed": "9.0.123" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Unknown", + "cpes": [ + "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "cpe:2.3:a:apache:tomcat:*:*:*:*:*:maven:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/tr0q87qwvs80p9hc53tkwpzvnx0ywftr" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80353" + } + ], + "published": "2026-10-28T09:01:41.365Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113713.json b/data/virtualenv/BIT-virtualenv-2026-113713.json new file mode 100644 index 0000000000..9175eb550d --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113713.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113713", + "summary": "virtualenv: Temporary app-data can leave dangling seed package links", + "details": "virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.", + "aliases": [ + "CVE-2026-113713" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "21.14.8" + }, + { + "fixed": "21.14.10" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/pull/3437" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.10" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113713" + } + ], + "published": "2026-10-28T09:00:03.797Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113714.json b/data/virtualenv/BIT-virtualenv-2026-113714.json new file mode 100644 index 0000000000..1c7cb02a2d --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113714.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113714", + "summary": "virtualenv: Downloaded wheel selection and caching precede verification", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled, a controlled package index can inject a misleading Saved line through a discarded link's data-requires-python attribute; this forged-line variant also requires knowledge of an absolute path to the genuine bundled wheel. The wrong path can then be hashed, while a digest mismatch leaves the rejected archive in the cache for later selection without verification. A separate rejected-cache-file variant requires control over downloaded data or archive selection but not the forged-line prerequisites. Explicit custom-index exceptions are outside the promised PyPI comparison, and the issue does not independently bypass TLS or establish control of default PyPI. This issue is fixed in version 21.14.9.", + "aliases": [ + "CVE-2026-113714" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Low", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/pull/3430" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113714" + } + ], + "published": "2026-10-28T09:00:04.986Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113715.json b/data/virtualenv/BIT-virtualenv-2026-113715.json new file mode 100644 index 0000000000..cf90bb1565 --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113715.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113715", + "summary": "virtualenv: Venv configuration readback can reinterpret path boundaries", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.", + "aliases": [ + "CVE-2026-113715" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Low", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/pull/3426" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113715" + } + ], + "published": "2026-10-28T09:00:06.201Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113716.json b/data/virtualenv/BIT-virtualenv-2026-113716.json new file mode 100644 index 0000000000..6d9a92c06c --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113716.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113716", + "summary": "virtualenv: Builtin creation follows linked environment directories", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure_dir() for executable, library, and package directories, and ensure_dir() accepts an existing symlink to a directory because exists() follows it. Interpreter creation, seed installation, and activation generation then write through the linked parent outside the requested destination when another local account prepared the tree and the invoking user can access the target. The --clear option removes the planted tree first, while ordinary creation reaches it; arbitrary attacker-selected output bytes are not established. This issue is fixed in version 21.14.9.", + "aliases": [ + "CVE-2026-113716" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/554d9f9d4f7758f5cf53f993031e29787f1f74c5" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/pull/3429" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-cw65-gx24-rc82" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113716" + } + ], + "published": "2026-10-28T09:00:07.463Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113717.json b/data/virtualenv/BIT-virtualenv-2026-113717.json new file mode 100644 index 0000000000..740e6db2ce --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113717.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113717", + "summary": "virtualenv: Pip seeding with download omits wheel digest verification", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and verify_wheel_digest() path. When virtualenv's default-index PyPI digest comparison remains enabled, an index candidate matching the bundled package and version can therefore be selected without comparison to PyPI SHA-256 metadata. Explicit custom-index settings already opt out of that comparison and remain outside this verification-bypass claim; the demonstrated configuration used a non-PyPI index while leaving the index environment variables unset so the comparison policy remained active. This condition does not independently defeat TLS or establish control of the index response. This issue is fixed in version 21.14.9.", + "aliases": [ + "CVE-2026-113717" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Low", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/pull/3430" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113717" + } + ], + "published": "2026-10-28T09:00:08.670Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113718.json b/data/virtualenv/BIT-virtualenv-2026-113718.json new file mode 100644 index 0000000000..43a1a53448 --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113718.