We are tasked to synthesize data about CVE-2026-65711 into a JSON object. We must use all provided data: description, CVSS (especially the CVSS:4.0 vector, note this is CVSS 4.0 not 3.1), EPSS, KEV (not mentioned, assume no KEV), POC (publicly available), CPE, tags, SSVC, ENISA references. We need to output each field as a plain text string, not array/object. First, parse the data: - Description: sysPass through version 3.2.11 contains OS command injection, authenticated admins can set malicious backup path, the FileBackupService builds a tar command via string concatenation with siteBackupPath without escapeshellarg(), passing to exec(). Injected commands persist and execute on every backup trigger. - CVSS Score: 8.6 (note this is likely a CVSS 4.0 score, not 3.1). Provided vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Interpretation: Network attack vector, Low attack complexity, No attack requirements, Privileges Required High, No user interaction, Vulnerable component confidentiality high, integrity high, availability high, subsequent system none. Environmental metrics all X (not defined). So base score 8.6 is derived from those base metrics. - CWE: CWE-78 (OS Command Injection). - Multi-source: EPSS: 2.41% (percentile 82%): This is relatively high, indicating a moderate likelihood of exploitation in next 30 days. Percentile 82% means it's higher than 82% of all CVEs. POC/Exploit: Publicly available (so there is a PoC). Reported by: VulnCheck. CPE: cpe:2.3:a:nuxsmin:syspass:*:*:*:*:*:*:*:* (all versions up to 3.2.11) Tags: Command Injection, Syspass. SSVC: Exploitation: poc, Automatable: no, Technical Impact: total. (So SSVC says PoC exists, not automatable, total technical impact.) ENISA EUVD ID: EUVD-2026-48717, affected versions: sysPass 0 ≤3.2.11. References: - gist.github.com (exploit) - vulncheck advisory - NVD detail No KEV mentioned. So it's not in CISA KEV. So exploitation status: publicly available exploit code exists, but not confirmed actively exploited by CISA. We must produce a comprehensive analysis with all fields. Now for each field: 1. product_name: "sysPass" (3 words? Actually one word, it's the product name) 2. summary: 2-3 sentence plain-language. Start with impact verb and product. "Authenticated OS command injection in sysPass 3.2.11 allows administrators to execute arbitrary commands..." but we need to incorporate all data. Mention that it's authenticated, the mechanism (backup path), EPSS moderate, PoC exists. Not KEV, but publicly available PoC. So: "Authenticated command injection in sysPass up to version 3.2.11 permits administrators with configuration privileges to execute arbitrary OS commands by setting a crafted backup path. The vulnerability resides in FileBackupService's unsanitized string concatenation when building a tar command, allowing injected commands to persist across backup runs. Exploit code is publicly available, and EPSS indicates a 2.41% exploitation probability (82nd percentile)." 3. technical_context: Explain underlying technology: sysPass is a PHP-based password manager. The backup functionality uses PHP exec() to call tar, constructing the command by directly concatenating the user-supplied path. The CWE-78 is OS command injection. Use CPE to identify affected product: cpe:2.3:a:nuxsmin:syspass:*:*:*:*:*:*:*:* (all versions). Root cause is lack of escapeshellarg() or similar sanitization before passing to exec(). 4. risk_assessment: Use CVSS 4.0 vector: AV:N, PR:H, AC:L, UI:N, High impact on confidentiality, integrity, availability. So it's a high-privilege, network-accessible command injection. EPSS 2.41% suggests moderate real-world exploit probability. SSVC: exploitation: PoC (public exploit), not automatable, total technical impact. So risk: It's a critical vulnerability if an admin account is compromised, but it requires high privileges, which limits attack surface unless there is another way to gain admin access. Note: CVSS score 8.6, but PR:H. So it's not a remote unauthenticated RCE; it's post-authentication. However, if admin accounts are weak or another vulnerability grants access, it's severe. The SSVC "not automatable" might indicate it's not easily scripted, but PoC exists, so manual exploitation is possible. The high score is justified given total compromise. Contrast: EPSS moderate, not extremely widespread. We'll say: While CVSS base score is high (8.6), the requirement for administrative privileges significantly reduces the risk in environments with strong admin credential management. The publicly available PoC increases urgency for patching. 5. affected_products: "sysPass versions up to and including 3.2.11 are affected. The product is identified by CPE cpe:2.3:a:nuxsmin:syspass:*:*:*:*:*:*:*:*. Vendor advisory available at VulnCheck (link)." 6. remediation: Vendor-released patch? The description says "through version 3.2.11" implying that version is vulnerable, but no mention of a fix version. The references are an exploit gist and a VulnCheck advisory. No mention of an official patch. So no vendor patch identified? But we should check: The CVE was assigned, maybe a fix is in a later version. Since the description says "through version 3.2.11", maybe 3.2.12 or 3.3.0 exists? We have no data. So we must state: No official patched version confirmed. Workaround: Since the injection is via backup path set by admin, a compensating control: restrict admin access to trusted users only; disable backup functionality if not needed; implement input validation at web application firewall (WAF) to block command injection patterns in the backup path parameter. However, the description says the path is admin-configurable, so likely only admins can set it. So limiting admin accounts is key. If patch not available, maybe monitor. But it's better to say: Upgrade to a patched version once released. As of analysis, no patched version identified. Use network segmentation to restrict access to the sysPass admin interface. 7. exploit_scenario: An attacker who obtains administrative credentials (via phishing, brute force, or another vulnerability) logs into the sysPass admin panel, navigates to the backup settings, and sets the backup path to a value like "/tmp/backup; id > /tmp/pwned". When a backup is triggered (automatically or manually), the injected command executes as the web server user, leading to full command execution and potential lateral movement. 8. exploitation_conditions: Specific conditions: The attacker must have administrative privileges to configure the backup path. The backup functionality must be enabled and triggered (manually or via scheduled task). No other special conditions: the vulnerability exists in the default code path when processing backups. The attack is remote (network), requires authentication as an admin (PR:H), no user interaction beyond setting the malicious path. So: "Requires administrative authentication to sysPass; the backup feature must be enabled and triggered. No additional non-default configurations are required." 