CWE-20

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Stirling-PDF",
          "vendor": "Stirling-Tools",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.13.1, \u003c 2.13.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses SvgSanitizer.isExternalUrl() before Batik resolves it against the file:///input.svg document base as a same-origin local file. The convert() and addSvgAsPage() paths in app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java can then render image-decodable server files into the returned PDF when sanitization is enabled, including without authentication on login-disabled deployments or with non-admin access when login is enabled. The issue discloses PNG, JPG, GIF, or SVG content and provides an existence oracle only for image-decodable paths; plain text, binary files, directories, XInclude text, external entities, explicit file URLs, and tested HTTP references are not disclosed through this mechanism. This issue is fixed in version 2.13.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-610",
              "description": "CWE-610: Externally Controlled Reference to a Resource in Another Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T20:28:30.049Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-pr4g-9qp2-g8j8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-pr4g-9qp2-g8j8"
        },
        {
          "name": "https://github.com/Stirling-Tools/Stirling-PDF/pull/6796",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Stirling-Tools/Stirling-PDF/pull/6796"
        },
        {
          "name": "https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5"
        },
        {
          "name": "https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.13.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.13.2"
        }
      ],
      "source": {
        "advisory": "GHSA-pr4g-9qp2-g8j8",
        "discovery": "UNKNOWN"
      },
      "title": "Stirling-PDF: SVG\u2192PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119342",
    "datePublished": "2026-10-30T20:28:30.049Z",
    "dateReserved": "2026-10-29T20:44:30.286Z",
    "dateUpdated": "2026-10-30T20:28:30.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119339",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T21:18:18.116329Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T22:13:31.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tesseract",
          "vendor": "tesseract-ocr",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.5.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-617",
              "description": "CWE-617: Reachable Assertion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T20:13:37.931Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-h9g4-frjx-6cj3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-h9g4-frjx-6cj3"
        },
        {
          "name": "https://github.com/tesseract-ocr/tesseract/pull/4657",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tesseract-ocr/tesseract/pull/4657"
        },
        {
          "name": "https://github.com/tesseract-ocr/tesseract/commit/c053424327352b9d5180aa7540c1f9e67c64f27e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tesseract-ocr/tesseract/commit/c053424327352b9d5180aa7540c1f9e67c64f27e"
        },
        {
          "name": "https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.4"
        }
      ],
      "source": {
        "advisory": "GHSA-h9g4-frjx-6cj3",
        "discovery": "UNKNOWN"
      },
      "title": "Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) triggers `ASSERT_HOST` abort in `WeightMatrix::DeSerializeOld` under `FAST_FLOAT` \u2014 Denial of Service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119339",
    "datePublished": "2026-10-30T20:13:37.931Z",
    "dateReserved": "2026-10-29T20:44:30.286Z",
    "dateUpdated": "2026-10-30T22:13:31.619Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119280",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T17:09:58.150194Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T17:10:10.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mariadb-connector-j",
          "vendor": "mariadb-corporation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.4.0, \u003c 3.4.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.5.0, \u003c 3.5.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T20:55:50.101Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-4jq2-8v3c-97w8"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/280efcfb4390055858fa2dd12b722d85a6a13ab8"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/47aba5a23548b35191865a428cc674316b95ee47"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"
        }
      ],
      "source": {
        "advisory": "GHSA-4jq2-8v3c-97w8",
        "discovery": "UNKNOWN"
      },
      "title": "MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119280",
    "datePublished": "2026-10-29T20:55:50.101Z",
    "dateReserved": "2026-10-29T18:50:28.064Z",
    "dateUpdated": "2026-10-30T17:10:10.174Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "mariadb-connector-j",
