{ "locale": "en", "language": { "code": "en", "en": "English", "ja": "英語" }, "language_native": "English", "snapshot": "2026-10-26-2135", "source_hash": "c2c92bac7ad68830728b1f381a2983f60050ee5817a4e9de7473640fe69a57c3", "string_hashes": { "records.npm-miners.title": "a8ecc5601b881163e7d681c577de2358a27b5b96cb183a73cfc8e0298579d884", "records.npm-miners.body": "52e72c623bacae5ab452115ebe9eca46651bcd8fe66edc1b2bc50129c148b1b5", "records.npm-miners.action": "9480c380e4ae8d26835633ace041b020ff2f32988fd520a9b41efc2de459e16f", "records.npm-miners.time": "315cedcf769e699f5b495daa3260362d40c593dcf5a5b891bab3287ddf08d0e9", "records.npm-worca.title": "8eaffd6df3db24bb1f765bc0c4a592528955d95ee42512c44a63d23aafefedae", "records.npm-worca.body": "062d078d5ba753c4a32cafbe89b7a66bf6a6bc060495cde5a96ec17efac2eb2b", "records.npm-worca.action": "dca0ec999ff54821b5e4452684b9e9ede7fc7fa5e70880e8006b60203a3659b1", "records.npm-worca.time": "be13033c2c4aa749ba1b1263722929b2eaeab856f34fc20ac6440b3ae0bd7cbd", "records.npm-publish-poc.title": "700f8963526b3b8e608ee18825f3412e0084c8f35895be1f9f212b87d3caeae2", "records.npm-publish-poc.body": "0e03a4a05c6ec97bbf3ca58d867c537917a91a3c0c0af0a1592e20d8290e99af", "records.npm-publish-poc.action": "a23f1ddbf5ad1ca23f98b819ac270a3b116159eb1a5cdd757daf4f6a483eeef9", "records.npm-publish-poc.time": "b1489ca13899ad04f28c5e53ab41dd4b15d26e69907a6992a03fa0fcc1912966", "records.pypi-netweavex.title": "5fe72b53019648dfa8116bdee44a097bf903f93188bf66a2073d08b5e25df6fa", "records.pypi-netweavex.body": "e8b72832647891963b559617bf2aa5ca2e795c9010e8af284006c46f63889246", "records.pypi-netweavex.action": "f560cbcf1bfaf148c963856ccfcf793f0571fb5df3d3de4c3ea57cb1cb9abc5c", "records.pypi-netweavex.time": "b90b2c7ac09b5c9560fa0fc622b8041ad68a6e3b1652cc9f9db87b92c3949b67", "records.pypi-pentest.title": "24786fc32636464134fde40d889e4612d69b1608c4d68caf3783df4ef0a40f9f", "records.pypi-pentest.body": "d3a2e5332db339e4f60c9c4980f550e9b68f09a66793c5ec9b54a720440b484d", "records.pypi-pentest.action": "14f1a6e8bc9ab1639b86f479e96a414168e993a891bc96af36c7c9f580ebb039", "records.pypi-pentest.time": "b1489ca13899ad04f28c5e53ab41dd4b15d26e69907a6992a03fa0fcc1912966", "records.frappe-builder.title": "0843ae83803c20412f3f2e832e7a135dc23f5b17d2954e72e9ad92a5b4888dc7", "records.frappe-builder.body": "346a29900a553f590b6f4789c3d6ef1988eb4efe0a3abc7b647935af7da9d998", "records.frappe-builder.action": "f3be593c8e18ef80ad6dcd127d00511d2f18ef2fee26a61e0a68b2b5b529e1e0", "records.frappe-builder.time": "0d755f805b68fd1f46225b023f636fa0bb1b981aa984f2480ca33aa598646a30", "records.misp-guard.title": "3026e4f72957b347217c757b18b037b363035c92a0fc353573aa243de2797a98", "records.misp-guard.body": "29a13ed0341f4ca9eb8d85823ed0586d732134133b2b38b90c410d1611caabb9", "records.misp-guard.action": "a7bd365a4bec2823796c745247c4dad0398c30b03f95419cb1b4661d9a97dc58", "records.misp-guard.time": "4f9e6260f79d35a15ae5c31508458fe46412761cc047fea56e671e7146d6841a", "records.mendix-saml.title": "eed572801e869a77cf88418300937c5488177936918551573a554d6b9cb1e4dd", "records.mendix-saml.body": "5f484279443f06b2fd718c065c277bd76576da8207c3b48335c0c972743a1e7e", "records.mendix-saml.action": "72c1faa6b960fa41f098c2419efb4a7d1438f5b56d85758fed26d9838914d9fd", "records.mendix-saml.time": "b6f931169be06122e6b61b5305669f94fd05f3025d246f5e77903e4174a7e380", "records.ash-multitenancy.title": "68e71a6475db23680f3774539b9ded7fbdad6febabcae9990fd53d241fbf166f", "records.ash-multitenancy.body": "5d0b3b7e03aefae62c03389deca1be08601220a46787077f415457c4c6e8fe49", "records.ash-multitenancy.action": "a179262285dc700c30b52ad1c8a35bbbaffa962e84250a3e3c5a3885501df24c", "records.ash-multitenancy.time": "2bc15ddd985605f843ff20c89563c3c0d153190f1c8e3c7f08dff020f5951a67", "records.camel-components.title": "993fc7f57cf6c3003951d5118ea95b91946945c813ace3e952ff0756792b0b66", "records.camel-components.body": "ab3d96168eee871c9da847e5363a48779f14dc5eef12fb2bace96c569d44d610", "records.camel-components.action": "48fe272a475fd4a17d46de6c46cd45caa44fe6bae7f56c8193def932c7abfa4b", "records.camel-components.time": "df9b4ccc7d4085c6eb221c76763cd1b407e08420e0b7b1b1739606b7a89cf117", "records.soem-ethercat.title": "0993f12da2e2f0e7383185c081d9948958ee2ddffbb6c3a8598ee31802fc0123", "records.soem-ethercat.body": "cd0134febfffe0e0125a3f9b2cd383fe72a2f83e837cfa587763eec97d51fdb8", "records.soem-ethercat.action": "3a900b138eeca1932f96a5347108edb08963ed4ec7997448e51021aef7b515d4", "records.soem-ethercat.time": "4ebacc84e8bd78e381298dc7439f72f1f0e9014029bf518d41e163b1ec756941", "records.woocommerce-callbacks.title": "5b62b00df38d14d26bf58dcecf9726aac2271d75f80477e37fad2f598eadb520", "records.woocommerce-callbacks.body": "ecef00a953aa62b6163133f7cfb28da4fe6287b547df3913de6bf5d451fe22d9", "records.woocommerce-callbacks.action": "9e2256e0c6436f9f1dd288effe8f16f836f0fd6bd8392e51a685f7863e21e379", "records.woocommerce-callbacks.time": "1241ecb8862df2fab68715c94a366ad21d73f79ffd57b987c5268b5e9263bd99", "records.wordpress-plugins.title": "039a38e6f3ffb2f8af8250282f80cb090f6acfa20c881f3e396b80c933b404a3", "records.wordpress-plugins.body": "087d421aed0af3662a92313da3e2be9f121816cb488e1c0c5b85327689450f47", "records.wordpress-plugins.action": "0cd070c998e3fa3b8424dc0310e589af277284d215c3677b521d2d3851b92561", "records.wordpress-plugins.time": "b6f931169be06122e6b61b5305669f94fd05f3025d246f5e77903e4174a7e380", "records.nocodb-auth-extra.title": "ab646bdaa4d8942a23d244a9bdd2435822bce7dd4c241c823707fe47b237e25d", "records.nocodb-auth-extra.body": "f441e44604c694622f6bab2acc26639f0564fbd9da6fe06243ac3142009eeab9", "records.nocodb-auth-extra.action": "ce4a02f9ab423383978e6eeccd74451347f007cd4c2233a6eab308044158b3b5", "records.nocodb-auth-extra.time": "7ea8d4883342cf4166cce5295d7f29950916c98498e5912fe6956ac0f6c0e65c", "records.libimobiledevice.title": "fcf289b58d6bd7cdb6006439bc9ce68db8b505d6f71e586d0b85355eb5a2bc8e", "records.libimobiledevice.body": "c23942cd27ee927855732d75dea1773c369ccf0ad