9. attack_chain: Using kill chain, we have a 4-step: Access (obtain admin credentials or session) → Exploit (set malicious backup path via admin interface) → Execution (trigger backup, injecting command) → Impact (execute arbitrary OS commands as web user). So: "Gain administrative access to sysPass → Set malicious backup path in settings → Trigger backup operation → The injected OS command executes via exec()" Actually, the injection persists, so it's: "Gain admin access → Inject command in backup path → Wait for or trigger backup → Execute arbitrary commands". But the chain can be: "Authenticate as admin → Navigate to backup configuration → Insert shell metacharacters into backup path → Save configuration → Trigger backup → Execute command". For brevity, we can combine. So: "Obtain admin credentials → Set backup path to include command injection → Initiate backup → Malicious command executes as web server user". That's 4 steps. It's a simple chain. 10. confidence_notes: Based on data: CVE assigned, VulnCheck advisory confirms vulnerability, exploit PoC publicly available. CVSS vector provided by NVD/NIST? Actually the CVSS vector came with the data, likely from NVD. So confirmed by NVD. Patch status unknown; no official fix version mentioned. The CVE description states "through version 3.2.11" so likely later versions may patch it but not confirmed. So: "Vulnerability confirmed by NVD and VulnCheck advisory. Public PoC exploit exists. No patched version identified in available data." 11. prevalence: sysPass is a self-hosted password manager, not as widely deployed as commercial alternatives. It's likely used by small to medium organizations or individuals. So prevalence: low? Possibly medium? It's an open-source project, some enterprise use but not ubiquitous. I'd say low. However, the SSVC says "not automatable" and EPSS 2.41% indicates some scanning? I'll estimate low. But prevalence basis: "open-source password manager, niche deployment". Could be medium if commonly used, but compared to WordPress or Apache, it's low. So "low". 12. prevalence_basis: "self-hosted password manager, modest community adoption". Short. 13. assessed_cvss_vector: We need to produce our own CVSS 3.1 base vector. The provided CVSS is 4.0. We can map the 4.0 base metrics to 3.1 as best we can. CVSS 4.0 has AV:N, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H. The 3.1 equivalents: AV:N, AC:L, PR:H, UI:N, S:C? Wait, in CVSS 4.0, scope is not explicitly present; instead we have vulnerable and subsequent system metrics. The attack vector is network, complexity low, privileges high, user interaction none. For scope: in CVSS 4.0, high impact on vulnerable system, low on subsequent. But in 3.1, scope is determined by whether the vulnerable component and impacted component are the same. Here, the vulnerability is in the web application (the vulnerable component) and execution happens on the same machine, so likely the vulnerable component and the impacted component are the same. However, it might be argued that the vulnerable component is the web app, and the impact is on the underlying OS, which is a different component. Typically for command injection in web apps, CVSS 3.1 sets Scope: Changed if the web app's security context is different from the OS command. Many CVSS 3.1 vectors for command injection use S:C. But we need to be consistent. The provided 4.0 set SC:N means subsequent system (after scope change) has no impact? Wait, no: In CVSS 4.0, VC:Vulnerable component confidentiality, VI, VA are high. SC: Subsequent system confidentiality, integrity, availability are all N. This means the vulnerable component (web app) suffers high impact, while the subsequent system (maybe the OS) has none? That doesn't make sense for OS command injection. The CVSS 4.0 user guide says: Vulnerable component is the thing that contains the vulnerability; Subsequent system is the component that suffers the impact if it's different. Here, the vulnerable component is the web application (sysPass). The impact is on the OS where commands are executed. If the web app and OS are considered separate, then the vulnerable component (web app) might have no confidentiality, integrity, availability impact because the exploit doesn't alter the web app itself, but rather the OS. But the injection lets an attacker execute commands as the web server user, which could read files (confidentiality), modify files (integrity), or disrupt service (availability) on the OS. The web app's own data may be accessible too. I think traditional CVSS 3.1 would set Scope Changed and impact on the OS as the target, with Conf/Integ/A
We are tasked to produce a JSON analysis for CVE-2026-66027 based on the provided data. The analysis must synthesize all the information, cross-reference, and produce a coherent summary, technical context, risk assessment, affected products, remediation, exploit scenario, exploitation conditions, attack chain, confidence notes, prevalence, prevalence basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. We have: - CVE: CVE-2026-66027 - Description: broken access control in message queue API of Suna before 0.9.102, allowing authenticated attackers to access/manipulate other users' queue resources. Can read pending prompt queues, read/delete individual sessions, inject prompts into another user's session queue, causing background drainer to forward malicious messages to victim's running AI agent with victim's credentials. - CVSS Score: 8.7 (base score based on CVSS 4.0 vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N) - CWE: CWE-862 (Missing Authorization) - Multi-source: EPSS 0.26% (percentile 17%) so low exploitation probability. POC/Exploit: Publicly available. Patch: Available from vendor. Reported by VulnCheck. - CPE: cpe:2.3:a:kortix-ai:suna:*:*:*:*:*:*:*:* (so product is Suna from kortix-ai). - Tags: Authentication Bypass, Suna - SSVC: Exploitation: poc, Automatable: no, Technical Impact: total. - ENISA EUVD ID confirms affected versions: suna 0 <0.9.102. So all versions before 0.9.102 are affected. - References: - exploit: https://github.com/geo-chen/oss/blob/main/suna.md (likely a writeup) - release: https://github.com/kortix-ai/suna/releases/tag/v0.9.102 - pull request: https://github.com/kortix-ai/suna/pull/4373 (security fix PR) - patch commit: https://github.com/kortix-ai/suna/commit/7536a7d47fc93abcb66e677fcc993b390c81296a - vulncheck advisory: https://www.vulncheck.com/advisories/suna-broken-access-control-via-message-queue-api - NVD link: https://nvd.nist.gov/vuln/detail/CVE-2026-66027
Missing object-level authorization in sysPass through 3.2.11 allows API token holders to enumerate account metadata, overwrite passwords, and delete any account across the vault without per-account access controls. A public proof-of-concept is available, though EPSS indicates low exploitation probability (0.22%).
