We need to produce a JSON object with the specified fields. All fields are plain text strings. The input includes CVE-2026-66748 description, CVSS 4.0 vector (base only, no temporal/environmental), CWE-94, tags, POC publicly available, Patch available from vendor, CPE, SSVC, references, release notes with more details. Need to synthesize. Key points from description: Camaleon CMS versions 2.1.1 through 2.9.1, authenticated remote code execution, users with custom_fields manage permission can execute arbitrary Ruby code via select_eval custom field type. They supply a malicious expression in the field options command parameter, evaluated via instance_eval in ERB view when post edit page is rendered, achieving code execution with web process privileges. CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. This is a v4 vector. Note the PR:L (low privileges). So authenticated as low privilege? Description says "users with custom_fields manage permission" - that's a specific permission, might be low or high? Typically custom_fields manage is not admin-level, maybe low. PR:L is consistent. AC:L, AV:N, UI:N. Total technical impact. So high CVSS 8.7 (not sure if that's computed score or base? CVSS 4.0 base score with those metrics would be 9.3? Wait, the given score is 8.7, maybe includes some environmental? But vector does not have environmental. Let's compute: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N -> base score: impact subscore: VC,H=0.56? Actually CVSS 4.0 formula: base score = max( ( (Impact_subscore * Exploitability_subscore)^? No, need to recall. But not necessary, just given score. We'll assess our own vector (both 3.1 and 4.0) based on description. Key: Authentication required (PR:L). Exploitation requires custom_fields manage permission (PR:L). The vulnerability is in how select_eval custom field type is evaluated. This field type was meant for advanced usage, but now they restrict it with a new permission. So prior to 2
Path traversal in TinyWeb through 0.0.8 allows unauthenticated remote attackers to read arbitrary files from the server's filesystem by injecting ../ sequences into the URL path, which are concatenated without normalization in HttpBuilder::buildResponse(). Publicly available exploit code exists, yet no active exploitation is recorded in CISA KEV; the risk is elevated when the server runs as root, exposing credential stores and private keys.
Null pointer dereference in TinyWeb 0.0.8 and earlier allows unauthenticated remote attackers to crash worker processes by sending an HTTP request with a malformed version string, causing a permanent denial of service when all workers are terminated. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
Memory exhaustion vulnerability in TinyWeb HTTP server (through 0.0.8) enables unauthenticated remote attackers to cause denial of service by sending ordinary HTTP requests. A memory leak in the request parser allocates objects without freeing them, consuming approximately 20–28 kB per request until the worker process is killed. Publicly available exploit code exists, but no active exploitation has been confirmed via CISA KEV.
Remote file disclosure in openhole-server v0.1.1 and earlier allows unauthenticated attackers to read arbitrary files from tunneled local services. The server forwards URL-decoded request paths, causing percent-encoded dot-segments (%2e%2e) and slashes to be decoded into path traversal sequences (../) before reaching the backend. Exploitation requires a tunneled local service that resolves paths without canonicalization, and the vulnerability is fixed in v0.1.2 by preserving raw percent-encoding.
Bearer token leak in the OAuth2 Ruby gem (ruby-oauth/oauth2) versions 0.4.0 through 2.0.
QTI Neon's relay service amplifies RECONNECT_REQUEST packets to the host, enabling unauthenticated attackers to cause denial of service on the host. The vulnerable handleReconnectRequest function in all three implementations (Java, Python, TypeScript) forward every request without bounding or deduplication, bypassing per-source rate limiting via spoofed IPs. No public exploit or KEV listing exists, but the attack is trivial to execute if a valid session ID is known.