          "vendor": "mariadb-corporation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.4.0, \u003c 3.4.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.5.0, \u003c 3.5.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a machine-in-the-middle attacker, could return crafted database or table identifiers that the connector reused in metadata or updatable-result queries, then answer with a LOCAL INFILE request for a client file. With allowLocalInfile enabled, this caused the connector to stream any readable client-host file named by the crafted text, including through DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T20:45:38.135Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-fhx5-2xqw-2cgm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-fhx5-2xqw-2cgm"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/4d2f8002399949ed7f138e9c0b75b69229538120",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/4d2f8002399949ed7f138e9c0b75b69229538120"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/5812e0ca7574c3934915179b76f2e819a556d099",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/5812e0ca7574c3934915179b76f2e819a556d099"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/a4891f877f1c885a573194771c1ed0aacec0ce1d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/commit/a4891f877f1c885a573194771c1ed0aacec0ce1d"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.3.7"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.4.5"
        },
        {
          "name": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mariadb-corporation/mariadb-connector-j/releases/tag/3.5.11"
        }
      ],
      "source": {
        "advisory": "GHSA-fhx5-2xqw-2cgm",
        "discovery": "UNKNOWN"
      },
      "title": "MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119210",
    "datePublished": "2026-10-29T20:45:38.135Z",
    "dateReserved": "2026-10-29T16:04:48.729Z",
    "dateUpdated": "2026-10-29T20:45:38.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119130",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T20:14:38.866656Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T20:14:54.045Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/wasmtime-wasi-http",
          "product": "wasmtime",
          "vendor": "bytecodealliance",
          "versions": [
            {
              "lessThan": "36.0.18",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "36.0.18",
              "versionType": "semver"
            },
            {
              "lessThan": "48.0.6",
              "status": "affected",
              "version": "37.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "48.0.6",
              "versionType": "semver"
            },
            {
              "lessThan": "49.0.3",
              "status": "affected",
              "version": "49.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "49.0.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "36.0.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "48.0.6",
                  "versionStartIncluding": "37.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "49.0.3",
                  "versionStartIncluding": "49.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T15:58:12.004Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5qpp-g3j2-8frx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx"
        },
        {
          "name": "VulnCheck Advisory: Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/wasmtime-before-36.0.18-37.0.0-before-48.0.6-and-49.0.0-before-49.0.3-http-request-target-smuggling"
        }
      ],
      "title": "Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119130",
    "datePublished": "2026-10-29T15:58:12.004Z",
    "dateReserved": "2026-10-29T14:26:15.522Z",
    "dateUpdated": "2026-10-29T20:14:54.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "forge",
          "vendor": "digitalbazaar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKCS#7 padding during CBC and ECB decryption and accepted zero, oversized, or mismatched padding bytes. Malformed ciphertext could consequently be accepted and up to four plaintext blocks could be silently removed, causing an integrity failure in applications that treated successful decryption as proof of valid padding. This issue is fixed in version 1.4.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354: Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T18:37:32.362Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-2vgq-wchc-25w7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-2vgq-wchc-25w7"
        },
        {
          "name": "https://github.com/digitalbazaar/forge/commit/81774ff99e2da64aec9a43591df45a360040c136",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/digitalbazaar/forge/commit/81774ff99e2da64aec9a43591df45a360040c136"
        },
        {
          "name": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"
        }
      ],
      "source": {
        "advisory": "GHSA-2vgq-wchc-25w7",
        "discovery": "UNKNOWN"
      },
      "title": "Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118776",
    "datePublished": "2026-10-29T18:37:32.362Z",
    "dateReserved": "2026-10-28T19:20:05.018Z",
    "dateUpdated": "2026-10-29T18:37:32.362Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2ui:a2ui:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Image Player/Video Player/Audio Player"
          ],
          "product": "a2ui",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "0.10.0"
            },
            {
              "status": "affected",
              "version": "0.10.1"
            },
            {
              "status": "affected",
              "version": "0.10.2"
            },
            {
              "status": "affected",
              "version": "0.10.3"
            },
            {
              "status": "affected",
              "version": "0.10.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "ez-lbz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T21:45:16.400Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-428014 | a2ui Image Player/Video Player/Audio Player Image.js input validation",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/428014"