63af47e0ab387ff98e5618f", "records.libimobiledevice.action": "fa87e8e4e65cf85fb186c601c526f223d897f8c4330769d7fcc836b432b5dbb6", "records.libimobiledevice.time": "b6f931169be06122e6b61b5305669f94fd05f3025d246f5e77903e4174a7e380", "records.libgsf-ole.title": "ec25f0f79283f2ab140ae1eced3d5b9c04a49e018cf9a36f521078f114629dcd", "records.libgsf-ole.body": "1a293f14bcf2ad33a30f07ccadd10943a6d8f29282f355cb6052bcc2659eaf2a", "records.libgsf-ole.action": "3c1335e2d126dc180b987175f3bdaf68e77f411e0280286296967725e007c8b7", "records.libgsf-ole.time": "61c9fdb17308bb2a02b9e67e83f3db843580d8d6d19f76906932f86c3ead50c8", "records.qt-http2.title": "b3ef0ef6d47aafbb4a482b04277f9a825cbdb49c49163c5b3f4f7a17e79a5d97", "records.qt-http2.body": "1dcab59202c2c940a625abe8b4e22a4976b3d7cebba71e717c3098499b4169bf", "records.qt-http2.action": "495e27e1fd5bfdfbe915cb11f959434937df6c45a9636aca5eb69efc9e5fe176", "records.qt-http2.time": "ac470e6a4ea740a29c6bb3431fd91d47ed3bcbe4b324c2def747a731767d1e80", "records.brain2-setup.title": "304ec63ca27f01f02760022b4ccbc3292452f2a3645886100de33c8b50259e2a", "records.brain2-setup.body": "a5945014c01702ccbeed94dfaabe1f7039b1664ed3344ff9572f1863d8ad2072", "records.brain2-setup.action": "936005e47547f87508a140a97f8d477d4c140836a0f26bf6e8f9ff9108f2d922", "records.brain2-setup.time": "2db77c84d0466bfae065bb84f32719f6d1414c60b9d27ce21bac91294cd3a5db", "records.image-upload-races.title": "ba9d927bca9e3b092407b4d84861e1446b29247ed67721e5587d933031e2d521", "records.image-upload-races.body": "bf0244c393b75a39c777ff157ef682e47f5e7c8fe1cf5edf82c41a357e934a38", "records.image-upload-races.action": "8ac71afb5f852d670e262a4974ee122a419411647b03b13f3128c4521e270018", "records.image-upload-races.time": "ac470e6a4ea740a29c6bb3431fd91d47ed3bcbe4b324c2def747a731767d1e80", "records.local-agent-http.title": "f022e4de16e40f548e5c8832dac20bde8ec68d14da821cee70aa1f4a121d9558", "records.local-agent-http.body": "1bc58078982c2be86aa26d7fe5e1f50242b48ad7e546097c933efe88375685be", "records.local-agent-http.action": "15e677a9914987d32139d390d4f133faa77d782cb66783a1636c29e612c413f3", "records.local-agent-http.time": "61c9fdb17308bb2a02b9e67e83f3db843580d8d6d19f76906932f86c3ead50c8", "records.game-desktop-inputs.title": "4ffde87d12f7161c83f4506b2d6e7a13c209315085a6057b4aaa721b6cc9d0e0", "records.game-desktop-inputs.body": "02f724d65a464989ffdbbe8b1cc8a668be1ee59abd4fb22e3ee16421dd400b02", "records.game-desktop-inputs.action": "773c09922ae4001894d89e02c5257d812c6ea93d4d3e4ad614a523b0855fcda7", "records.game-desktop-inputs.time": "e26b79145ddd3d541adf0be772b0076ad077521980bc4ed7ab402beb6e0ca759", "records.pleasanter-nvd.title": "26a8c56d6f3f235b5bb370df45649e3c1b199839890a7e4e2bfee9933244c325", "records.pleasanter-nvd.body": "64cacff6faa209f00747f86bf90dbbc8b7c3ce64694d229a2b82bdc89177230f", "records.pleasanter-nvd.action": "13a9497523ccfb97474687d39e606423a2bc9a2937f4a0dc86b483aa5cdecb91", "records.pleasanter-nvd.time": "d8d3b23b5fe1728c3f868de534f261b4476d0bb72f40e9294ee63b2715bb7847", "records.vsft-nvd.title": "1a4c2fe345a7a385eb811e49585eca6032bac88390455703bc925f8ae096d8e8", "records.vsft-nvd.body": "2c4e1283d1cb6575aaefc30c00db397bda5658fce47c5e46b1af613e25857d30", "records.vsft-nvd.action": "96815335e7e13a0906f84b19cb130673c2edd9102b959a9052c11bcbc89faf37", "records.vsft-nvd.time": "fa8d966e6a9f609eed7641452e564a2ceecb8fe830cda566ede5cc93bf560887", "records.jpcert-php-brotli.title": "9e341d9bc45da36502ad888b828e7fe67b8e93c6368614769d234fc4698984e8", "records.jpcert-php-brotli.body": "a6f5d4e3abae5e1d071c2460dae97410fe24e190ece1173c9d3441fda81cf8dc", "records.jpcert-php-brotli.action": "eecbefc20046657173c701a2d02f86afb47083f0a66a4e023ca109336361d73b", "records.jpcert-php-brotli.time": "8ef609c3f85a2f0511cb05e5abab35d86d87c8e873a565d9c1aff3a23cda4d4c", "records.oray-router.title": "b892c94519281bb57349405e8e994bc7f47e24181f1e294cec4c40ea225286c0", "records.oray-router.body": "9f586dd5d664153da6d6acb077e2def0296596c88d145c2f7d195007669bf26b", "records.oray-router.action": "d22e27213580ca326c4c313d245a36afba3a5c9bd421a036428d90c6edacf838", "records.oray-router.time": "34fa7adbf5ea81acb2a5a539f942607105a90086e65d954b845e3d8502c0f7b5", "records.siem-management.title": "bb50866b3672c7ed004009f4cb42222e4f7c600a722d5f891ee2830a102c3f09", "records.siem-management.body": "ca2f0f6c0d5d59be2e515e053fd3bd48dae90a76e456449f922b7e2472b25fba", "records.siem-management.action": "2f1b6f256752d57bf11530ad0051c2c2f38c5416d810647f153147143ff3d631", "records.siem-management.time": "ac470e6a4ea740a29c6bb3431fd91d47ed3bcbe4b324c2def747a731767d1e80", "records.gmo-sixth.title": "aad8fbb26c5d876e2d362c83d0a4899ff45ec749bc51e2b0140878f8f3fc1d41", "records.gmo-sixth.body": "cddbe5974db9b206a1edd210dfb51bc7a53650076946257cd0b4bb9ae12e4133", "records.gmo-sixth.action": "38d36deaceb476e66fe8ea72bef9b24e42511645a8eb49bd16bbb279d3f7dc61", "records.gmo-sixth.time": "5a703958f9f5add38cf87d90710e6b942788a036cc59995a2f1f1fbdabcea7b2", "records.blastmail-345.title": "7ee21f47ab498141aae84f3583e26bdc11550ba787046279320fe1a148e35bc2", "records.blastmail-345.body": "16f2decb10999fbe666c67ad5c8484e523e1b6b8de6e1b9323af9fa3a6ad79a9", "records.blastmail-345.action": "a1d7b1c593fe8d094853483fa6f080edfff03437e2443b8093ccd80e0669fde9", "records.blastmail-345.time": "4a03e66767ec6a205b0d1a33c18e51d74e10fda5acd292d6b8fd32a4aa5b7b67", "records.tavinos-reservation-followup.title": "39f7a3fc40569c6f9b97449bbf27e782c75ad88dec22096ceb2444316f8f40a7", "records.tavinos-reservation-followup.body": "9411969fc6f61812f366b4b787e52eb10b05dcbd0c9710c9582ead5f2f2cdbda", "records.tavinos-reservation-followup.action": "560baae65422d91f366a4bce2fe1656928af4f04be58b52f736606f4b6f8173e", "records.tavinos-reservation-followup.time": "5c0e61f76d645113a7b0fc0be43dff0e9544b40182e84bad392026b72768304e", "records.php-honeypot-observed.title": "4f25ead4d3633294e66925f57de1286798b63bd190517f972f3460317754047f", "records.php-honeypot-observed.body": "d4ff28ee11e4aa91e3ff8d33ab046