We need to construct a JSON object that synthesizes data from multiple sources about CVE-2026-54690. The input includes description, CVSS, CWE, patch info, CPE, references, tags, etc. The output must be plain text strings, no arrays or objects, each field a coherent paragraph. Let's analyze the data. CVE ID: CVE-2026-54690 Description: datamodel-code-generator generates Pydantic v2 models, etc., from various schemas. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP/HTTPS URLs via _get_ref_body, and --allow-remote-refs gate can warn instead of blocking, allowing SSRF. Fixed in 0.61.0. CVSS: 8.2 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. So network, low complexity, no privileges, user interaction required, scope changed, high confidentiality, low integrity, no availability. CWE-918: Server-Side Request Forgery (SSRF). Tags: SSRF, Datamodel Code Generator. Patch: Available from vendor. Fix in version 0.61.0, commit. CPE: cpe:2.3:a:koxudaxi:datamodel-code-generator:*:*:*:*:*:*:*:* (asterisk, so all versions? Actually range is before fix, so vulnerable <=0.60.2? The description says from 0.9.1 until 0.61.0, with fix in 0.61.0, so vulnerable is >=0.9.1, <0.61.0. CPE * indicates all versions, but advisory says >=0.9.1. Probably better to specify version range. The EUVD affected versions: "datamodel-code-generator 0.9.1, < 0.61.0". References: GitHub advisory, commit, release tag. GHSA advisory from GitHub: summary says vulnerable to SSRF via JSON-Schema $ref to HTTP URL. It details that remote refs are fetched with no validation; --allow-remote-refs defaults to None which warns but then fetches; only explicit false blocks. Fetched body is parsed as sub-schema and reflected into generated code, leading to leakage. Only affects users who installed [http] extra. PoC available. Patch: commit adds --allow-private-network flag to block private network targets by default, and modifies behavi
Code injection via unescaped validator entries in datamodel-code-generator's --extra-template-data feature allows arbitrary Python code execution when a generated Pydantic v2 model is imported. Affects versions 0.52.1 through 0.60.1, with a fix in 0.60.2. Publicly available exploit code exists, though no active exploitation has been reported to CISA KEV.
Authentication bypass in pytonapi 2.2.0 allows unauthenticated remote attackers to trigger webhook handlers when a custom path is configured via the documented `path=` argument. The TonapiWebhookDispatcher fails to store bearer tokens for custom paths, causing the token check to be skipped entirely. Publicly available exploit code exists but no active exploitation in the wild has been confirmed.
We need to produce a JSON object with the specified fields. We'll synthesize data from the input. CVE ID: CVE-2026-55389 Description: datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in src/datamodel_code_generator/parser/jsonschema.py through is_url and _get_ref_body without containing file:// or ../ traversal references to the input directory and without honoring --no-allow-remote-refs, allowing arbitrary local file reads. This issue is fixed in version 0.62.0. CVSS Score: 7.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE: CWE-22 Tags: Path Traversal, Datamodel Code Generator CPE: cpe:2.3:a:koxudaxi:datamodel-code-generator:*:*:*:*:*:*:*:* Multi-source intelligence from GitHub Advisory: summary confirms arbitrary local file read via JSON-Schema $ref using file:// or ../ traversal, bypassing --no-allow-remote-refs. Details show code branches that handle local file reads without containment checks. Fixed in 0.62.0. POC? Not explicitly stated, but the issue is described with code fragments and test cases that demonstrate the vulnerability. No KEV mention. EPSS not provided. CWE-22 is path traversal. We need to analyze and fill all fields. product_name: "datamodel-code-generator" (the specific product name, 1-3 words) summary: Synthesize original summary, not copy description. Must start with impact verb and product. "Arbitrary local file read in datamodel-code-generator prior to 0.62.0 allows unauthenticated attackers to read any file on the system via crafted JSON Schema $ref references (file:// or ../ traversal), bypassing the --no-allow-remote-refs control. This is fixed in version 0.62.0. Exploit code exists (public test cases) but no active exploitation reported." Wait, "Arbitrary local file read" is the impact. So summary: "Arbitrary loc
Remote denial of service in gotd/td versions before 0.145.1 allows unauthenticated attackers to exhaust memory and CPU by sending a crafted MTProto unencrypted packet with a maliciously inflated dataLen field, causing excessive allocation before length validation. No authentication or session is required, and the vulnerability is reachable during the handshake phase. There is no evidence of active exploitation and no public exploit has been identified.