Authenticated administrators can execute arbitrary OS commands on Microweber CMS through 2.0.20 by injecting unsandboxed Twig expressions into mail templates. The vulnerability allows full server compromise once an admin injects a payload, which auto-executes on every mail dispatch event. Public exploit code exists, though no active exploitation is confirmed.
Authenticated attackers can bypass access controls in sysPass 3.2.11 and earlier to access, download, or delete any account file attachment, regardless of their ACL permissions, by exploiting missing authorization checks in AccountFileController. Public exploit code is available, but the EPSS score of 0.22% indicates low likelihood of widespread exploitation.
Authenticated SQL injection in Likeshop up to 3.0.5 allows admin-level users to extract arbitrary database contents via the adjustAccount endpoint. The vulnerability stems from unsanitized POST parameters (money, integral, growth, earnings) concatenated directly into raw SQL queries. Exploit code is publicly available, though no active exploitation has been reported by CISA.
Local code injection in NLTK versions prior to 3.9.3 allows an attacker with low privileges who can invoke the collocations module via the command line to execute arbitrary Python code. A publicly available proof-of-concept exploit demonstrates passing a crafted argument to the BigramAssocMeasures.eval() call, enabling arbitrary code execution including OS commands. The vulnerability has been patched in NLTK 3.9.3.
Account takeover in CAFEHAUS API plugin for WordPress allows unauthenticated attackers to arbitrarily reset any user password via a missing authorization endpoint. Versions up to 1.0.0 are affected, enabling complete site compromise by setting an administrator password and logging in. While a public proof-of-concept exists, no widespread exploitation has been confirmed by KEVCISA.
Unauthorized REST endpoint in WowOptin Popup Maker for WordPress (versions <1.4.38) allows unauthenticated attackers to disable all site opt-in forms and insert arbitrary template-based rows into the database. Public exploit code is available, though no active exploitation is reported. EPSS indicates a very low likelihood of widespread attack.
Unauthenticated privilege escalation in Paid Membership Plugin for WordPress before 4.16.18 allows an attacker to register an account with an elevated role such as Editor or Author, bypassing the configured restriction because the registration handler's role acceptance logic differs from the UI parser. The lack of a nonce on the public handler enables exploitation without user interaction. A public proof-of-concept exists, but no active exploitation has been reported via CISA KEV, and the EPSS score is low at 0.13%.
Message content overwrite in Open WebUI's chat completion API allows any authenticated user to modify messages in channels they do not belong to, including private and DM channels. By crafting a request with a `channel:`-prefixed chat_id and a target message_id, an attacker can overwrite a message's content while retaining the original author attribution, effectively impersonating the victim. A publicly available proof-of-concept exploit exists, and the vulnerability affects versions 0.9.5 through 0.9.9.
Cloudreve versions earlier than 4.17.0 contain an incorrect authorization flaw in the OAuth scoping of admin storage policy routes. An attacker with a bearer token scoped only to Admin.Read can send a request to the vulnerable endpoint and overwrite OneDrive storage policy credentials, violating the intended scope boundary. A publicly available proof-of-concept exists, and the vendor has released a patched version.
Privilege escalation in sysPass 3.2.11 allows authenticated users with the PUBLICLINK_CREATE profile flag to decrypt passwords of arbitrary vault accounts and store them in public links, enabling unauthenticated retrieval if the link hash is obtained. No active exploitation is confirmed, but public exploit code exists; EPSS probability is low (0.18%).
Privilege escalation in Weintek cMT3092X HMI and EasyWeb allows authenticated non-privileged users to modify cookies to gain elevated privileges. Affected firmware versions before 20210218 and EasyWeb versions before v2.1.20 are susceptible, with no public exploit code or active exploitation reported. EPSS probability is low (0.32%), indicating limited real-world exploitation likelihood.
Privilege escalation in Weintek cMT3092X HMI allows a low-privileged user to modify authentication tokens, gaining full administrative control over the device. The vulnerability affects firmware prior to 20210218 and EasyWeb prior to v2.1.20. No active exploitation is known and public exploit code has not been identified; EPSS indicates a low likelihood of exploitation.
Plaintext storage of user account passwords in Weintek cMT3092X HMI firmware and EasyWeb exposes credentials to any network-based attacker with low-privileged authenticated access. Successful exploitation leads to full confidentiality compromise as stored passwords can be read directly. No active exploitation or public exploit code has been identified, and a vendor patch is available.
Unauthorized data modification in Weintek EasyWeb allows authenticated low-privilege attackers to alter read‑only data, compromising system integrity. Affected versions are EasyWeb prior to v2.1.20 and cMT3092X firmware prior to 20210218. No active exploitation is known, and low EPSS score indicates limited real‑world risk.
Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an out-of-bounds read. An attacker sending a specially crafted Thrift message can trigger this to read beyond the buffer, potentially leaking sensitive memory contents. Remote unauthenticated exploitation is possible against any service using vulnerable bindings, and the issue is fixed in version 0.24.0.
Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory by sending crafted binary protocol messages that lack a string size limit when the non-strict path is used. Successful exploitation can crash the affected service. No active exploitation or public exploit code is currently reported.
Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affects C++ and c_glib bindings before 0.24.0. Attackers can send crafted messages to crash the service. No known active exploitation or public exploit code.
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU resources via crafted requests that trigger quadratic-time processing in the receive transport. No active exploitation or public exploit is known at
Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources by sending highly compressed data that decompresses to disproportionate sizes. Affecting all language bindings before version 0.24.0, the flaw enables denial of service via ZIP-bomb-style attacks. Upgrading to Thrift 0.24.0 provides a fix.
Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger infinite loops when processing malformed varint input, affecting Python, Go, PHP, and Java bindings before version 0.24.0. Exploitation can exhaust CPU resources, making the service unresponsive; no active exploitation or public exploit code is known at this time.
Remote code execution and credential exfiltration in Snowflake libsnowflakeclient versions before 2.9.2 stem from three distinct flaws in the C client library: a stack-based buffer overflow (CWE-121) and an out-of-bounds write in the file-download path, plus improper validation of connection parameters. A lower-privileged principal sharing an internal stage can plant a file with crafted encryption metadata that corrupts memory in a higher-privileged victim process, while the connection-parameter flaw can redirect outbound authentication requests carrying credentials and tokens to an attacker endpoint. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; the vendor fixed all issues in 2.9.2, which users must manually install.
Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute arbitrary PowerShell code on the server by injecting malicious variable values that are not escaped in the configuration file. No public exploit or active exploitation is known (EPSS 0.29%, SSVC exploitation: none), but the vulnerability has a critical CVSS score and the vendor has released a patch in version 2026.2.3.
Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to inject malicious PowerShell code. By crafting parameter names that are unsafe concatenated into a script invocation, an attacker can execute arbitrary commands on the underlying host. No public exploit or active exploitation is currently known, and EPSS indicates low exploit probability (0.29%).
Memory corruption in Apache NimBLE BASS service allows a nearby, paired attacker to exploit an integer underflow during parsing of Add Source or Modify Source PDUs, leading to a stack buffer overflow or arbitrary out-of-bounds read. This can result in full device compromise. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability, but a vendor patch is available.
Out-of-bounds memory access in the Linux kernel’s iwlwifi wireless driver allows a remote attacker on the same WiFi network to corrupt kernel memory, potentially leading to code execution or system crash. The flaw occurs in Block Acknowledgment session handlers where the sta_mask field is not checked before being used to index an array, causing a wrap-around when the mask is zero. Affected are kernel versions prior to 6.18.38 and 7.1.3; no active exploitation or public exploit code is known at this time, and EPSS indicates a low probability of exploitation.
Denial of Service in React Router 7.x (Framework Mode) allows unauthenticated attackers to send crafted requests to the manifest endpoint, causing heavy server load and degraded response times. This is a follow-up CWE-400 vulnerability to GHSA-8x6r-g9mw-2r78, affecting only Framework Mode applications using react-router versions 7.0.0 through 7.17.x. A patch is available in version 7.18.0.
We need to produce a JSON object with specific fields based on the provided CVE data. The user wants a multi-source synthesis. We have the CVE description, CVSS vector (CVSS 4.0), EPSS, patch info, CPE, tags, references, etc. Let's extract relevant details: CVE ID: CVE-2026-66040 Description: FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. Remote attackers can supply a crafted PNG image with a malicious eXIf chunk. Attackers craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution. CVSS Score: 8.7, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (with other fields as X). So base score 8.7, high impact, user interaction required (UI:P). Attack vector network, low complexity, no privileges required. CWE: CWE-122 (Heap-based Buffer Overflow) EPSS: 0.55% (43rd percentile) – relatively low exploitation probability. Patch: Available from vendor (commit b506faf). Also EUVD says patch: b506fafec9a19fcbc2be5271875fd4a63d6615bc Reported by: VulnCheck CPE: cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* (all versions prior to fix) Tags: Heap Overflow, Buffer Overflow, RCE, Canonical, Ffmpeg ENISA EUVD ID: EUVD-2026-48742, affected versions: FFmpeg 0 ≤8.1.2, patch: b506fafec9a19fcbc2be5271875fd4a63d6615bc References: pull request, commit, VulnCheck advisory, vuldb advisory. Now we need to fill each field. product_name: "FFmpeg" (primary product, 1-3 words) summary: Start with impact verb and product. Impact: heap out-of-bounds write in PNG/APNG encoder, leading to heap corruption, crash, potential RCE. Affected: FFmpeg through
Heap-based buffer overflow in FFmpeg versions up to 8.1.2 via a crafted CAF file can allow remote code execution. Exploitation requires user interaction (opening a malicious file). No known active exploitation or public exploit exists, but the vulnerability carries a critical severity score (CVSS 8.8).
CPU exhaustion in bandit 1.11.0 to 1.12.0 allows unauthenticated remote denial-of-service via WebSocket fragment reassembly. An attacker can send millions of tiny continuation frames per connection, triggering quadratic (O(n²)) buffer length recalculation that pins a CPU core for minutes to hours without requiring any authentication. No active exploitation has been confirmed (KEV), but a public proof-of-concept exists, and the EPSS score is low (0.39%).
Client-side denial-of-service in libssh2 through 1.11.1 allows a malicious SSH server to crash any connecting client before authentication by triggering an integer underflow during AES-GCM cipher negotiation, causing an out-of-bounds read and a near-SIZE_MAX memcpy that immediately terminates the process.
Reflected Cross-Site Scripting in Loytec LWEB-802 versions prior to 5.0.8 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a crafted link containing malicious project or mspParams parameters. No active exploitation has been observed in the wild and EPSS indicates a low probability of exploitation (0.36%). Vendor has released a fix in version 5.0.8.