        },
        {
          "name": "VDB-428014 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/428014/cti"
        },
        {
          "name": "CVE-2026-118537 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-118537"
        },
        {
          "name": "Submit #1020092 | a2ui-project a2ui \u003c=0.10.4 CWE-20",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1020092"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/a2ui-project/a2ui/issues/3077"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/a2ui-project/a2ui/pull/3108"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-28T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-28T16:54:57.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2ui Image Player/Video Player/Audio Player Image.js input validation",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-118537",
    "datePublished": "2026-10-28T21:45:16.400Z",
    "dateReserved": "2026-10-28T15:49:48.340Z",
    "dateUpdated": "2026-10-28T21:45:16.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp-guard:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "src/mispguard.py"
          ],
          "product": "misp-guard",
          "programFiles": [
            "src/mispguard.py"
          ],
          "repo": "https://github.com/MISP/misp-guard",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Luciano Righetti"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy (for example, TLP), the guard only verified that at least one tag of that taxonomy matched the configured allowed list. It did not verify that every tag of the required taxonomy present on the event or attribute was in the allowed list. As a result, an event or attribute could simultaneously carry an allowed tag (e.g., tlp:clear) and a non-allowed tag (e.g., tlp:red or tlp:amber) and still pass the guard\u0027s policy check. This allowed data marked with a higher classification or sensitivity level to be distributed through feeds configured to only distribute lower-classification data, effectively bypassing the intended data-handling restrictions. The vulnerability affected both event-level and attribute-level tag validation, including attributes nested within objects and shadow attributes. An attacker with the ability to author or modify MISP events in a feed source could include non-allowed taxonomy tags alongside allowed ones to exfiltrate more sensitive data to feed consumers than the guard policy intended to permit.\u003c/p\u003e"
            }
          ],
          "value": "MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy (for example, TLP), the guard only verified that at least one tag of that taxonomy matched the configured allowed list. It did not verify that every tag of the required taxonomy present on the event or attribute was in the allowed list. As a result, an event or attribute could simultaneously carry an allowed tag (e.g., tlp:clear) and a non-allowed tag (e.g., tlp:red or tlp:amber) and still pass the guard\u0027s policy check. This allowed data marked with a higher classification or sensitivity level to be distributed through feeds configured to only distribute lower-classification data, effectively bypassing the intended data-handling restrictions. The vulnerability affected both event-level and attribute-level tag validation, including attributes nested within objects and shadow attributes. An attacker with the ability to author or modify MISP events in a feed source could include non-allowed taxonomy tags alongside allowed ones to exfiltrate more sensitive data to feed consumers than the guard policy intended to permit."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-120",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-120 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-27T18:09:46Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T18:11:51.815Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/misp-guard/commit/6127d94c350e4dfe31fd4426ba26f51294ed3867"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix introduces a new validation function, check_required_taxonomy_tags_allowed, that iterates over every tag belonging to a required taxonomy and verifies each one is present in the configured allowed-tags list, raising a ForbiddenException if any tag is not allowed. This check is applied at both the event level and the attribute level. Additionally, an inherit_event_taxonomies flag is introduced so that attributes without their own required-taxonomy tags inherit the event\u0027s already-validated taxonomy, while attributes that do carry tags of the required taxonomy are still fully validated against the allowed list. This ensures that no non-allowed tag of a required taxonomy can pass the guard regardless of whether an allowed tag is also present.\u003c/p\u003e"
            }
          ],
          "value": "The fix introduces a new validation function, check_required_taxonomy_tags_allowed, that iterates over every tag belonging to a required taxonomy and verifies each one is present in the configured allowed-tags list, raising a ForbiddenException if any tag is not allowed. This check is applied at both the event level and the attribute level. Additionally, an inherit_event_taxonomies flag is introduced so that attributes without their own required-taxonomy tags inherit the event\u0027s already-validated taxonomy, while attributes that do carry tags of the required taxonomy are still fully validated against the allowed list. This ensures that no non-allowed tag of a required taxonomy can pass the guard regardless of whether an allowed tag is also present."