An authorization bypass in goshs’s bulk zip-download route allows unauthenticated attackers to read any file protected solely by a per-folder .goshs ACL, circumventing both folder-based authentication and per-file block lists. The vulnerability affects goshs v2.x up to 2.1.0 and all v1.x versions. A proof-of-concept is publicly available, demonstrating the bypass against a patched version that had addressed a related ACL gap on write/delete routes but left the read path unprotected.
A DNS rebinding flaw in datamodel-code-generator's SSRF guard allows unauthenticated remote attackers to bypass the default `allow_private_network=False` restriction and reach internal services. The vulnerability affects versions prior to 0.63.0, where a time-of-check/time-of-use gap between URL validation and connection enables rebinding to private IPs. A public proof-of-concept exists, though no active exploitation in the wild is reported at this time.
Unauthorized post creation and arbitrary post/page overwrite in the Tablesome Table WordPress plugin before version 1.1.31 due to missing authentication, capability, and nonce checks in an AJAX action. Unauthenticated attackers can create new published posts or overwrite any existing published content. Public exploit code exists, but no active exploitation has been confirmed; EPSS predicts very low exploitation probability (0.18%).
Denial-of-service in Xen's Xenstore component allows unprivileged guest domains to crash the host by triggering a bitmap teardown in an error path of the XEN_DOMCTL_get_domain_state operation. Exploit code is publicly available, though no active exploitation is confirmed. The attack is automatable, requiring no user interaction or guest authentication.
We need to generate a JSON object with the specified fields, synthesizing all provided data about CVE-2026-14870. First, parse the input: CVE ID: CVE-2026-14870 Description: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. CVSS Score: 7.1 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CWE: CWE-79 EPSS: 0.15% (percentile 5%) POC/Exploit: Publicly available Patch: Available from vendor Reported by: WPScan CPE: cpe:2.3:a:unknown:database_for_contact_form_7,_wpforms,_elementor_forms:*:*:*:*:*:*:*:* Tags: XSS, WordPress, Database For Contact Form 7 Wpforms Elementor Forms SSVC: Exploitation: poc, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-49701 Affected versions (EUVD): ["Database for Contact Form 7, WPforms, Elementor forms 0 <1.5.3"] References: [cveorg] (exploit) https://wpscan.com/vulnerability/d574b78c-df04-4dab-bd33-e3a22ff51918/ [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-14870 Now, construct each field as a paragraph string. product_name: The plugin name is "Database for Contact Form 7, WPforms, Elementor forms". So product_name: "Database for Contact Form 7, WPforms, Elementor forms" – but that's long, but permissible as a product name. The task says "1-3 words ONLY." That's problematic because the product name is longer. I need to pick a short name. The plugin's main purpose: it's a database plugin for those form plugins. Maybe "WordPress Forms Database" or "Database for CF7, WPforms, Elementor Forms"? But I must keep it 1-3 words. The plugin name as per WPScan: "Database for Contact Form 7, WPforms, Elementor forms". I could shorten to "Database for Contact Form 7, WPforms, Elementor forms plugin"? No, that's too long. The instruction says: "product_name": "1-3 wor
Brute-force vulnerability in MikroTik RouterOS allows adjacent network attackers to gain full administrative access by repeatedly guessing API credentials without effective lockout or rate-limiting. The absence of source-based restrictions and the ability to bypass a weak per-connection delay through concurrent sessions make high-volume password attacks practical. Successful exploitation grants complete control over the device, compromising confidentiality, integrity, and availability.
Authorization bypass in HashiCorp's terraform-mcp-server (versions 0.3.0 through 1.0.x) lets an attacker who obtains another user's MCP session identifier execute their own tool calls under the victim's Terraform credentials when the server runs in streamable-HTTP stateful transport mode. Rooted in a session fixation weakness (CWE-384), the flaw carries a CVSS 8.9 with a scope change, meaning cross-user credential misuse against managed infrastructure. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC records exploitation as none, indicating no observed active exploitation.