We need to produce a JSON with the specified fields. Data: CVE-2026-12496: Stored XSS in OPC XML-DA server statistics in multiple Loytec products through 8.4.16 on LINX-A64. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS 0.36% (low). CISA KEV not mentioned, no POC data explicitly? Input has no KEV status, Tags: XSS, etc. SSVC: Exploitation none, Automatable no, Technical Impact total. Affected versions: 0 <= 8.4.16 for all products. References: loytec advisory and NVD. No patch version given. Description says "through 8.4.16", so maybe 8.4.16 is the vulnerable ending version, but no fixed version. No exact fix version. Also, note: the CVE says "on LINX-A64", but the products are different. Probably these are Loytec building automation products. The vulnerability: unauthenticated remote attacker can inject stored XSS via User-Agent header in POST /da request, which executes in admin browser. So condition: OPC XML-DA server statistics accessed by admin. Possibly requires admin viewing the stats page. CVSS 4.0: UI:P (user interaction required to trigger), so the attack requires an admin to view the malicious data. AV:N, AC:L, PR:N, UI:P. So it's unauthenticated but requires user interaction (the admin viewing the page). Also, EPSS low, no active exploitation, no KEV. We need to construct all fields accordingly. No KEV, so "no public exploit identified at time of analysis" (since POC not mentioned either). No explicit POC data, so "no public exploit identified at time of analysis" (I'll use that). EPSS 0.36% is very low, so risk is low despite high impact. But stored XSS could lead to admin compromise, so high impact. product_name: Loytec LW-series? Actually products: LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD. They are all Loytec building automation devices. I'll pick a representative, maybe "Loytec L-INX" or "Loytec L-GATE"? The CPE list includes lip-me20xc, l-inx, l-gate, etc. So product_name: "Loytec L-INX" (one of
We need to extract from the provided information and synthesize into the required JSON fields. Let's go through each field. Product name: The affected product is primarily the Loytec LIP-ME201C, but the vulnerability affects many products: LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD. The description says "through 8.4.18 on LINX-A64". So the primary product might be LIP-ME201C or the whole family. Which to pick? "Loytec LIP-ME201C" seems specific. But it might be better to use "Loytec LIP-ME201C" as the main product? Or the family "Loytec LINX-A64" as in the description. The description mentions "Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64". So it's a range of products that share the same underlying software. The product name could be "Loytec BACnet Devices". But the instruction says 1-3 words only. I can use "Loytec LIP-ME201C" as the first listed, or "Loytec LINX-A64". I'll go with "Loytec LIP-ME201C" as it's the first in the list and a specific product. Or "Loytec BACnet Devices" is 3 words. But they want the specific product name, not a vulnerability type. So I'll use "Loytec LIP-ME201C". Actually the description says "on LINX-A64", which is the platform. So maybe the product is "Loytec LINX-A64"? But the CPE list includes many products like l-inx, l-gate, etc. So it's a group of products. I could say "Loytec Automation Devices" but that's generic. I'll choose "Loytec LIP-ME201C" to be specific. 1-3 words: "Loytec LIP-ME201C" (3 words). That's fine. Summary: Must be 2-3 sentences, original synthesis. Start with impact verb and product. E.g., "Denial of service in Loytec LIP-ME201C and related building automation devices allows..." The impact: crash linx_a64.exe and reboot device. So it's a DoS that forces device reboot. WHO: unauthenticated remote attacker via malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with invalid month value. So "Denial of service in Loytec LI
Double-free heap corruption in libssh2's SFTP client allows a malicious SSH server to corrupt the memory of any authenticated client that opens an SFTP session. This vulnerability, present in libssh2 through 1.11.1, can be triggered via a crafted server response during the `sftp_open()` operation, leading to tcache poisoning and potential arbitrary code execution on the client. No active exploitation has been confirmed, and no public PoC is known at this time, though the EPSS score is low (0.29%).
We need to produce a JSON with the fields as specified. The input data includes description, CVSS vector (CVSS 4.0), CWE, EPSS, SSVC, patch info, CPE, tags, references, etc. The output must be a JSON object. Let's analyze the data: - CVE-2026-15810: XSS in Google Cloud Looker (formerly Looker) versions prior to several patched versions. Allows arbitrary JavaScript execution leading to administrative account takeover via malicious URL. Looker-hosted and Self-hosted. Hosted already mitigated. Self-hosted must upgrade. - CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber - AV:N network, AC:L low, AT:N none, PR:N none, UI:P passive (user interaction required), VC:H/VI:H/VA:H (high impact on vulnerable system integrity, confidentiality, availability), SC:L/SI:L/SA:L (low impact on subsequent system). Overall base score 8.7? Actually the vector doesn't include score, but we are given "CVSS Score: 8.7" and vector. So CVSS 4.0 base score 8.7. However, the output requires "assessed_cvss_vector" (CVSS 3.1) and "assessed_cvss40_vector". The instruction: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." And also "assessed_cvss40_vector" "The SAME assessment expressed as a CVSS 4.0 base vector, consistent with your 3.1 choice." So we need to provide a 3.1 vector, and then a 4.0 vector based on our assessment. But we also have the input's CVSS 4.0 vector. We can use that to derive our own. It's an XSS with high impact: admin account takeover. User interaction required (UI:P in CVSS 4.0 means passive user interaction, so in 3.1, UI:R). No privileges required (PR:N). Network attack vector. So for 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H? Actually XSS typically scope changed? In CVSS 3.1, XSS usually has scope changed
We need to produce a JSON with the specified fields. Let's analyze the input. CVE ID: CVE-2026-17107 Description: A flaw in cluster-proxy service-proxy component used in RHACM and MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster. CVSS: 8.5, vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-441 (Unintended Proxy or Intermediary ('Confused Deputy')). Actually CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')? Wait, description: "The software fails to properly de-identify or sanitize caller-supplied data when acting as a proxy, relay, or other intermediary." That fits. EPSS: 0.23%, percentile 14% (low). KEV: not mentioned, so no active exploitation. POC: not mentioned. Tags: Kubernetes, Red Hat, Privilege Escalation, Multicluster Engine For Kubernetes. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. References: access.redhat.com security page, bugzilla, vuldb, RHSA-2026:46885 (likely an errata with fix). Also CPE: cpe:2.3:a:red_hat:multicluster_engine_for_kubernetes:*:*:*:*:*:*:*:* - all versions, so no specific version range given. It mentions RHACM and MCE. So product name: Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The CPE given is for MCE. Primary product: Could be "Red Hat MCE" or "Red Hat Advanced Cluster Management". We'll pick the main one as "Red Hat Advanced Cluster Management for Kubernetes" or combine? "Red Hat Advanced Cluster Management" probably. I'll pick "Red Hat Advanced Cluster Management" as product_name, since that's the parent product. But the vulnerability is in cluster-proxy service-proxy component that is part of both. I'll use "Red Hat Advanced Cluster Management for Kubernetes (R
We are tasked with synthesizing data from multiple sources about CVE-2026-10610 into a comprehensive analysis in JSON format. The output must be a JSON object with the specified fields, all strings, and no arrays or objects. Let's extract relevant data: - CVE ID: CVE-2026-10610 - Description: "Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user." - CVSS Score: 8.5 (CVSS 4.0 score, base score 8.5) - CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CWE: CWE-269 (Improper Privilege Management) - EPSS Score: 0.14% (percentile 4%) - Reported by: ESET - CPE: cpe:2.3:a:eset_spol._s.r.o.:eset_endpoint_security_for_macos:*:*:*:*:*:*:*:*, cpe:2.3:a:eset_spol._s.r.o.:eset_cyber_security_for_macos:*:*:*:*:*:*:*:* - Tags: RCE, Privilege Escalation, Eset Endpoint Security For Macos, Eset Cyber Security For Macos - SSVC: Exploitation: none, Automatable: no, Technical Impact: total - ENISA EUVD ID: EUVD-2026-48558 - Affected versions (EUVD): - ESET Endpoint Security for macOS 0 ≤8.0.7200.0 - ESET Endpoint Security for macOS 9.0 ≤9.0.5400.0 - ESET Endpoint Security for macOS 8.1 ≤8.1.200.0 - ESET Cyber Security for macOS 0 ≤9.0.5300.0 - ESET Endpoint Security for macOS 9.1 ≤9.1.2500.0 - References: - [cveorg] (None) https://support.eset.com/en/ca8977-eset-customer-advisory-local-privilege-escalation-vulnerability-in-eset-security-applications-for-macos-fixed - [vuldb] (advisory) https://vuldb.com/vuln/382896 - [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-10610 We also have "Reported by: ESET" likely meaning the vulnerability was reported by ESET, and the product is ESET's own software. Now, we need to produce fields. Let's go through each: 1. product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPre
Local privilege escalation in ESET Endpoint Security and Cyber Security for macOS allows a low-privileged local attacker to write arbitrary files with controlled content as root, leading to full system compromise. The vulnerability affects multiple versions of the macOS security applications and is addressed in a vendor patch. No active exploitation has been reported, and the EPSS score is low at 0.12%, but exploitation would give an attacker complete control over the system.