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113718", + "summary": "virtualenv: Xonsh activation literals depend on the script decoding codec", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSH_ENCODING. Under a legacy multibyte codec such as GBK or Big5, a UTF-8 trail byte can consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the user sources the generated script. This issue is fixed in version 21.14.9.", + "aliases": [ + "CVE-2026-113718" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/pull/3432" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113718" + } + ], + "published": "2026-10-28T09:00:09.827Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113719.json b/data/virtualenv/BIT-virtualenv-2026-113719.json new file mode 100644 index 0000000000..421adcb0fa --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113719.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113719", + "summary": "virtualenv: Seed replacement does not contain metadata deletion paths", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause app-data reseeding to delete files outside the environment or the environment root with the invoking user's permissions, provided that user has deletion rights over the named paths. The deletion occurs during environment creation before any later use of the environment. Fresh environments without existing package metadata and creation with --clear do not enter this cleanup path. This issue is fixed in version 21.14.9.", + "aliases": [ + "CVE-2026-113719" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/pull/3428" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113719" + } + ], + "published": "2026-10-28T09:00:11.041Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113720.json b/data/virtualenv/BIT-virtualenv-2026-113720.json new file mode 100644 index 0000000000..18162f9148 --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113720.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113720", + "summary": "virtualenv: Seeded files retain permissions from an older cache", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.", + "aliases": [ + "CVE-2026-113720" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/35f0b33562790176dd186d0a3c517af3acc7a0e1" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/pull/3425" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-fc2g-4w5p-6whm" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113720" + } + ], + "published": "2026-10-28T09:00:12.220Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113721.json b/data/virtualenv/BIT-virtualenv-2026-113721.json new file mode 100644 index 0000000000..3daf16ee18 --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113721.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113721", + "summary": "virtualenv: Generated files can follow existing destination links", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write() opens pyvenv.cfg without first replacing an existing symbolic or hard link. Another local account that prepares final entries inside the destination can therefore cause environment creation to create or overwrite files outside the requested tree with constrained virtualenv-generated content and the invoking user's permissions. The destination parent must remain controlled by the environment owner during creation; concurrent parent-directory replacement is a separate concern. This issue is fixed in version 21.14.9.", + "aliases": [ + "CVE-2026-113721" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/pull/3431" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-558c-9hv2-4prj" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113721" + } + ], + "published": "2026-10-28T09:00:13.457Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113722.json b/data/virtualenv/BIT-virtualenv-2026-113722.json new file mode 100644 index 0000000000..4fc8960190 --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113722.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113722", + "summary": "virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks. An attacker who influences the environment destination can therefore execute commands with the user's privileges when the user later runs a generated launcher; environment creation and activation do not trigger the command. Existing launchers are not repaired by upgrading virtualenv alone and must be regenerated, while a later independent pip installation or upgrade can reintroduce an affected launcher because pip's vendored distlib is unchanged. The virtualenv fix is released in version 21.14.9.", + "aliases": [ + "CVE-2026-113722" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/2519941bed33ee0d3ac99277f67913e439e476a9" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/pull/3417" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-c978-59m8-c77v" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113722" + } + ], + "published": "2026-10-28T09:00:14.695Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113723.json b/data/virtualenv/BIT-virtualenv-2026-113723.json new file mode 100644 index 0000000000..c0961d6fdc --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113723.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113723", + "summary": "virtualenv: Bash prompt values can change meaning under older compatibility modes", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. This vulnerability is fixed in 21.14.9.", + "aliases": [ + "CVE-2026-113723" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/pull/3418" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113723" + } + ], + "published": "2026-10-28T09:00:15.913Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113724.json b/data/virtualenv/BIT-virtualenv-2026-113724.json new file mode 100644 index 0000000000..aa2b819820 --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113724.