Code injection in datamodel-code-generator 0.17.0–0.60.1 allows attackers who control a schema’s default_factory value to inject arbitrary Python expressions into generated models, achieving remote code execution when the target imports the poisoned module. The vulnerability affects all supported input types (JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, XSD) and output model types (Pydantic v2, dataclass, msgspec). Public exploit code exists; the issue is fixed in version 0.60.2.
We need to produce a comprehensive analysis in JSON format for CVE-2026-17524. The provided data includes description, CVSS, CWE, patch status, CPE, tags, references, EUVD info, and source code diff. We'll synthesize these into the required fields. Let's analyze: - CVE ID: CVE-2026-17524 - Description: Versions of zip-lib before 1.1.0 vulnerable to Directory Traversal via caching mechanism for path validation during extraction. Attacker can bypass security checks (isOutsideTargetFolder) that only checks and caches path status when initial directory symlink is created during first extraction. - CVSS Score: 8.7 (CVSS 4.0 vector given) - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - Patch: Available from vendor (references point to GitHub commit fixing issue) - Reported by: snyk - CPE: cpe:2.3:a:n/a:zip-lib:*:*:*:*:*:*:*:* (note: vendor is "n/a", product is "zip-lib") - Tags: Path Traversal, Zip Lib - ENISA EUVD ID: EUVD-2026-49687, affected versions: zip-lib 0 <1.1.0 - References: snyk advisory, GitHub commit, GitHub issue #14 - Source code evidence: Commit diff shows changes in fs.ts and unzip.ts. The fix involves ensuring folder creation returns symbolic link info and tracks symlink folders in EntryContext; the isOutsideTargetFolder function now checks symlinkFolders. This confirms the vulnerability and the fix. Now, for fields: product_name: "zip-lib" (the specific npm package). Short, 1-3 words. Could also be "zip-lib (npm)" but product_name should be plain "zip-lib". summary: Need 2-3 sentences, original synthesis, not copied. Start with impact verb and product: "Directory traversal in zip-lib before 1.1.0 allows attackers to write files outside the intended extraction directory by exploiting a flawed caching mechanism that only validates symlink paths during initial directory creation." Mention affected product, what attacker can do, exploitation status (no KEV, no POC known? Actually no POC info in provided data;
Missing authorization in the insert path of an unspecified product's configuration table enables a low-privileged remote attacker to gain administrator privileges, leading to full system access. The specific affected product and version are not disclosed in the limited advisory information; no data on active exploitation or patch availability is provided.
Privilege escalation in the WP Password Policy plugin for WordPress up to version 3.7.1 allows authenticated attackers with subscriber-level access to escalate to Administrator by submitting a crafted POST request to the password-reset form endpoint. The vulnerability results from missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `set_role()` with an attacker-supplied role. At time of analysis, no active exploitation or public exploit code was identified.
Heap-based buffer overflow in the schreibfaul1 ESP32-audioI2S library (version 3.4.5) exposes ESP32-based audio devices to remote code execution when they parse malicious HTML entities in streamed content. The flawed htmlToUTF8() decoder rearranges string data with memmove/memcpy without checking remaining buffer space, so an attacker who controls the HTML the device fetches (e.g. a web-radio stream or its metadata) can force an out-of-bounds heap write leading to code execution, memory disclosure, or a crash. Publicly available exploit code exists per the CISA SSVC 'poc' status, but the flaw is not listed in CISA KEV and carries a low EPSS score of 0.27% (19th percentile), indicating no evidence of widespread active exploitation yet.
Unauthenticated configuration manipulation and information disclosure in Arris BGW210‑700 gateways running firmware 2.7.7 and earlier arises because the server fails to enforce authentication on /cgi-bin/*.ha management endpoints, relying only on client‑side JavaScript gating. Any LAN‑adjacent attacker can read sensitive configuration data, modify persistent device settings, or invoke diagnostic operations. No active exploitation or public proof‑of‑concept is known, but the missing server‑side checks make exploitation trivial once network adjacency is gained.