        }
      ],
      "title": "MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "partial",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The CAPEC-120 mapping is the closest available match but is not a perfect fit; the attack involves manipulation of structured MISP event tag fields rather than traditional HTTP parameters. No more specific CAPEC for structured-data tag manipulation exists in the CAPEC catalog.",
                  "The CVSS PR:H assumption is based on the inference that an attacker needs write access to a MISP instance to author events with non-allowed tags. If the guard is deployed in a context where feed sources are fully trusted, the practical exploitability may be lower.",
                  "The exact fixed version is not specified in the patch metadata. The tag_version_boundary indicates v1.4 is the nearest tag with 15 commits after the fix, suggesting the fix landed in a version after 1.4, but the precise version number is unknown.",
                  "The SI:H rating assumes the data distribution policy violation (higher-TLP data reaching lower-TLP consumers) constitutes a significant integrity impact on the feed\u0027s trust model. A different rating (e.g., SI:L) could be argued if the policy is considered advisory rather than binding.",
                  "The patch does not specify whether the vulnerability was discovered through a security audit, bug report, or internal testing. No finder or reporter credit is assigned beyond the remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-120",
                    "rationale": "The closest plausible attack pattern is parameter tampering: an attacker who can author MISP feed events manipulates the tag parameters to include a non-allowed taxonomy tag (e.g., tlp:red) alongside an allowed one (e.g., tlp:clear), exploiting the guard\u0027s incomplete validation that only checked for the presence of at least one allowed tag. The uncertainty is that this is not a traditional HTTP parameter tampering scenario but rather manipulation of structured data fields (tags) within MISP event objects; however, the fundamental technique of altering input values to bypass validation aligns with CAPEC-120."
                  }
                ],
                "commit": "6127d94c350e4dfe31fd4426ba26f51294ed3867",
                "confidence": "medium",
                "cpeReview": [
                  {
                    "api": "https://cpe.gcve.eu/api/cpes",
                    "cpe": "cpe:2.3:a:misp:misp-guard:*:*:*:*:*:*:*:*",
                    "exactSearchTruncated": false,
                    "searchTruncated": false,
                    "status": "not_found"
                  }
                ],
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Luciano Righetti"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerability is exploitable over the network via MISP feed endpoints. AC:L: The attack is straightforward; the attacker simply includes a non-allowed tag alongside an allowed one. AT:N: No need to manipulate or bypass any additional protection. PR:H: The attacker requires high privileges, specifically the ability to author or modify MISP events in a feed source (write access to a MISP instance). UI:N: No user interaction is required. VC:N/VI:N/VA:N: The guard process itself is not compromised in terms of its own confidentiality, integrity, or availability. SC:N: No direct impact on connected systems\u0027 confidentiality. SI:H: The integrity of the data distribution policy is significantly violated; data with higher sensitivity/classification is distributed to consumers who should only receive lower-classification data, undermining the trust model of the feed. SA:N: No cascading security impact on other systems.",
                "fixSummary": "The fix introduces a new validation function, check_required_taxonomy_tags_allowed, that iterates over every tag belonging to a required taxonomy and verifies each one is present in the configured allowed-tags list, raising a ForbiddenException if any tag is not allowed. This check is applied at both the event level and the attribute level. Additionally, an inherit_event_taxonomies flag is introduced so that attributes without their own required-taxonomy tags inherit the event\u0027s already-validated taxonomy, while attributes that do carry tags of the required taxonomy are still fully validated against the allowed list. This ensures that no non-allowed tag of a required taxonomy can pass the guard regardless of whether an allowed tag is also present.",
                "generatedAt": "2026-10-27T18:09:46.639416Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "96c08da8be43b5e5165fc57cebe9904273d91d56fcf14a0566ecd3dfb50ce099",
