{"vulnerability": "CVE-2026-5914", "sightings": [{"uuid": "a2d0779a-d7e0-4734-8542-70ae9638001c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5914", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260409", "content": "", "creation_timestamp": "2026-04-08T18:00:00.000000Z"}, {"uuid": "8fa4fa4b-89a0-4af7-8452-8bd118807cad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5914", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mj3eh7b6fc2o", "content": "", "creation_timestamp": "2026-04-09T17:46:58.786360Z"}, {"uuid": "3b2d49ff-3682-4bd0-ab40-3339fd125e23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5914", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260413", "content": "", "creation_timestamp": "2026-04-12T20:00:00.000000Z"}, {"uuid": "42b04a37-49ff-4dd6-b2b5-33f642dcd804", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5914", "type": "seen", "source": "https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review", "content": "", "creation_timestamp": "2026-04-14T15:49:19.000000Z"}, {"uuid": "971e3ab0-0cd3-4ed2-9f07-230ac4994670", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5914", "type": "seen", "source": "Telegram/wp_aceAWiHnKeB1QgDBbSEs0CV1Y0qbWjZiA4LmSBc26yhc", "content": "", "creation_timestamp": "2026-04-11T16:10:06.000000Z"}, {"uuid": "fa1e597c-d5df-478b-85e4-13dc8559354c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59149", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqahy25dnq2t", "content": "CVE-2026-59149 - Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)\nCVE ID : CVE-2026-59149\n \n Published : July 9, 2026, 7:17 p.m. | 31\u00a0minutes ago\n \n Description : Mockoon provides way to design and run mock API...", "creation_timestamp": "2026-07-09T20:29:44.876683Z"}, {"uuid": "12dfc238-3ff6-424f-a0bf-d035bc26fa52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59148", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqaibfx7pc24", "content": "CVE-2026-59148 - Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft\nCVE ID : CVE-2026-59148\n \n Published : July 9, 2026, 7:17 p.m. | 31\u00a0minutes ago\n \n Description : Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mock...", "creation_timestamp": "2026-07-09T20:34:59.349479Z"}, {"uuid": "d2aa9138-bf1b-4df6-9e6e-bbea5818f45b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59144", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrb667p2vy2r", "content": "CVE-2026-59144 - data::ringbuffer::shared\nVersions of Perl's Data::RingBuffer::Shared before 0.04 can be exploited by a malicious peer to corrupt data in memory. This is a concern for systems where multiple users can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#egor #CVE #infosec", "creation_timestamp": "2026-07-22T20:32:05.739401Z"}, {"uuid": "468e023a-6ec6-4e44-9cb7-76b87f6e7d9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59145", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrb6bqtgk62v", "content": "CVE-2026-59145 - data::intern::shared\nVersions of Data::Intern::Shared for Perl before 0.02 have a security issue that allows an attacker to access sensitive information from another process. This is possible if an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#egor #CVE #infosec", "creation_timestamp": "2026-07-22T20:34:04.547105Z"}, {"uuid": "59cf0b2b-6efc-4990-a4f5-26609e277eb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59147", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrcv5ppfj523", "content": "CVE-2026-59147 - data::disjointset::shared\nData::DisjointSet::Shared versions before 0.02 for Perl are vulnerable to memory corruption due to an unvalidated index in the dsu_find function. This can be exploited by a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#egor #CVE #infosec", "creation_timestamp": "2026-07-23T12:56:04.884474Z"}, {"uuid": "b5663bbf-6b07-44e2-a70a-e9fc0de30070", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59148", "type": "seen", "source": "https://gist.github.com/alon710/12e5af59440fe17bf499cbab29b7b498", "content": "# CVE-2026-59148: CVE-2026-59148: Unauthenticated Administrative API and CORS Misconfiguration in Mockoon\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59148\n\n## Summary\nAn in-depth analysis of CVE-2026-59148, a high-severity flaw in Mockoon where unauthenticated administrative endpoints and a wildcard Cross-Origin Resource Sharing (CORS) policy allow remote execution, state poisoning, and credential theft.\n\n## TL;DR\nUnauthenticated endpoints and wildcard CORS in Mockoon allow local and remote attackers to compromise administrative APIs and hijack local server instances.