e2ef5aa62225e4ae54a780f144bea00c482", "records.php-honeypot-observed.action": "46b2d9f5ae77bf3ad407ee93446e22bf77c769dc452ddbab00d00740b945724e", "records.php-honeypot-observed.time": "c5eb741d5b2d0afe81e31e5bedf2a9a8668cf4af1f06b0f04bd52656310e4bdc", "records.tailworm-code-and-release.title": "49f38a33b9ae47b483e91a621f2262e7a7c5acca8d0f4f1bc45bd784f594a517", "records.tailworm-code-and-release.body": "c69e54c75576b703a3bfc89726757f1b11ead9d0c24daf4a8ecca69361f849ef", "records.tailworm-code-and-release.action": "f596992043e6f7dc9b26db3cd19e8333ed34e252174e6afaf2ae7f3f8dfafa92", "records.tailworm-code-and-release.time": "5743a127b0bff2d7c498ea25dde56b2f7db6837596a62c36e1937b678233b769", "records.m365-token-replay.title": "e5234f6a704b3a39dad51778e7f368fcc0ef7958019795c51fcb74a1ed9a2f77", "records.m365-token-replay.body": "1b901424fa9afe70a9b104b13604d6c3baf7064828c6d1d4ee57195b22793d28", "records.m365-token-replay.action": "206b3faece7ed4a564e365bd23bd059f045d3901257c5d9f7ca2390e540407e4", "records.m365-token-replay.time": "073d86a1d21be87a7825ecdd8e514d5a28e54ae170e2de1a764c53b0604bbb97", "records.gheist-github-tokens.title": "c3029d775ed4ae7ba90101459377725c62f68580f2806d5be537c9a83404285c", "records.gheist-github-tokens.body": "3d257e2ebde97815ef1a11ceb8fc4ca78fc3ea29e1e6c26f2780e296df7bca8b", "records.gheist-github-tokens.action": "5b45523c0068351a5f084ddde7130a0d640716ad8fdddbd4143b6f4246fa1e87", "records.gheist-github-tokens.time": "6a16f3bb921950e87560fd086a5672aa1cfd20c24c0e29bc3e92f13ce79ca100", "records.ucreator-android.title": "e2b8cd556b9a4c5f7d98dc926c57019d21b602a84e530a2bde6363466df5c69b", "records.ucreator-android.body": "bfcf851c0f4db9d234282f6c43717969000d43c7b074d048f0856759791b643d", "records.ucreator-android.action": "9f0efd36df4ede7b8e5a35d4a543413cb89b6c4917371d54852656074f67152d", "records.ucreator-android.time": "5ec5c1a4ab22bae83833f656600e363c1c99b4396a49000b24fc645d43463cc1", "records.neat-rollout-recheck.title": "34ae6f4c94bf51c3ee07b155332ce173b1bad6fdad711273735c9625b472ac04", "records.neat-rollout-recheck.body": "7b3ee63018cfd71327bd050fe23020f620a413f9533e3e86bf574dd58d201b15", "records.neat-rollout-recheck.action": "a1f8c9aec2bc00cbda8ddbbd5e5b2bafc7b9abffa071d30589f6d054988ffa33", "records.neat-rollout-recheck.time": "1835b3f544da4741958003c74b5691609beff79b386f8dae7ac6e14974b5eda7", "records.icewarp-after-cutoff.title": "7a9e8e952137b41be5a720b540fad10e83262d1b3b0e1f12bb53600a747c7dfd", "records.icewarp-after-cutoff.body": "afd17cb9872d912107c58c0a5be0f5267a710d151993320c24569186478abb42", "records.icewarp-after-cutoff.action": "38a8b3826c29e44a19f1042159600c567b5b793c8aca1c7f81da8c2dd1db65e8", "records.icewarp-after-cutoff.time": "a607327910d3f5076c6e1cd81644fdb0cfa16b043c48dd064e0e168eb1e8825c", "records.kawanishi-restoration-reference.title": "1527c1ea69fcb8560217121fd7cd7b6bd4a4d467459c7b3a4e1e9ca3d9eb81e6", "records.kawanishi-restoration-reference.body": "d8e23265b72719fcae2ad9e36fbc821b0daf77f33b8d3e83530480f230f15de7", "records.kawanishi-restoration-reference.action": "0a7b6c8c60a9829c126a02e6264c4c15f82ad07bd670aae29568c6d7c9ef489b", "records.kawanishi-restoration-reference.time": "dc3a24b7452fe469b28026ae4f86ad0c2741c66d1773fa069c0da50835070977", "caveats.0": "d8e25d8b006740ab7080cdb7ef35982bed7497e2eb5ed6a1be22a22aac24f611", "caveats.1": "8044172fdd6dd6fda112d41def41f35ee90d4c3d0425f1e5a6381b2c4940f329", "caveats.2": "faeb29ed6ad3ea19ec917c1ca60dd370a44b079c11f7c450ea6373f662ce2077", "caveats.3": "dca3c70a83053ff81ba54511952b107aca158853fa9ccc8f9bf546b1d61e9b9d", "caveats.4": "bcd7fd60a8299e234d6cd33a8804d28e7c5791c467f3ea9e7e0a15ee67ed0389", "caveats.5": "3e54a28033e05a77adcf9057153b19d8979e29d0998096d5cf72ced32952e352", "caveats.6": "1e78d29f267917091145832087a6644f073f03f031ad65c18147670fa021cd19", "caveats.7": "f07d3112eea4dda032a71351f2f51bc24fa536f54833772c58c42316c6c75af3", "caveats.8": "95fc370b02eab5cc72f1132757e5fa99b85dc3af1196c027a1dfef6d857e9383", "caveats.9": "68084b5120772d5257f9b893e462d14608d62acec63feab3ddef793688708ca4", "caveats.10": "19224aceff17cfd25f107e8ac3186cc1611978da9ad4c96d7e9c16ee68a0a026", "caveats.11": "7edf57a3c3fecc246c1b7931a5b9fdf6ecf974e87bcd440747514447b3264d94", "caveats.12": "1775c8eed9b3864d4765d753e181c54eaf34e3d4d92d384fc17f6f673e03a7de", "caveats.13": "181a3ac244155e3a18c8813c1731197fd6df5eb0c41b5eecfb99f676f2d1ca89", "caveats.14": "b687bd75ebaf17775a3b767d469946cd4b3080af789921cc711d4d2ceb4d6ae7", "caveats.15": "0a59488f5ab5e15ba587d6f4a47c66186bc3a960b67f256720a9f7b946204851", "caveats.16": "4aea1e2bae84a13118a720531171f4fb0f92f4e90a3c65b50e01c364cf973a10", "caveats.17": "4619ca16a7d9091efd9fd91c5eeca442b0de95763e73c0e862cd5460df070281", "caveats.18": "d6e51d449aa376cefd63f0a2a88885a8c7f73ea183ff2a2f85def309bee35119", "caveats.19": "3747520a8d0b4a52d0ea5ef4395e36c70914d60e4fc4f552c2915caacfb2fde1", "caveats.20": "66adf938c3eca056485c6dcd551d4f8800b7532f9332407876433ce755a7af82", "caveats.21": "b7b34d75bbd9d51ea12cfb5d7061f9651e629d9d48a6908500fdce6a56ece026", "report.title": "1587ec96fc4b489563eadc3005da95193b98c535515b3d8911502a61c5fb733e", "report.headline": "07c6d57177d09a4f0641e65037cb8709e1b94cbfcd50f72acb3e1f4d50788854", "report.intro": "f5d1b9e9330df6b95ed8736d00a804a2746623272b8da86ab9c7bac187666ef4", "quick.0.title": "0f9afc396780d727189767255f839109adcbd5e983b24d7a6fbed35d850e706f", "quick.0.text": "a566886a2e1514e399234f540833da76272e068346fa9dde91672556e1ba4974", "quick.0.label": "5c1a7525323e6a7be6d587f3e96009ab592a3d8cd219d2ed4a1a8451245ed342", "quick.1.title": "e8f3d19734362a2e47d980e562f3267e15496a5e9f6c319b353d907032512e1c", "quick.1.text": "4a4eb0d61b3d5c6088de9d0326e6b732ccbb7e917d8774dc3711b2111bd5141e", "quick.1.label": "0ef1b3ed7a2022ec0ecae0dab1fbb9fd36ef1fe4ba0aea59725ce9baa03f93b9", "quick.2.title": "d8d3f5af9197bfe4d072bba9004ec61a80566d813dd4a955bf67ff1aa45b8b5f", "quick.2.text": "51fe405af3e08cf7e6e96bde0bfedc54a79d4b27d5fb71e840878fab2a6f8c96", "quick.2.label": "bb9fce