Missing authentication in Universal Software Inc. UKBS through version 28072026 allows adjacent network attackers to access restricted critical functionality without credentials, resulting in complete compromise of confidentiality, integrity, and availability. The vendor has confirmed the product is no longer supported, leaving all installations permanently vulnerable. No active exploitation or public exploit code has been reported.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrator access over the BMC interface on affected IBM Power Systems servers. The flaw spans two firmware release trains - FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 - across more than a dozen IBM Power9 and Power10 server models. No public exploit code or active exploitation has been identified; EPSS is 0.17% (7th percentile) and SSVC classifies exploitation as none, but the consequence of BMC administrator access is severe given the out-of-band control it provides over physical infrastructure.
Authenticated OS command injection in ELECOM WAB series routers and access points allows authenticated attackers to execute arbitrary OS commands via the Restore Settings function. Full device compromise is possible, but no active exploitation or public exploit code is known at this time. The vulnerability is rated high severity (CVSS 8.6) but requires administrative credentials to exploit.
Authenticated OS command injection in ELECOM wireless LAN routers and access points allows an attacker with administrative credentials to execute arbitrary operating system commands on the device. Exploitation requires logging into the product's WebUI; no public exploit or active exploitation has been reported at this time. The vulnerability is confirmed by the vendor and JPCERT/CC, with a CVSS 4.0 score of 8.6 (High).
Privilege escalation in Xen hypervisor due to lock acquisition unfairness in platform operations allows authenticated control-domain users to bypass XSM/Flask permission checks. An attacker with low-privileged authenticated access can exploit the race condition to execute privileged operations, potentially gaining full control of the system. The vulnerability carries a CVSS 8.8 rating but has no known active exploitation or public exploit code.
We need to produce a JSON object with all the fields described. The CVE is CVE-2026-62426, affecting Xen hypervisor (based on description and references). The provided data: description, CVSS vector 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-412, Tags (Python, Information Disclosure - might be noise? Xen isn't Python), SSVC says exploitation none, automatable no, impact total. ENISA EUVD. References: xenbits advisory, nvd, oss-security. I'll extract info. Key points: - The description: Xen hypervisor uses system-wide locks for sysctl and platform ops. The lock acquire lacks fairness, and with XSM/Flask, lock is acquired before permission checking, leading to potential denial-of-service or possibly privilege escalation? The CVE-2026-62426 is specifically the sysctl issue. CVSS indicates high impact to CIA, PR:L (low privileges needed), AV:N, so attacker with low privileges (maybe a guest user? Xen sysctl is from dom0 or management toolstack) can exploit to gain high impact. But the description mentions locks and fairness; this sounds like a locking flaw that could allow a local attacker to cause denial of service or perhaps escalation. CWE-412 is "Unrestricted Externally Accessible Lock", which fits. But the CVSS says AV:N? That's network vector. How is sysctl accessed? In Xen, sysctl is a hypercall interface typically available to Dom0, the control domain, which is a privileged VM. So the attack vector might be from a compromised Dom0 or a guest with access? Actually, sysctl is accessible from dom0 kernel or toolstack, not directly from network. However, the CVSS says AV:N, which may be misassigned. Possibly the vulnerability allows a remote authenticated user with low privileges (like a management network user) to trigger the lock contention and cause DoS or something else? But C/I/A are all H, so complete compromise. That seems odd for a locking unfairness bug. Let's read the advisory from xenbits (reference). Since I don't have the actual content, I'll inf
We are tasked with synthesizing data about CVE-2026-14328 into a comprehensive analysis. The user provided a description, CVSS, CWE, tags, references, and multi-source intelligence note. Our output must be a JSON object with specific fields. Let's go step by step. First, I need to extract product name. The CVE is about "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress plugin for WordPress". That's a complex name. The product_name should be 1-3 words, specific. The plugin is called "Eazy Plugin Manager" (maybe the slug is "plugins-on-steroids"? from references, the plugin folder is "plugins-on-steroids", but the description says "Eazy Plugin Manager - Powerful Plugin Management Solution for WordPress". So the product is the Eazy Plugin Manager WordPress plugin. I'll use "Eazy Plugin Manager" as the product name. Confirm: references show paths like "plugins.trac.wordpress.org/browser/plugins-on-steroids/tags/4.4.1/...", so the plugin slug is "plugins-on-steroids" but the marketed name is "Eazy Plugin Manager". For