We need to produce a JSON with various fields. We'll synthesize from data: CVE-2026-64247. The vulnerability is in Linux kernel, KVM x86 Hyper-V, a bounds check missing for sparse bank index, leading to out-of-bounds read (KASAN: use-after-free). Technical: KVM (Kernel-based Virtual Machine) with Hyper-V emulation, specifically the paravirtual TLB flush for L2 guests via enlightened VMCS. VP ID is copied verbatim without bounds check. With a large VP ID (>= 4096), it causes out-of-bounds read on sparse bank bitmask (max 64 banks of 64 vCPUs each = 4096). Impact: possible unnecessary TLB flush, but the KASAN splat shows use-after-free? Actually the bug is out-of-bounds read of a bitmask, which KASAN logs as use-after-free? Let's see: "KASAN: use-after-free in hv_is_vp_in_sparse_set" but description says out-of-bounds read. Probably the address is bogus. It might lead to information disclosure (H high confidentiality impact) or denial of service (A high) but AV:L, PR:L (needs local access to guest to trigger the hypercall? Actually the attacker is a guest VM user triggering hypercalls via CPUID? The description: "When handling a paravirtual TLB flush for L2, the VP ID is copied verbatim from the enlightened VMCS, without bounds check." The bug is in KVM code handling a hypercall from the guest. The attacker would be a malicious guest (L2) that can execute hypercalls. So the access vector is local (from guest VM) with low privileges (normal user in guest). Scope changed? CVSS says S:C, meaning the vulnerable component is the host/KVM and the impact is to the host (confidentiality high, availability high). So an out-of-bounds read could leak host memory, and could crash host. That's plausible. So the assessed CVSS might be similar. Already provided: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H. We'll use that but need to confirm independence? The instruction: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploi
We are tasked with producing a comprehensive analysis of CVE-2026-12504 in JSON format. We have description, CVSS 4.0 vector, CWE, EPSS, CPEs, tags, SSVC, affected versions from EUVD, and references. No KEV status mentioned, so not in KEV. EPSS is low. The description says: Improper Authentication due to PAM configuration allows local attacker to authenticate as uid=0 without password and get root shell via /etc/passwd entry with empty password. So this is a local privilege escalation via a misconfigured PAM allowing passwordless root login if there is a root entry with empty password. The vulnerability is in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD through 8.4.16 on LINX-A64. So it's a very specific product line, likely industrial or building automation devices. CVSS 4.0: AV:L, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So local attack, low complexity, requires high privileges (PR:H), no user interaction. That matches concept: to add an entry to /etc/passwd, you need high privileges, then you can get root. So the vulnerability is that if a root entry with empty password exists, you can log in as root without password. This is improper authentication in PAM config. SSVC: exploitation none, automatable no, technical impact total. So no active exploitation, not automatically exploitable, total impact if exploited. EPSS 0.13% (low). No POC mentioned. So low risk. No KEV. We must synthesize data from multiple intel sources: we have NVD description, EPSS, CWE, CPEs, tags, SSVC, EUVD affected versions, references. We'll write fields as paragraphs. Use all data to add value. We'll cross-reference. We'll note that the vulnerability is in PAM configuration, likely a default configuration that permits empty password for root, conflicting with security expectations. Affected are many Loytec building automation products running on LINX-A64 architecture. The attacker must already have high privileges (probably root) to add such an en
A local privilege escalation flaw in the ltsudo binary on Loytec LIP-ME201C and related L-Series building automation controllers allows an attacker with superadmin group membership to reset the password of any LARM user, including the larmapp service account, via the set-passwd subcommand. This can lead to full compromise of LINX-A64-based devices running firmware up to version 8.4.16. Exploitation requires local access and high privileges; no active exploitation or public exploit code is currently known, and EPSS indicates a very low probability of exploitation.
TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC communications. The vulnerability resides in the TSSLSocket matchName() function's handling of wildcard certificates per RFC 6125, permitting an attacker with a crafted certificate to impersonate a legitimate server. Upgrading to version 0.24.0 fixes the flaw; no active exploitation or public exploit has been identified at this time.