390eedf77f42396bca500401c488ade36fb97b8dfce967a0326baa1277", "quick.3.title": "dd5909db87f7c2c34c6ffe006b421f7e3c34baf90669148bb3cacafb1a6daab3", "quick.3.text": "0f442b7bd87f8eba6321788aeceabe130d578b2ff5569c92175a7b474980e1a0", "quick.3.label": "f8d13386f3815b91acaae588939e9bc9680c4a86af845cb998996cae82e5ed9d", "ui.title": "c589afd85a653859c675603d873b89a2ec72704a908f9fe532956589276d6ea1", "ui.intro": "8bc1411fd2df3f6f0ad0fdbd6a6d7ed5ba9b0c63f0bd91fbea0f04dd4b859fda", "ui.cutoff": "30bffe1d8c0fefe3ad569045a850f06ea6dd8810b558c34de1f71d4df906a9e6", "ui.actions": "7e155300cecf74323a1e9ffcde23987947c1aa0b2a3e797fd3a50ad82939d62d", "ui.sources": "835c47be68ea833b08692f4fd81b08923cc237d4aa02e12951d1352e9c23bd71", "ui.delta": "9adc14b6e164efe8327f724c20a7ccfb1e6afa553360fe699d5169498751dd53", "ui.scope-complement": "40eb64185c871529b368a52dec2a5da371f082fd0ceede57744418e9e7bded29", "ui.reference-only": "438c048773567ac03e23a2d37bcda0cfd91b904736e75680507be0efb1859685", "ui.notice": "58caa3c4eeff2c6afefb59c8edea1d100788a6947a2c7560e7a91ecbf21e4638", "ui.original": "e8fc20d01f7577c9e02b0eafdd1fb27a5633123f9ac86833b370bc7c8d5fea9f", "ui.data": "2039bbd338a139da69fcdd7b37a2f1dc83dbc2efbf17c2f52fdbb96e895837f3", "ui.home": "f109578971d6a45d0822844efc41ded0cf437c2e1e876ea2519cbbb9dbc12f87", "ui.languages": "2191b209745deedcb25dc4acbbab8273ac7159575dd94c2170b24998e46a2d29", "ui.evidence": "688f77c246c750e5858f1d0b04381beb642d641a043603b7510db8deb1a16da5", "ui.counts": "7d6c2976cecf20cd4587cd6ae65583534f56cbdecabad2b9104cd7a7a8357fe2", "ui.pending": "7673fe83755b580dddf493fe3091b7687e3df01dd8c4268344bf707912eb1790" }, "status": "translated", "strings": { "records.npm-miners.title": "2 npm packages: mining during installation", "records.npm-miners.body": "GitHub malware advisories describe mining programs and persistence mechanisms run through postinstall in dsh-plugin-blender-3d 0.2.1 and @walknpm/todo-cli 2.0.1. Behavior differs depending on whether root access or passwordless sudo is available. This does not mean that all npm packages or Blender itself have been compromised.", "records.npm-miners.action": "Check installation records for the affected versions. If they have run, isolate the environment, investigate persistence, external communications, and access to credentials, and revoke any necessary keys from a safe environment.", "records.npm-miners.time": "15:30 JST (GHSA publication)", "records.npm-worca.title": "@worca/app: malware advisory for affected RC versions", "records.npm-worca.body": "GitHub classifies @worca/app 1.14.0-rc.2 / 1.14.0-rc.4 as malware and advises treating devices on which it was run or installed as compromised. The public record does not specify the number of affected organizations or when the intrusion began.", "records.npm-worca.action": "Isolate and investigate environments where the affected versions were installed. Rotate keys and secrets from another safe device, and do not consider recovery complete simply because the package has been removed.", "records.npm-worca.time": "16:33 JST (GHSA publication)", "records.npm-publish-poc.title": "npm publish-poc packages: publishing permissions in the installation environment", "records.npm-publish-poc.body": "The 7 affected versions of publish-poc-test3 reportedly attempt to publish using the environment's npm credentials during postinstall. publish-poc-base 1.0.7 prepares a temporary file containing a README fragment and credentials, but the description states that this version deletes it before publishing or communicating externally. Do not count both as successful external transmission.", "records.npm-publish-poc.action": "Check the affected versions, CI installation logs, and npm publishing history. If suspicious publications are found, revoke the relevant tokens and review dependencies and publishing permissions.", "records.npm-publish-poc.time": "18:31 JST (GHSA publication)", "records.pypi-netweavex.title": "PyPI netweavex: fetching remote code on import", "records.pypi-netweavex.body": "The affected versions are netweavex 1.1.0 / 1.1.1 / 1.1.2. The original analysis describes copying a legitimate package, obfuscation, and fetching and executing code from GitHub on import. It also states that the retrieval destination was a placeholder at the time of analysis, and does not confirm successful theft of any specific information.", "records.pypi-netweavex.action": "Check installation records without running the affected versions. If they have run, investigate external communications and execution history, and revoke secrets and rebuild as appropriate to the exposure.", "records.pypi-netweavex.time": "21:30 JST (GHSA publication)", "records.pypi-pentest.title": "2 PyPI cases: transmission of basic device information and analysis classifications", "records.pypi-pentest.body": "zagents-framework 6.25.30.10b5 / 99.25.30.10b5 and changes-lxc-wrapper 0.0.0 / 0.1.0 are recorded as sending basic device information during installation or import. GitHub categorizes them as malware, while the original analysis classifies them as PROBABLY_PENTEST. Do not equate them with large-scale credential theft incidents.", "records.pypi-pentest.action": "Check their intended use and how they were installed, and exclude unnecessary affected packages. If they have run, investigate the destinations and actual impact.", "records.pypi-pentest.time": "18:31 JST (GHSA publication)", "records.frappe-builder.title": "Frappe Builder: SSRF in image retrieval and permissions for AI use", "records.frappe-builder.body": "The developer published 3 advisories at 14:58 JST. They cover authenticated users controlling image retrieval destinations, reaching internal destinations through redirects and DNS re-resolution, and insufficient authorization for improve_prompt, which uses an AI provider key. They do not describe compromise of every server by any unauthenticated user.", "records.frappe-builder.action": "Check the requirements for Builder 1.36.1 or later