product_name, use "Eazy Plugin Manager" (or "Eazy Plugin Manager for WordPress"? The requirement says 1-3 words, so likely "Eazy Plugin Manager". I'll use "Eazy Plugin Manager". Summary: Must not copy description, but original synthesis. Include impact, affected product, attacker capabilities. Mention if actively exploited, POC, EPSS. Input doesn't have KEV status or EPSS score explicitly. The user didn't provide EPSS or KEV. The description says "authenticated attackers, with Subscriber-level access and above". That's PR:L per CVSS vector (PR:L). So it requires a low-privileged user. No mention of exploitation in the wild, no KEV. POC? Not explicitly, but maybe from Wordfence advisory they might have details. The references are code links and the Wordfence threat intel page. I can't assume POC exists unless stated. The input just says "Tags: WordPress, Privilege Escalation". So I'll state "no public exploit identified at time of ana
Heap-based buffer overflow in ESP32-audioI2S 3.4.5’s ID3v2 APIC frame parser lets remote attackers execute arbitrary code or crash vulnerable devices by supplying a crafted MP3 file. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed.
Heap-based buffer overflow in the connecttospeech() function of schreibfaul1 ESP32-audioI2S version 3.4.5 allows remote attackers to achieve arbitrary code execution by supplying an overly long speech text string. The flaw arises because the library performs URL encoding of attacker-controlled input and appends it to a fixed-size heap buffer without length validation, leading to a heap overflow. A public proof-of-concept exploit is available, but active exploitation has not been confirmed.
Heap-based buffer overflow in ESP32-audioI2S 3.4.5 allows remote attackers to cause denial of service, information disclosure, or arbitrary code execution via a crafted MP3 file. Public exploit code is available but no active exploitation is confirmed.
SuperPlane before 0.27.0 allows authenticated viewers to bypass organization scoping via the CanvasService gRPC handler, accessing and manipulating resources across tenants without authorization. Attackers can read execution histories and event payloads containing secrets, inject queue items or canvas events, and delete canvases in other organizations. No public exploit is known and it is not reported in the CISA KEV catalog at this time.
We need to produce a JSON analysis for CVE-2026-59248 based on the provided data. The input includes a description, CVSS 4.0 vector, CWE, tags, references, and source code evidence. We'll extract information accordingly. The CVE ID is CVE-2026-59248. Product: cowlib (but description says "ninenines cowlib", actually "cowlib" is the library name by ninenines). The product name should be the specific product affected: cowlib. So product_name: "cowlib". Could also be "cowlib HTTP parser". Keep short, 1-3 words. "cowlib" works. Summary: Original synthesis. Mention that HPACK/QPACK integer decoding in cowlib lacks limits, allowing remote unauthenticated attacker to exhaust memory via HTTP/2 or HTTP/3, causing DoS. Impact: memory exhaustion, Erlang VM crash. Mention if actively exploited? No KEV data, no POC explicitly stated, but the description suggests it's easy to trigger. EPSS not provided (none given). So we can say "no public exploit identified". Need to note EPSS unknown. Since EPSS not in data, we can't assess its probability. But we can say EPSS data not available. So summary: "Memory exhaustion in ninenines cowlib 2.0.0 before 2.19.0 allows remote unauthenticated HTTP/2 or HTTP/3 attackers to exhaust server memory and cause denial of service via crafted HPACK/QPACK integers." That's a concise summary. Technical context: Explain underlying tech: HPACK (HTTP/2 header compression) and QPACK (HTTP/3), integer decoding with variable-length encoding using prefixed integers. Erlang's immutable integers cause bignum allocations with growing size, quadratic memory allocation from many continuation octets. CWE-770: Allocation of Resources Without Limits. Affects cowlib, used by Cowboy, RabbitMQ management plugin, etc. Give context. Risk assessment: CVSS 4.0: 8.7, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H (VA:H implies high availability impact on vulnerable system). No EPSS score. No KEV. No POC? At least not in provided data; but the commit adds a test that triggers it
Inadequate authorization
HTTP response smuggling in IBM WebSphere Application Server 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to poison intermediate caching proxies by exploiting improper handling of non-standard HTTP version tokens. Successful exploitation leads to high confidentiality and integrity impact through cache poisoning, potentially enabling information disclosure and malicious content injection into proxied responses. A vendor patch is available, though no public exploit code or active exploitation has been reported at this time.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7 allows remote attackers to poison request queues, potentially leading to unauthorized information disclosure and cache poisoning. The flaw stems from improper handling of TRACE requests, with a CVSS base score of 8.7 but no evidence of active exploitation or public exploit code at the time of analysis.