Una
We need to produce a JSON object with the specified fields. Let's analyze the data. CVE ID: CVE-2026-64223 Description: In the Linux kernel, wifi: mac80211: consume only present negotiated TTLM maps. It's an out-of-bounds read due to parsing error in negotiated TTLM elements. The vulnerability is in mac80211 (Linux kernel wireless subsystem). Specifically, ieee80211_parse_neg_ttlm() advances cursor for every TID, even if presence bit is clear, leading to reading past validated element for later present TIDs. The bad bytes land in neg_ttlm->{up,down}link[tid] but gated by valid_links, so a peer cannot turn it into policy change. Under KUnit + KASAN, OOB read reported as slab-out-of-bounds. In production, depends on allocator state. So from the description: It's an out-of-bounds read. Affected product: Linux kernel (specifically mac80211 subcomponent). CVSS score 8.1, vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H -> Adjacent network (WiFi range?), low complexity, no privileges, no user interaction, scope unchanged, high confidentiality and availability impact, no integrity. So it's a read and potentially crash/A impact. EPSS: 0.17% (6th percentile) very low. Patch: Available from vendor (Linux). CPE strings: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (generic), no version specified in CPE, but EUVD provides affected versions: Linux commits from 8f500fbc6c... up to various fix commits. EUVD versions: Linux 8f500fbc6c... < a6e6ccd5bd... (6.12.92?), etc. Patches: "Linux patch: 6.18.34", "6.12.92", 0, 7.1, 7.0.11? Those look odd: maybe patch versions for stable trees. Anyway, the vulnerability is in mac80211, which is part of the Linux kernel. The affected versions likely include kernels where this commit 8f500fbc... (introduced) until fix commit a6e6ccd5bd..., which appears in various stable trees. I need to synthesize. Product_name: "Linux Kernel" (1-3 words). Actually the specific product is "mac80211" which is part of the Linux kernel's wireless stack. So "Linux Kernel mac80
Denial of service in the Linux kernel's x86/ftrace dynamic trampoline mechanism causes a kernel panic when CONFIG_CALL_DEPTH_TRACKING is enabled on retbleed-affected platforms (e.g., Skylake) using retbleed=stuff. An attacker with local privileged access to configure ftrace can trigger a crash by setting up a kprobe event and invoking the traced function. No active exploitation or public exploit has been reported, and the EPSS probability is 0.16% (5th percentile), indicating low real-world risk.
We need to produce a comprehensive analysis for CVE-2026-54342. We have multiple sources: the description, CVSS vector, CWE, EPSS, patch, CPE, tags, references, etc. We'll synthesize into the required JSON fields. First, identify product_name: the description says "epa4all", a product by med-united. So product_name: "epa4all". Keep 1-3 words. Summary: Synthesize original, don't copy description. Start with specific impact verb and product. It's about a TLS certificate validation issue on network path between epa4all and backends. Impact: attacker on network path can present self-signed certificate and intercept connection. For non-VAU connections, direct read and modify traffic including smartcard and OIDC. For ePA backend, it's transport-level enabler for another vulnerability (GHSA-vvh7-x6c7-46gh). Patch in version 2026-05-20. Mention if actively exploited? No KEV. EPSS low (0.12%). POC status? Not mentioned. We'll craft a summary like: "Man-in-the-middle interception in epa4all prior to 2026-05-20 allows network-path attackers to bypass TLS validation by presenting a self-signed certificate, enabling traffic decryption, modification, and injection for backend connections (Konnektor, IDP) and enabling a VAU MITM for ePA backend. Attacker can read and modify smartcard operations and OIDC authentication exchanges." Avoid "A vulnerability". Technical_context: Explain underlying tech: TLS, certificate validation, CWE-295 Improper Certificate Validation. Use CPE to identify affected: cpe:2.3:a:med-united:epa4all:*:*:*:*:*:*:*:*. So it's the epa4all application. Specifically, the TLS verification is disabled for certain connections, allowing self-signed certificates. Attacker on network path (adjacent network). Reference the CWE. So: "The vulnerability arises from improper certificate validation (CWE-295) in epa4all's TLS implementation for connections to backend services (Konnektor, IDP, ePA backend). The application does not verify the server certificate, allowing any self-signed certificate to be accepted, which enables a man-in-the-middle attack. For non-VAU connections, this results in cleartext exposure of authentication and smartcard data; for the ePA backend, it disables transport security, acting as an enabler for a separate VAU bypass (GHSA-vvh7-x6c7-46gh)." Risk_assessment: Use CVSS vector AV:A (adjacent network), AC:L, PR:N, UI:N, S:U, C:H, I:H, A:N. EPSS 0.12% (very low). KEV: not listed. POC: not mentioned, but advisory implies potential exploitation if on network path. So real-world risk: exploitability limited to network-path attackers (adjacent). Adjacent network typically means same local network segment, so not remotely exploitable over internet. Combined with low EPSS, it's likely low immediate risk, but severity is high impact. The CVSS base score is 8.1 (High) but AV:A reduces reachability. SSVC: exploitation status: no public exploit identified, automatable: likely yes (once on network), technical impact: high. So risk: high severity but limited attack vector; not a priority for internet-facing but important for internal networks in healthcare. We'll state: "CVSS 8.1 indicates high confidentiality and integrity impact with adjacent network attack vector, requiring attacker to be on the same network segment. EPSS score 0.12% suggests low likelihood of widespread exploitation. No known active exploitation or public exploit code. The attack vector limits exploitability to local network adversaries, reducing overall real-world risk for internet-facing deployments but critical for healthcare environments handling sensitive patient data." Compare signals. No conflicting info. All from CVSS and description. Affected_products: "epa4all versions prior to 2026-05-20 (CPE: cpe:2.3:a:med-united:epa4all:*:*:*:*:*:*:*:*) as per EUVD advisory. Vendor patch released in version 2026-05-20, available at https://github.com/med-united/epa4all/releases/tag/2026-05-20. References: GHSA-296w-v8f6-3rf7, GHSA-vvh7-x6c7-46gh, and machinespirits.com advisory b98b02." Remediation: Actionable: Upgrade to version 2026-05-20 or later. The patch is available from vendor. The advisory references the release. No specific workarounds mentioned. If no patch is possible, compensating controls: "If immediate upgrade not possible, restrict network access to epa4all's backend communication to trusted segments, enforce mutual TLS with pinned certificates, and monitor for unauthorized certificates. Note that this does not fully mitigate the risk as the underlying TLS verification bypass remains, but can reduce the attack surface." But since patch exists, primary recommendation is upgrade. We'll mention "Upgrade epa4all to version 2026-05-20, which properly validates TLS certificates. Advisory: GHSA-296w-v8f6-3rf7. No additional workarounds provided by vendor." I'll keep it focused. Exploit_scenario: Realistic: "An attacker positioned on the same