                "patchSummary": "In src/mispguard.py: (1) Added a new method check_required_taxonomy_tags_allowed that loops over all tags of a required taxonomy and rejects any tag not in the allowed list. (2) Modified check_event_required_taxonomies to call the new method after the existing existence check. (3) Modified check_attribute_required_taxonomies to accept an inherit_event_taxonomies parameter; when True, the existence check is skipped (the event already satisfied it) but the new allowed-tags check still runs on any tags the attribute does hold. (4) Added the inherit_event_taxonomies parameter to check_attribute_level_rules and check_object_level_rules, threading it through recursive calls for ShadowAttribute and object attributes. (5) Updated check_required_taxonomy_exists to accept an entity parameter for clearer error messages. (6) Added 172 lines of test cases in src/test/test_misp_guard.py covering: event with both allowed and non-allowed taxonomy tags (blocked), untagged attribute under a tagged event (allowed), attribute in",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "6127d94c350e4dfe31fd4426ba26f51294ed3867",
                    "date": "Mon, 26 Oct 2026 08:44:32 +0100",
                    "patchSha256": "96c08da8be43b5e5165fc57cebe9904273d91d56fcf14a0566ecd3dfb50ce099",
                    "source": "https://github.com/MISP/misp-guard/commit/6127d94c350e4dfe31fd4426ba26f51294ed3867.patch",
                    "sourceUrl": "https://github.com/MISP/misp-guard/commit/6127d94c350e4dfe31fd4426ba26f51294ed3867.patch",
                    "subject": "fix: [security] enforce allowed tags on every tag of a"
                  }
                ],
                "source": "https://github.com/MISP/misp-guard/commit/6127d94c350e4dfe31fd4426ba26f51294ed3867.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-27T18:09:46Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] enforce allowed tags on every tag of a",
                "tagVersionBoundary": {
                  "commits_after_fix": 15,
                  "repository": "https://github.com/MISP/misp-guard",
                  "tag": "v1.4",
                  "version": "1.4",
                  "version_type": "custom"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-20",
                    "rationale": "The guard\u0027s validation logic for required taxonomy tags was incomplete: it only checked for the existence of at least one allowed tag rather than verifying that all tags of the required taxonomy were in the allowed list. This is a classic incomplete input validation flaw where the check does not cover all relevant input values."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "The guard\u0027s purpose is to enforce authorization policies on data flowing through MISP feeds. The incomplete tag check effectively allowed unauthorized (non-allowed) tags to pass, resulting in improper enforcement of the data distribution authorization policy."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (6127d94c350e4dfe31fd4426ba26f51294ed3867): fix: [security] enforce allowed tags on every tag of a",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/misp-guard/commit/6127d94c350e4dfe31fd4426ba26f51294ed3867.patch"
                    ],
                    "timestamp": "2026-10-26T07:44:32Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20219"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-118173",
    "datePublished": "2026-10-27T18:11:51.815Z",
    "dateReserved": "2026-10-27T18:11:43.078Z",
    "dateUpdated": "2026-10-27T18:11:51.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "all"
          ],
          "product": "Xpdf",
          "vendor": "Xpdf",
          "versions": [
            {
              "lessThanOrEqual": "4.06",
              "status": "affected",
              "version": "0",
              "versionType": "Version"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mateusz Waliszewski and Artur Mattern"
        }
      ],
      "datePublic": "2026-10-26T19:54:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eInfinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.\u003c/div\u003e"
            }
          ],
          "value": "Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper input validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835 Loop with unreachable exit condition (\u0027infinite loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T20:10:20.067Z",
        "orgId": "ace9cabe-4f4f-416b-8c39-b0e002761924",
        "shortName": "GandC"
      },
      "references": [
        {
          "url": "https://www.xpdfreader.com/security-bug/CVE-2026-116671.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ace9cabe-4f4f-416b-8c39-b0e002761924",
    "assignerShortName": "GandC",
    "cveId": "CVE-2026-116671",
    "datePublished": "2026-10-26T20:10:20.067Z",
    "dateReserved": "2026-10-26T19:49:20.183Z",
    "dateUpdated": "2026-10-26T20:10:20.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116469",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T13:32:47.760705Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T14:35:18.399Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp-guard:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "src/mispguard.py"
          ],
          "product": "misp-guard",
          "programFiles": [
            "src/mispguard.py"
          ],
          "repo": "https://github.com/MISP/misp-guard",
          "vendor": "MISP",
          "versions": [