Privilege escalation in Anchore Enterprise's user management API allows authenticated attackers to modify user permissions, granting write access to read-only users. Versions 5.11.0 through 5.27.1 and 6.0.0 are affected; patches are available in 5.27.2 and 6.0.1. No public exploit or active exploitation has been reported.
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to redirect Terraform API requests and steal server-side authorization tokens via the streamable-HTTP transport. The vulnerability, tracked as CVE-2026-14869, permits an attacker to control the destination of outbound requests, leading to token exposure. No public exploit or active exploitation has been reported at this time.
We need to produce a JSON object according to the detailed instructions. The CVE is CVE-2026-18084, BlackBerry UEM Management Console, XSS, CVSS 4.0 given, CVSS 3.1 not provided, we need to independently assess CVSS 3.1 and 4.0 vectors, prevalence, etc. First, extract from input: - product_name: "BlackBerry UEM" (precisely "UEM" or "BlackBerry UEM Management Console" but description says "BlackBerry UEM Management Console of BlackBerry UEM" so product is BlackBerry UEM, specific component Management Console). We need 1-3 words, so "BlackBerry UEM" is fine. - summary: must synthesize from multiple sources. Description: Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console allows Cross-Site Scripting (XSS). Affects UEM: 12.23.0 QF8 or earlier. CVSS 4.0: 8.6, vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N. CWE-79. Tags: XSS, Uem. Reported by blackberry. CPE: cpe:2.3:a:blackberry:uem:*:*:*:*:*:*:*:* References: https://support.blackberry.com/pkb/s/article/141208. No KEV, POC status unknown. So we need to write summary: start with specific impact and product. "Cross-site scripting in BlackBerry UEM Management Console (versions 12.23.0 QF8 and earlier) allows..." Actually, XSS impact: an attacker can inject malicious scripts into the web console that execute in users' browsers. Potential impact: stealing session cookies, performing actions as victim, etc. But the CVSS 4.0 VC:H/VI:H/VA:H suggests high impact to vulnerable system (confidentiality, integrity, availability), and SC:L/SI:L suggests low subsequent impact. So it's a stored or reflected XSS with high impact on management console itself. So summary: "Cross-site scripting in BlackBerry UEM Management Console (versions 12.23.0 QF8 and earlier) allows an unauthenticated attacker to inject malicious scripts via crafted input, potentially leading to unauthorized actions, data theft, or system compromise on the UEM server." Need to mention 'activel
Arbitrary command execution in WordPress Coding Standards (WordPressCS) before 3.4.1 lets attacker-controlled PHP source trigger code execution on the machine running the linter. The flawed WordPress.WP.EnqueuedResourceParameters sniff reconstructed the $ver argument of wp_enqueue_script()/wp_register_script() and passed it to eval(), so scanning a malicious file (for example a pull request in CI) with the WordPress or WordPress-Extra rulesets runs the attacker's payload. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the technical impact is total and a patched release (3.4.1) is available.