and Frappe v16.36.1 or later. Review image retrieval destinations, publicly stored content, and AI usage logs. If updating is not possible, consider restricting the affected APIs and temporarily removing AI keys.", "records.frappe-builder.time": "14:58 JST (developer advisory), 21:17 JST (NVD inclusion)", "records.misp-guard.title": "MISP Guard: check sharing policy evaluation", "records.misp-guard.body": "CVE-2026-116372 allows distribution filters to be bypassed through successful responses other than 200; 116469 allows bypasses through letter casing in tags, categories, and sharing group UUIDs. The developer addressed these in commits at 16:53 / 18:25 JST. This does not confirm compromise of all of MISP itself or disclosure of all feed data.", "records.misp-guard.action": "Check that the running code includes both fixes, and review permission settings such as TLP and distribution history. The earliest distributed release containing the fixes has not been established in this review.", "records.misp-guard.time": "18:16 JST (NVD inclusion)", "records.mendix-saml.title": "Mendix SAML: reusing IdP-initiated responses", "records.mendix-saml.body": "CVE-2026-89209 is an authentication bypass under conditions involving reuse of a valid SAML response in IdP-initiated SSO. It affects module versions below 3.6.29 for Mendix 9 and below 4.2.4 for 10/11. It does not state that merely creating an arbitrary SAML response is sufficient.", "records.mendix-saml.action": "Update the SAML module in use to 3.6.29 or 4.2.4 or later. If an immediate update is not possible, consult the developer's guidance on disabling IdP-initiated SSO.", "records.mendix-saml.time": "20:16 JST (NVD inclusion)", "records.ash-multitenancy.title": "Ash: tenant boundaries in upsert", "records.ash-multitenancy.body": "The developer advisory for CVE-2026-96581 was published at 14:32 JST, before the previous cutoff. It describes conditions under attribute multitenancy in which a create action with upsert that accepts primary keys or similar values can update or retrieve another tenant's records. Not every create action or Ash application has this configuration.", "records.ash-multitenancy.action": "Check for Ash 3.37.2 or later, and review cross-tenant upserts and record movement history. Also note the exception that the temporary upsert_condition workaround does not work with Mnesia.", "records.ash-multitenancy.time": "14:32 JST (developer advisory), 17:17 JST (NVD inclusion)", "records.camel-components.title": "Apache Camel: Docling configuration is still needed after updating", "records.camel-components.body": "5 advisories published on 10/22 have been supplemented to reflect their inclusion in NVD. Docling input and output paths, expiration of Keycloak introspection results, expression evaluation in AWS2-S3 object names, and information disclosure in CoAP errors involve distinct conditions. The Keycloak issue applies when token introspection is enabled, which is not the default.", "records.camel-components.action": "Update to versions such as 4.18.5 / 4.22.2 / 4.23.0, as applicable. Where external input can specify a Docling output destination, configure outputBaseDirectory even after updating. Check handling of S3 headers and expired tokens.", "records.camel-components.time": "Published 10/22; included in NVD 10/26", "records.soem-ethercat.title": "SOEM: device responses on the same EtherCAT network", "records.soem-ethercat.body": "RT-Labs documentation dated 9/21 describes 6 issues affecting SOEM 2.0.0 and earlier. They require a malicious or compromised EtherCAT device to return invalid responses to the master. Insufficient validation of lengths, cumulative quantities, array indices, and similar values may cause memory corruption, information disclosure, or shutdown. General internet reachability alone is not sufficient.", "records.soem-ethercat.action": "Check with the product vendor whether SOEM 2.0.1 or later is integrated. Review device additions to the EtherCAT segment, maintenance connections, and master privileges, and update in accordance with equipment shutdown procedures and a validation plan.", "records.soem-ethercat.time": "Advisory dated 9/21; included in NVD 10/26", "records.woocommerce-callbacks.title": "WooCommerce payment integrations: payment notifications and order status", "records.woocommerce-callbacks.body": "6 issues published on 10/23 have been supplemented to reflect their inclusion in NVD. They affect individual plugins for CCAvenue, nexi Alpha Bank, Eurobank, iKhokha, OPay, and Mintpay, involving changes to states such as paid or canceled due to notification authenticity issues or a secret that is empty by default. They do not represent compromises of the banks themselves or WooCommerce itself.", "records.woocommerce-callbacks.action": "For iKhokha, check for version 3.0.4 or later. The original sources list no known fixed versions for the other 5, so consider suspending or replacing affected integrations and reconciling payments against payment provider records.", "records.woocommerce-callbacks.time": "Original reports published 10/23; 16:17 JST (NVD inclusion)", "records.wordpress-plugins.title": "Additional WordPress issues: check privileges and individual fixed versions", "records.wordpress-plugins.body": "The original sources confirm privilege requirements of Contributor for SQL injection in JetEngine 3.9.0 and earlier, Author for SQL injection in Media Library Assistant 3.42 and earlier, and Contributor for insufficient authorization in AI Engine 3.8.6 and earlier. These and the other XSS and CSRF entries are not all treated as unauthenticated RCE or confirmed exploitation.", "records.wordpress-plugins.action": "Check for JetEngine 3.9.0.1, Media Library Assistant 3.43, and AI Engine 3.8.7 or later, and review contributor privileges and installed plugins. For the remaining individual records, use the NVD index to check product-specific fixes.", "records.wordpress-plugins.time": "20:16 JST (NVD inclusion)", "records.nocodb-auth-extra.title": "4 additional NocoDB issues: authentication processing and the role of rate limits", "records.nocodb-auth-extra.body": "CVE-2026-116120–116123 are CNA records concerning resource consumption during signup and reset, signup races, differences in sign-in information, and limits on authentication attempts. The official PublicApiLimiterGuard explicitly states a design that relies on a reverse proxy or similar component for rate limiting, and the current signup processing also includes withSignupClaim. An increase in record identifiers alone does not establish that every version remains unfixed.", "records.nocodb-auth-extra.action": "Check rate limits for externally exposed signup, reset, and login endpoints, including proxy-side controls. Compare unusual signup and session revocation logs with the version in use, and treat the earliest shipped fixed version as undetermined.", "records.nocodb-auth-extra.time": "15:17 JST (NVD inclusion)", "records.libimobiledevice.title": "libimobiledevice: protocol responses from connected peers", "records.libimobiledevice.body": "CVE-2026-116258–116262 are CNA entries concerning memory handling in AFC, Web Inspector, and other components through version 1.4.0. The device info entries also include issues with local conditions. Official code was checked, but details could not be retrieved from the researcher's dynamically rendered site, so the full connection and pairing requirements and earliest fixed version remain undetermined.", "records.libimobiledevice.action": "Check device management tools, bundled versions, and the devices trusted for connection. Do not interpret this as all iPhones being vulnerable to compromise merely by browsing any website; isolate processing of suspicious devices and protocol responses.", "records.libimobiledevice.time": "20:16 JST (NVD inclusion)", "records.libgsf-ole.title": "libgsf: boundary checks in OLE2 file parsing", "records.libgsf-ole.body": "CVE-2026-116124 is a CNA entry concerning the OLE2 parser through version 1.14.60. A 9/26 commit fixing an out-of-bounds write was confirmed in GNOME's official mirror. The original GitLab page returned a challenge screen despite HTTP success, so its body could not be read. This is not a newly issued fix, and the earliest distributed fixed version remains undetermined.", "records.libgsf-ole.action": "Inventory libgsf bundled with document parsing and conversion processes, and check which distributions include the fix. Restrict the environments and privileges used to process untrusted OLE2 documents.", "records.libgsf-ole.time": "16:17 JST (NVD inclusion)", "records.qt-http2.title": "Qt: denial of service caused by a malicious HTTP/2 peer", "records.qt-http2.body": "CVE-2026-96432 concerns QNetworkAccessManager stopping while processing a sequence of responses from a malicious or compromised HTTP/2 server. The official table lists affected versions as 6.8.0–6.8.9 and 6.9.0–6.11.2. It does not confirm code execution through applications using Qt or compromise of all Qt products.", "records.qt-http2.action": "Check the applicable release branches, such as Qt 6.8.10 / 6.11.3, and update applications and bundled libraries. Also review control over connection destinations and restart monitoring.", "records.qt-http2.time": "21:17 JST (NVD inclusion)", "records.brain2-setup.title": "BRAIN2: service credentials left in installation logs", "records.brain2-setup.body": "CVE-2026-112250 concerns plaintext passwords left in setup logs in BRAIN2 3.09 and earlier when SQL Server Integrated Security is combined with a specified Windows service account. The logs are usually in the installing administrator's temporary directory; the description does not say they are unconditionally exposed to standard users.", "records.brain2-setup.action": "Update to 3.10 or later, and check secure removal and access permissions for the relevant setup logs. Change credentials for service accounts suspected of exposure.", "records.brain2-setup.time": "19:16 JST (NVD inclusion)", "records.image-upload-races.title": "Image uploads: temporary files and deletion permissions", "records.image-upload-races.body": "PictShare CVE-2026-116263 involves a race caused by predictable temporary filenames that allows content to be replaced after inspection. A fix dated 10/18 and the v3.7.2 tag were confirmed, but the GitHub Release API returned 404. EasyImage CVE-2026-116223 concerns deletion permissions, with a related hardening commit confirmed on 10/24. The conditions differ between the two products.", "records.image-upload-races.action": "For PictShare, check the tag corresponding to 3.7.2 and inclusion of the fix; for EasyImage, check the relevant fix and authentication and storage destination settings. Do not infer an arbitrary version number as a new earliest fixed version.", "records.image-upload-races.time": "21:17 JST (NVD inclusion)", "records.local-agent-http.title": "agent-teams-ai: boundaries of the local HTTP service", "records.local-agent-http.body": "CVE-2026-116228 is a CNA entry concerning insufficient authentication in the Local HTTP Service through version 2.17.10. Official code confirmed default handling of localhost origins, CORS conditions that broaden depending on configuration, and listening on the specified host. Unconditional compromise from an external webpage under every configuration has not been verified.", "records.local-agent-http.action": "Check the local HTTP service's listening address, CORS_ORIGIN, execution user, and local users' privileges. The earliest fixed version remains undetermined.", "records.local-agent-http.time": "16:17 JST (NVD inclusion)", "records.game-desktop-inputs.title": "Game and desktop utilities: handling external input", "records.game-desktop-inputs.body": "FFXIV Teamcraft CVE-2026-116229 concerns clipboard IPC in the renderer; Plague Inc Evolved CVE-2026-116230 concerns deserialization of Workshop scenarios. Teamcraft 