            {
              "lessThanOrEqual": "1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Luciano Righetti"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5.5 (1M context)"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "Claude Opus 5.5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.\u003c/p\u003e\u003cp\u003eAn attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the \u0027tlp\u0027 taxonomy with only \u0027tlp:clear\u0027 allowed, an event tagged \u0027TLP:AMBER\u0027 would not be recognized as belonging to the \u0027tlp\u0027 taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as \u0027Person\u0027 would not match a configured block entry of \u0027person\u0027, allowing the attribute to pass through the filter.\u003c/p\u003e\u003cp\u003eThe security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce.\u003c/p\u003e\u003cp\u003eThe vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.\u003c/p\u003e"
            }
          ],
          "value": "MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.\n\nAn attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the \u0027tlp\u0027 taxonomy with only \u0027tlp:clear\u0027 allowed, an event tagged \u0027TLP:AMBER\u0027 would not be recognized as belonging to the \u0027tlp\u0027 taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as \u0027Person\u0027 would not match a configured block entry of \u0027person\u0027, allowing the attribute to pass through the filter.\n\nThe security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce.\n\nThe vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-10",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-10 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-26T10:33:59Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-178",
              "description": "CWE-178 Improper Handling of Case Sensitivity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T18:14:58.333Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/misp-guard/commit/9868b1d93fc9cc40cc7c69ca11c86afd825bbc1c"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix makes all policy-matching comparisons case-insensitive by applying .lower() to both the input value (tag name, attribute category, sharing-group UUID) and the configured policy value (required taxonomy prefix, allowed tags, blocked categories, blocked UUIDs) before performing the comparison. This ensures that a tag such as \u0027TLP:AMBER\u0027 is correctly recognized as belonging to the \u0027tlp\u0027 taxonomy and is checked against the allowed-tags list, and that a blocked category or UUID is matched regardless of letter case.\u003c/p\u003e"
            }
          ],
          "value": "The fix makes all policy-matching comparisons case-insensitive by applying .lower() to both the input value (tag name, attribute category, sharing-group UUID) and the configured policy value (required taxonomy prefix, allowed tags, blocked categories, blocked UUIDs) before performing the comparison. This ensures that a tag such as \u0027TLP:AMBER\u0027 is correctly recognized as belonging to the \u0027tlp\u0027 taxonomy and is checked against the allowed-tags list, and that a blocked category or UUID is matched regardless of letter case."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "partial",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The MISP Guard is assumed to operate as a proxy filtering outbound MISP feed data; the attacker is assumed to have the ability to create or modify events in a MISP instance that feeds through the guard. The patch does not specify the exact deployment topology.",
                  "PR:L assumes that creating events in MISP requires at least a low-privilege authenticated account. If the guard is used in a context where events are pushed from a connected MISP instance without per-event authentication, PR could be None.",
                  "The CAPEC-10 mapping is the closest available pattern; the actual attack involves modifying structured JSON event fields rather than traditional HTTP parameters, so the mapping is approximate.",
                  "No specific affected or fixed version numbers are provided in the patch metadata; the version range is marked as unspecified.",
                  "The commit message references \u0027ID 004\u0027 as a prior related fix, suggesting this is a follow-up to an earlier incomplete case-sensitivity fix, but no further details about that prior fix are available in the patch."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-10",
                    "rationale": "The attacker tampers with the letter case of tag names, attribute categories, or sharing-group UUIDs in MISP events to bypass the guard\u0027s policy checks. This is a form of parameter tampering where the input is modified in a way that the validation logic does not anticipate. CAPEC-10 is the closest available pattern; the uncertainty is that the tampering occurs in structured event data rather than in a traditional request parameter, but the underlying technique (modifying input to evade validation) aligns with this pattern."