We need to produce a JSON object with multiple fields. Let's analyze the input. CVE ID: CVE-2026-48388 Description: Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed. CVSS Score: 8.6 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CWE: CWE-427 Multi-source: Reported by Adobe. CPE: cpe:2.3:a:adobe:adobe_photoshop_installer:*:*:*:*:*:*:*:* (all versions?). Tags: Adobe, RCE, Adobe Photoshop Installer. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD ID. Affected versions from EUVD: ["Adobe Photoshop Installer 0 ≤N/A"] - weird, maybe that's not precise. References: cveorg link (None?) and euvd advisory NVD link. Now, we must fill out all fields. No arrays, no nested JSON, plain text strings. product_name: 1-3 words ONLY. Affected product is "Adobe Photoshop Installer". So "Adobe Photoshop Installer". That's 3 words. Could also be just "Photoshop Installer" but better to include "Adobe". I'll output "Adobe Photoshop Installer". summary: 2-3 sentence plain-language synthesis. Not copying description. Should start with specific impact and product, e.g., "Arbitrary code execution in Adobe Photoshop Installer allows..." but careful: it's the installer, not Photoshop itself. The vulnerability is uncontrolled search path element (DLL hijacking). The attacker places a malicious library in a directory searched by the installer, and when the victim runs the installer, arbitrary code executes in the current user context. User interaction required. Use all data: SSVC says not exploited (none), not automatable, total impact. EPSS? None provided. KEV? Not mentioned.
Arbitrary code execution in Adobe Bridge up to versions 15.1.6 and 16.0.5 occurs via an untrusted search path vulnerability. A local attacker can craft a malicious file that, when opened by a victim, causes Bridge to load and execute a malicious DLL from an attacker-controlled location, leading to full system compromise in the context of the current user. No active exploitation or public exploit code is known at time of analysis, and EPSS data is not available.
Arbitrary code execution in Adobe Bridge via a malicious file opened by a victim. An incorrect authorization flaw allows an attacker to bypass security constraints and run code with the current user's privileges. No active exploitation or public proof-of-concept has been reported, but the vulnerability carries a high CVSS score due to scope change and full system impact.
Identity header smuggling in OpenShift Container Platform 4.x allows authenticated low-privilege users to escalate privileges by injecting forged identity headers that upstream applications may trust. The oauth-proxy fails to strip underscore-variant headers, enabling WSGI and PHP frameworks to normalize them into the legitimate identity, potentially overriding the true authenticated user. No known active exploitation or public exploit code has been identified.
We need to produce a comprehensive analysis for CVE-2026-21047. Let's gather all provided data: CVE ID, description: "Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code." CVSS Score 8.3 (but note vector is CVSS:4.0, not 3.1, although score provided as 8.3, which is moderate? Actually CVSS 4.0 base score 8.3 is high, not critical). Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. CWE N/A. Multi-source: Reported by SamsungMobile, CPE: cpe:2.3:a:samsung_mobile:samsung_mobile_devices:*:*:*:*:*:*:*:* (no version bound). Tags: RCE, Buffer Overflow, Samsung Mobile Devices. References: [cveorg] (None) https://security.samsungmobile.com/securityUpdate.smsb?year=2026&month=07. No KEV status mentioned, no EPSS, no POC availability in input. So exploitation status: "no public exploit identified at time of analysis". No patch version explicitly given except "prior to SMR Jul-2026 Release 1", which implies fix in that release. So patch status: "Vendor-released patch: SMR Jul-2026 Release 1". However, we need to check if the patch version is exact. The description says "prior to SMR Jul-2026 Release 1", meaning the fix is in that release. So we can state the patched version is "SMR Jul-2026 Release 1". But we need to be precise: "SMR Jul-2026 Release 1" is a version string for Samsung Mobile devices security maintenance release. So remediation: upgrade to SMR Jul-2026 Release 1. No workarounds mentioned. No EPSS, so risk assessment must note the CVSS 4.0 vector but we need to produce an assessed CVSS 3.1 vector as well? The output includes "assessed_cvss_vector" (3.1) and "assessed_cvss40_vector". I need to independently assess the vulnerability based on description and conditions. The description: Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code. The CVSS 4.0 provided: AV:N, AC:L, AT:P, PR:N, UI:N, VC:N
Denial of service in rouille 0.1.6 through 3.6.2 allows remote unauthenticated attackers to crash the server