11.4.32 was published on 10/13 and is not a new fix issued tonight. Avoid generalizing these issues to every part of the games or to ordinary browsing alone.", "records.game-desktop-inputs.action": "Compare fix guidance for Teamcraft 11.4.32, Plague Inc Evolved 1.24.0.4, and other applicable versions with your environment, and restrict untrusted scenarios and renderer input.", "records.game-desktop-inputs.time": "17:17 JST (NVD inclusion)", "records.pleasanter-nvd.title": "Pleasanter: rechecking the previously reported LDAP authentication issue", "records.pleasanter-nvd.body": "Following NVD inclusion of CVE-2026-113438, the developer's explanation from 10/23 was reviewed again. The affected conditions combine LDAP authentication on Linux/Docker or with the Windows Novell provider with AD or an LDAP server permitting anonymous binds. This is not an authentication bypass for all users, including those using local authentication, SAML, or passkeys.", "records.pleasanter-nvd.action": "For affected configurations, update to 1.5.9.1 or later. Note that 1.5.9.0 does not include the fix and that LDAP users are affected when LDAP+Local is used.", "records.pleasanter-nvd.time": "Developer publication 10/23; included in NVD 10/26", "records.vsft-nvd.title": "V-SFT: NVD inclusion of 7 previously reported issues", "records.vsft-nvd.body": "CVE-2026-107894–107900 are 7 issues previously listed using JVN information. Their inclusion in NVD this time does not mean 7 new incidents or 7 newly confirmed cases of exploitation. The requirement to open a crafted V7-format file on a design workstation still applies.", "records.vsft-nvd.action": "Check use of 6.2.11.0 and earlier and handling of external design files, and review improvement information and patches for 6.2.12.0.", "records.vsft-nvd.time": "13:00 JST (previous JVN report), 16:17 JST (NVD inclusion)", "records.jpcert-php-brotli.title": "JPCERT/CC: PHP update and Japanese Brotli alert", "records.jpcert-php-brotli.body": "At 16:25 JST, JPCERT/CC added information on PHP demonstrations, environment-dependent conditions, and upload progress mitigation, and published a Brotli alert. JVN also listed Brotli at 18:00. These are updates to guidance for Japan, not separate new PHP/Brotli CVEs.", "records.jpcert-php-brotli.action": "For PHP, continue updating to fixed versions and investigating compromise, and check session.upload_progress.enabled=0 for CVE-2026-115560 and restart all workers. For Brotli, check branch-specific fixes in 1.0.10 / 1.1.1 / 1.2.1 and guidance for products that bundle it.", "records.jpcert-php-brotli.time": "16:25 / 18:00 JST (official feeds)", "records.oray-router.title": "Oray X5 Pro: newline and file handling through configuration values", "records.oray-router.body": "CVE-2026-116231–116237 are CNA entries concerning configuration processing for Ser2net, SNMP, Dnsmasq, IPsec, L2TP, PPPoE, and other components in Pugongying X5 Pro 7.6.1. Newline injection and uploads should not collectively be generalized as unauthenticated external intrusion; access to administrative operations and privilege requirements need further confirmation.", "records.oray-router.action": "Check the model, firmware, management interface exposure, and configuration change history. The earliest fixed version remains undetermined, so review vendor guidance and restrictions on unnecessary administrative access.", "records.oray-router.time": "17:17–19:16 JST (NVD inclusion)", "records.siem-management.title": "Logsign SIEM / Liman MYS: product-specific administrative paths", "records.siem-management.body": "The CNA records path traversal in Logsign SIEM from 6.4.120 up to but excluding 6.4.122, and password recovery in Liman MYS from 2.3.4-1124 up to but excluding 2.3.5-1131, as separate issues. The national authority's original notification pages were dynamically rendered and their bodies could not be retrieved, so exploit conditions and actual exploitation were not independently confirmed in this review.", "records.siem-management.action": "Compare distributor guidance for Logsign 6.4.122, Liman 2.3.5-1131, and other applicable versions with the release branch in use, and review exposure of administrative paths, recovery procedures, and related logs.", "records.siem-management.time": "21:17 JST (NVD inclusion)", "records.gmo-sixth.title": "GMO: check linked services and browser sync as well as all sessions", "records.gmo-sixth.body": "The guidance advises signing out all devices and all sessions from another safe device, changing passwords for FX, securities, email, Google, and other services, and using MFA. It also adds removal of unfamiliar linked apps, forwarding settings, extensions, and registered devices, and keeping browser sync off until checks are complete. This does not confirm infection of every connected device.", "records.gmo-sixth.action": "Check guidance through official support channels, revoke all sessions, and review newly added authentication methods and integrations. Run a full scan and keep a disconnected backup; for optional PC investigations, check the scope of the prior confirmation document.", "records.gmo-sixth.time": "21:00 JST (reference time for the 6th report)", "records.blastmail-345.title": "Blastmail: total rises to 345 contracts; resumption time remains undetermined", "records.blastmail-345.body": "An external investigation newly confirmed exposure of information other than subscriber information for 1 additional contract. The operator states that the total is 345 contracts and that individual notifications to all 345 have been completed. This does not mean exposure involving 345 people or all recipients. The management interface, API, and delivery remain suspended; the next report is scheduled for around 10/27 12:00.", "records.blastmail-345.action": "Compare the information affected under each contract with the latest notification, and continue alternative delivery arrangements, inquiry handling, and vigilance against