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-942, CWE-732, CWE-352\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.8 (High)\n- **EPSS Score**: 0.00262 (0.26% probability)\n- **Impact**: Remote Code Execution / Environment Pollution / Credential Exfiltration\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mockoon Desktop Client\n- Mockoon CLI\n- Mockoon Serverless\n- @mockoon/commons-server\n- **Mockoon**: < 9.7.0 (Fixed in: `9.7.0`)\n\n## Mitigation\n\n- Upgrade Mockoon components to version 9.7.0 or above\n- Disable the administrative API using application flags\n- Restrict socket binding to localhost (127.0.0.1)\n- Use firewalls to block remote inbound connections to mock ports\n\n**Remediation Steps:**\n1. Identify all active instances of Mockoon CLI, GUI, and Serverless libraries.\n2. Execute update commands to pull version 9.7.0 or newer.\n3. Set the MOCKOON_ADMIN_API_TOKEN environment variable to a strong, random value.\n4. Ensure the --disable-admin-api flag is configured for CLI execution where the administration plane is not needed.\n5. Verify localhost-only binding in environment configurations.\n\n## References\n\n- [GHSA-rqx4-3f6q-3x2v](https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v)\n- [Security Patch Commit](https://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299)\n- [Security Patch Pull Request](https://github.com/mockoon/mockoon/pull/2254)\n- [Release v9.7.0](https://github.com/mockoon/mockoon/releases/tag/v9.7.0)\n- [Mockoon Official Release Notes](https://mockoon.com/releases/9.7.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59148) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-12T00:32:03.846589Z"}, {"uuid": "4821e08a-11e8-4db6-8391-f0df2e00c89e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59148", "type": "published-proof-of-concept", "source": "https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v", "content": "", "creation_timestamp": "2026-09-12T00:35:05.840754Z"}, {"uuid": "b5a7097e-abd8-45ce-b0cd-ff82b9226511", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59149", "type": "published-proof-of-concept", "source": "https://github.com/mockoon/mockoon/security/advisories/GHSA-8wqc-v2q8-vff2", "content": "", "creation_timestamp": "2026-09-12T00:35:08.063068Z"}, {"uuid": "537a2d70-34a1-4f21-8dcf-432f12ccfd2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59149", "type": "seen", "source": "https://gist.github.com/alon710/8e9884324f7c5a6dc21f24fa20ed79e2", "content": "# CVE-2026-59149: CVE-2026-59149: Sibling Directory Path Traversal in Mockoon Backend Server\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59149\n\n## Summary\nCVE-2026-59149 identifies a directory traversal vulnerability in `@mockoon/commons-server`, the backend mock-server library powering the Mockoon application. The flaw occurs in the path containment validation logic used during raw file response generation. An unauthenticated attacker can exploit this weakness to retrieve arbitrary files from sibling directories sharing a common prefix with the designated static base directory.\n\n## TL;DR\nA path traversal vulnerability in Mockoon's backend server allows unauthenticated clients to read files from sibling directories outside the configured base directory by exploiting character-by-character prefix validation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.5\n- **EPSS Score**: 0.00483 (0.48%)\n- **Impact**: Confidentiality (High)\n- **Exploit Status**: Proof of Concept / Public Details Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Mockoon Desktop Application\n- Mockoon CLI\n- @mockoon/commons-server npm package\n- **mockoon**: < 9.7.0 (Fixed in: `9.7.0`)\n- **@mockoon/commons-server**: < 9.7.0 (Fixed in: `9.7.0`)\n\n## Mitigation\n\n- Upgrade Mockoon applications and server components to version 9.7.0 or later.\n- Sanitize client input before processing template variables in file-serving endpoints.\n- Configure Mockoon execution environments to operate under the principle of least privilege.\n\n**Remediation Steps:**\n1. Run the command `npm install @mockoon/commons-server@latest` or update the parent application package configurations.\n2. Verify that path resolution checks execute using semantic relative path checking rather than string-prefix matching.\n3. Isolate Mockoon containers from sibling workspace environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-8wqc-v2q8-vff2](https://github.com/mockoon/mockoon/security/advisories/GHSA-8wqc-v2q8-vff2)\n- [Mockoon Fix Commit b42bdfb7f82e83f0e81bea8e6fe41adf5ec82585](https://github.com/mockoon/mockoon/commit/b42bdfb7f82e83f0e81bea8e6fe41adf5ec82585)\n- [Mockoon Pull Request 2255](https://github.com/mockoon/mockoon/pull/2255)\n- [Mockoon Release Tag v9.7.0](https://github.com/mockoon/mockoon/releases/tag/v9.7.0)\n- [Mockoon v9.7.0 Official Release Notes](https://mockoon.com/releases/9.7.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59149) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-12T01:32:31.038794Z"}]}