                  }
                ],
                "commit": "9868b1d93fc9cc40cc7c69ca11c86afd825bbc1c",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Luciano Righetti"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5.5 (1M context)"
                  },
                  {
                    "lang": "en",
                    "type": "tool",
                    "value": "Claude Opus 5.5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The MISP feed is consumed over the network (HTTP). AC:L: Exploitation requires only changing the letter case of a tag, category, or UUID string. AT:N: No log or audit tampering is needed. PR:L: The attacker needs the ability to create or modify events in a MISP instance, which typically requires a low-privilege user account or a connected instance. UI:N: No user interaction is required. VC:H: The primary impact is unauthorized disclosure of data that the operator intended to restrict (non-allowed TLP tags, blocked categories, blocked sharing groups are forwarded to feed consumers). VI:N: The data content is not modified, only improperly shared. VA:N: No availability impact. SC/SI/SA:N: No secondary system impact is evidenced.",
                "fixSummary": "The fix makes all policy-matching comparisons case-insensitive by applying .lower() to both the input value (tag name, attribute category, sharing-group UUID) and the configured policy value (required taxonomy prefix, allowed tags, blocked categories, blocked UUIDs) before performing the comparison. This ensures that a tag such as \u0027TLP:AMBER\u0027 is correctly recognized as belonging to the \u0027tlp\u0027 taxonomy and is checked against the allowed-tags list, and that a blocked category or UUID is matched regardless of letter case.",
                "generatedAt": "2026-10-26T10:33:59.935580Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "26a847175a70394b7c0feaa57f7286f41fb131fc28c4c540412e88018c749628",
                "patchSummary": "In src/mispguard.py, four comparison sites were changed: (1) check_required_taxonomy_exists now uses tag[\u0027name\u0027].lower().startswith(required_taxonomy.lower() + \u0027:\u0027) instead of a case-sensitive startswith; (2) check_required_taxonomy_tags_allowed applies .lower() to both the tag name and the required taxonomy prefix in the startswith check; (3) check_blocked_attribute_categories compares attribute[\u0027category\u0027].lower() against a lowercased list of blocked categories; (4) check_blocked_analyst_data_sharing_groups_uuids compares the UUID in lowercase against a lowercased list of blocked UUIDs. Ninety-one lines of test cases were added to src/test/test_misp_guard.py covering mixed-case TLP tags in required-taxonomy checks and mixed-case blocked attribute categories.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "9868b1d93fc9cc40cc7c69ca11c86afd825bbc1c",
                    "date": "Mon, 26 Oct 2026 10:25:52 +0100",
                    "patchSha256": "26a847175a70394b7c0feaa57f7286f41fb131fc28c4c540412e88018c749628",
                    "source": "https://github.com/MISP/misp-guard/commit/9868b1d93fc9cc40cc7c69ca11c86afd825bbc1c.patch",
                    "sourceUrl": "https://github.com/MISP/misp-guard/commit/9868b1d93fc9cc40cc7c69ca11c86afd825bbc1c.patch",
                    "subject": "fix: [security] match categories and required taxonomies"
                  }
                ],
                "source": "https://github.com/MISP/misp-guard/commit/9868b1d93fc9cc40cc7c69ca11c86afd825bbc1c.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-26T10:33:59Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [security] match categories and required taxonomies",
                "weaknessRationale": [
                  {
                    "cweId": "CWE-178",
                    "rationale": "The root cause is that string comparisons used to enforce security policies (taxonomy prefix matching, category blocking, UUID blocking) were case-sensitive, allowing an attacker to bypass the checks by altering letter case. CWE-178 is the most specific and accurate mapping."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "More broadly, the guard failed to validate input against the policy in a canonical form, which is a form of improper input validation. CWE-20 is included as a secondary, broader mapping."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (9868b1d93fc9cc40cc7c69ca11c86afd825bbc1c): fix: [security] match categories and required taxonomies",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/MISP/misp-guard/commit/9868b1d93fc9cc40cc7c69ca11c86afd825bbc1c.patch"
                    ],
                    "timestamp": "2026-10-26T09:25:52Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20344"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-116469",
    "datePublished": "2026-10-26T10:35:51.992Z",
    "dateReserved": "2026-10-26T10:35:05.591Z",
    "dateUpdated": "2026-10-27T18:14:58.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}