network segment as the epa4all instance performs a man-in-the-middle attack by presenting a self-signed TLS certificate to the epa4all client when it connects to the Konnektor or IDP backend. The attacker then intercepts smartcard operations and OIDC authentication tokens, enabling unauthorized access to patient health records." If POC exists, note that; none mentioned. Exploitation_conditions: Specific prerequisites: The attacker must be positioned on the network path between epa4all and the backend services (Konnektor, IDP, TSS, or ePA Aktensystem). For non-VAU connections (Konnektor, IDP), exploitation requires no further conditions beyond network adjacency. For the ePA backend, the disabled TLS verification is an enabler for the VAU MITM described in the referenced GHSA, meaning that another vulnerability or configuration (VAU bypass) is needed to fully exploit the ePA connection. So condition: network adjacency, and for ePA backend exploitation requires combined with the VAU MITM vulnerability. Importantly, the description says "For non-VAU connections ... this allows direct read and modification of the inner traffic". So no special configuration needed for those backends. It just works by default? It says "disabled TLS verification is the transport-level enabler for the VAU MITM", so for ePA backend the actual MITM requires VAU vulnerability. So exploitation condition: Attacker must be on the same network segment as epa4all or a network path to the backends. No user interaction or authentication required. Affects all versions prior to 2026-05-20 in default configuration (no TLS verification). For ePA backend, combined with GHSA-vvh7-x6c7-46gh to achieve full compromise. Attack_chain: 3-7 steps. AV:A, so network adjacency. Steps: Attacker gains network adjacency (e.g., compromised host on same LAN) → Attacker positions as man-in-the-middle (ARP spoofing, etc.) → Intercept TLS handshake and present self-signed certificate → epa4all accepts certificate without validation → Decrypt and read/modify application data. For IDP/Konnektor: inject commands, steal OIDC tokens. For ePA backend: combined with VAU bypass to access plaintext health data. So 5-step: Access (gain LAN access) → Delivery (MITM setup like ARP spoof) → Exploit (TLS bypass) → Execution (decrypt traffic) → Impact (modify smartcard operations, credential theft). That's 5 steps. I'll craft: "Gain network adjacency to epa4all host → Perform ARP spoofing to intercept traffic between epa4all and backend → Present self-signed TLS certificate during handshake → epa4all accepts certificate without validation → Decrypt and modify OIDC authentication tokens and smartcard operations." Confidence_notes: "Vulnerability confirmed by vendor advisory (GHSA-296w-v8f6-3rf7) and patched in version 2026-05-20. CVSS vector provided by NVD. No evidence of active exploitation or public exploit code. Attack vector limited to adjacent network as per CVSS, consistent with description. CPE data indicates all versions before 2026-05-20 are affected." So we can say that. Prevalence: epa4all is a tool for the German ePA (electronic patient record) system, used in healthcare. Not as widespread as general-purpose software. Likely low or medium. It's niche: healthcare sector in Germany. So prevalence ~ low. "low". Prevalence_basis: "German healthcare ePA middleware, limited deployment outside Germany." Rationale. Now, assessed_cvss_vector: We will reassess based on our analysis. CVSS from input is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. This seems accurate. Attack vector adjacent, no privileges, no user interaction, unchanged scope, high confidentiality and integrity, no availability impact. So we can output that same vector but it's our independent assessment, not copying. So we'll output "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" and rationale "Adjacent network attack, no privileges or interaction needed, high data exposure and modification without availability impact." CVSS 4.0 vector: Map to 4.0. AV:A (adjacent network) -> AV:A. AC:L -> AC:L. AT: none specific, so AT:N. PR:N, UI:N. VC:H, VI:H, VA:N (no availability). Scope unchanged, so SC:N, SI:N, SA:N. So "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N". Rationale: same as 3.1. Now put into JSON. All fields plain text strings, no arrays. So we'll write a single paragraph for each. No bullet points, no JSON inside. Summary: make it 2-3 sentences, start with "TLS certificate validation bypass in epa4all..." That's what it is: a man-in-the-middle due to disabled TLS verification. Actually, the vulnerability is that it doesn't verify certificates, so it's a bypass. So "TLS certificate validation bypass in epa4all versions prior to 2026-05-20 allows network-adjacent attackers to intercept backend connections by presenting a self-signed TLS certificate, enabling decryption and modification of traffic including smartcard operations and OIDC authentication exchanges." That's one sentence, we need 2-3. I'll make it two: "TLS certificate validation bypass in epa4all versions prior to 2026-05-20 allows network-adjacent attackers to intercept backend connections by presenting a self-signed TLS certificate. Attackers can decrypt and modify smartcard operations, OIDC exchanges on non-VAU connections, and for the ePA backend, this enables a VAU man-in-the-middle (GHSA-vvh7-x6c7-46gh)." That's good. Technical context: "The flaw stems from improper certificate validation (CWE-295) in the TLS client implementation of epa4all (cpe:2.3:a:med-united:epa4all). When connecting to backend services like Konnektor, IDP, or ePA Aktensystem, the application fails to verify the server’s certificate, accepting any self-signed certificate presented by a man-in-the-middle. This violates the trust model expected for healthcare data exchange, exposing patient-sensitive OIDC tokens and smartcard operations to interception and tampering without any user interaction or authentication requirement." Risk assessment: "CVSS 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates high confidentiality and integrity impact but requires adjacent network access, limiting exploitation to internal network segments. EPSS score of 0.12% suggests very low probability of widespread exploitation. No active exploitation or public proof-of-concept is currently known. While the vulnerability could critically compromise healthcare data within a localized network, the attack vector constraint and low EPSS reduce overall immediate risk for internet-facing environments, but it remains a high priority for healthcare providers using epa4all." Affected products: "epa4all versions prior to 2026-05-20 (identified by CPE cpe:2.3:a:med-united:epa4all) are affected. The vendor has released a patch in version 2026-05-20, detailed in the release notes at https://github.com/med-united/epa4all/releases/tag/2026
Privilege escalation in the Wpify Woo WordPress plugin (versions ≤ 5.4.16) lets authenticated Shop Manager users overwrite arbitrary WordPress options and promote themselves to Administrator. The vulnerable SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) forwards attacker-controlled 'option' and 'data' values straight into update_option() with no allowlist or sanitization, gated only by the manage_woocommerce capability. Reported by Wordfence with a CVSS of 8.0; no public exploit identified at time of analysis and not listed in CISA KEV.