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113724", + "summary": "virtualenv: Deletion recovery can change a symlink target's mode", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path) and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted link inside a read-only directory can therefore cause a victim-owned target outside the destination that is initially not writable by the invoking user to become broadly writable before the retry fails, provided that user owns the target and can change its mode. Another account can use the widened mode only if it can traverse the target's parent directories; root does not reach the demonstrated failure path, and the operation does not itself read the target. This issue is fixed in version 21.14.9.", + "aliases": [ + "CVE-2026-113724" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/pull/3427" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.9" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113724" + } + ], + "published": "2026-10-28T09:00:17.100Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113725.json b/data/virtualenv/BIT-virtualenv-2026-113725.json new file mode 100644 index 0000000000..ea06aea918 --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113725.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113725", + "summary": "virtualenv bash activate runs commands from an environment name with a backslash before $", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing \\$(...) runs as commands in the user's shell each time bash draws the prompt. This issue is fixed in version 21.14.7.", + "aliases": [ + "CVE-2026-113725" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.7" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/c3104e02474b652832a9bbaae79f6e1696296932" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.7" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-vxj4-q4g9-crj7" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113725" + } + ], + "published": "2026-10-28T09:00:18.319Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113726.json b/data/virtualenv/BIT-virtualenv-2026-113726.json new file mode 100644 index 0000000000..79aa533f29 --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113726.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113726", + "summary": "virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH_VERSION is set, so zsh receives the raw value. The script assigns that value to PS1. In zsh with PROMPT_SUBST, an attacker-influenced environment directory, --prompt, or VIRTUALENV_PROMPT value containing command, parameter, or arithmetic expansion syntax can therefore execute commands in the user's shell each time the prompt is drawn. A percent sign is separately interpreted as a zsh prompt escape but does not by itself execute commands. Plain zsh with PROMPT_SUBST disabled and bash are not affected by this mechanism. This issue is fixed in version 21.14.4.", + "aliases": [ + "CVE-2026-113726" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.4" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.4" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113726" + } + ], + "published": "2026-10-28T09:00:19.518Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113732.json b/data/virtualenv/BIT-virtualenv-2026-113732.json new file mode 100644 index 0000000000..8c9837f2c2 --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113732.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113732", + "summary": "virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote", + "details": "virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or VIRTUALENV_PROMPT value containing a backslash before a quote can therefore terminate the generated fish literal and execute command substitution when the user sources activate.fish. This issue is fixed in version 21.14.2.", + "aliases": [ + "CVE-2026-113732" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.14.2" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.2" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113732" + } + ], + "published": "2026-10-28T09:00:20.646Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file diff --git a/data/virtualenv/BIT-virtualenv-2026-113776.json b/data/virtualenv/BIT-virtualenv-2026-113776.json new file mode 100644 index 0000000000..2402313022 --- /dev/null +++ b/data/virtualenv/BIT-virtualenv-2026-113776.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.6.2", + "id": "BIT-virtualenv-2026-113776", + "summary": "virtualenv activation scripts run code from a path that contains a placeholder name", + "details": "virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the complete activation template, so trigger names such as __VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__ inside an already substituted and quoted environment path or prompt can be replaced during a later pass. The later value's quoting can close the earlier literal and execute the remaining path when a user activates the environment through bash, fish, xonsh, or activate_this.py. The distinct csh prompt-display token __VIRTUAL_PROMPT_DISPLAY_TCSH__ can instead break the generated script without establishing command execution. The attacker must influence the destination path or --prompt, and a value without a relevant placeholder name does not trigger this mechanism. This issue is fixed in version 21.14.2.", + "aliases": [ + "CVE-2026-113776" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "virtualenv", + "purl": "pkg:bitnami/virtualenv" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "20.26.6" + }, + { + "fixed": "21.14.2" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "High", + "cpes": [ + "cpe:2.3:a:virtualenv:virtualenv:*:*:*:*:*:python:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/releases/tag/21.14.2" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/virtualenv/security/advisories/GHSA-8rjx-v5ww-45pp" + }, + { + "type": "WEB", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113776" + } + ], + "published": "2026-10-28T09:00:21.852Z", + "modified": "2026-10-28T09:14:33.188Z" +} \ No newline at end of file