fraudulent emails. Do not treat completion of notifications as the end of the investigation or authorization to resume.", "records.blastmail-345.time": "17:00 JST (operator's displayed update time)", "records.tavinos-reservation-followup.title": "Hotel Tavinos: beware of payment links even from someone who knows your booking", "records.tavinos-reservation-followup.body": "Suspicious messages affected some bookings at the 3 Hamamatsucho, Asakusa, and Kyoto properties that met both conditions: made by 9/21 and with a stay date on or after 9/21. The notice explains that booking information may have been viewed and obtained through TEMAIRAZU. It does not confirm disclosure of all bookings or a new intrusion at this time.", "records.tavinos-reservation-followup.action": "Even if a message contains accurate booking details, do not enter information or transfer money through its URL; verify through the property's or booking site's official support channel. If you have already entered card information, contact your card issuer.", "records.tavinos-reservation-followup.time": "15:37:47 JST (page update metadata)", "records.php-honeypot-observed.title": "PHP2Shell: primary research observing execution in a limited honeypot setup", "records.php-honeypot-observed.body": "The researcher correlated HTTP requests with 35 Apache-child shell executions across 3 targets using PHP8.4.26, single-worker Apache mod_php, and 128MiB. Execution was under UID33; this does not mean 35 victims or root access. This article has not independently reanalyzed all PCAPs or run the PoC. The withdrawal of the connection to the government agency intrusion reported by Unit42 remains separately in effect.", "records.php-honeypot-observed.action": "In addition to updating, investigate suspicious child processes, communications, and file creation originating from PHP workers, together with surrounding HTTP records. Do not use 500 errors or large cookies alone to determine successful exploitation or absence of harm.", "records.php-honeypot-observed.time": "Observed and first published 10/24; last addition 10/26 11:28:31 JST", "records.tailworm-code-and-release.title": "Tailworm: distinguish source fixes from distributed releases and stop unnecessary forwarding", "records.tailworm-code-and-release.body": "Official PR21942 changes Unix forwarding to use authenticated local user credentials. Serve PR21931 has also been merged, but the latest stable versions are 1.104.2 and headscale0.29.6, and the earliest fixed version covering all of Tailworm remains undetermined in this review. Connection policy PR21944 is open. A merge into main does not establish that a fix has been distributed.", "records.tailworm-code-and-release.action": "After confirming an alternative management path, review the temporary measure of setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting it to stop unnecessary forwarding. Do not treat check mode or this flag alone as completing fixes for every research finding.", "records.tailworm-code-and-release.time": "SSH forwarding PR merged 10/26 12:08:59 JST. Change predates the previous review", "records.m365-token-replay.title": "Microsoft 365: check MFA and registered devices as well as sessions", "records.m365-token-replay.body": "Huntress reports 497 successful sign-ins across 79 organizations, at least 48 unauthorized Entra device registrations, MFA replacement, and inbox rules. Distinguish reuse of stolen sessions from subsequent persistence. The source does not establish 79 intrusions today or the same cause as ConnectWise.", "records.m365-token-replay.action": "Alongside session revocation and password changes, investigate registered devices, MFA methods, inbox rules, new enterprise applications, and consent grants, and remove unauthorized entries. Do not prioritize response solely by the number of failed attempts.", "records.m365-token-replay.time": "Primary research published 10/22 22:00 JST. Observed 7/14–9/22", "records.gheist-github-tokens.title": "Gheist: exfiltration of secrets through GitHub logs", "records.gheist-github-tokens.body": "Wiz reports more than 850 accounts and over 13,500 suspicious branches involving stolen tokens. Workflows print secrets to logs, which are retrieved through the GitHub API before the runs are deleted. The public runs examined were blocked by approval holds, while execution and subsequent activity were observed in private / Enterprise environments. Branch counts are not counts of affected organizations.", "records.gheist-github-tokens.action": "Check for ci-sync- branches, sync-check workflows, runs deleted shortly after creation, and cloud-side role assumption. In repositories where execution occurred, revoke and replace tokens and accessible secrets, and investigate self-hosted runners and permissions. Do not approve pending suspicious workflows.", "records.gheist-github-tokens.time": "Primary research published 10/26 02:55:33 JST. Observed since 9/15", "records.ucreator-android.title": "uCreator: research into surveillance capabilities through modified APKs and containers", "records.ucreator-android.body": "The research analyzes modified APKs for Telegram, WeChat, and other apps, and hooks inside Onion Box containers. It demonstrates capabilities to obtain 2FA information, sessions, and similar data, but a reliable victim count remains undetermined. It does not prove that the entire chain worked on Android17 or that OS updates alone can prevent every case.", "records.ucreator-android.action": "Check distribution sources, signatures, and app provenance. If suspicious modified versions are present, investigate sessions and authentication methods from a safe device. Do not confirm infection solely from residual LSPatch files or add the previous year's infection counts to this case.", "records.ucreator-android.time": "Primary research published 10/21 23:57:50 JST", "records.neat-rollout-recheck.title": "Neat: confirm deployment completion separately for devices and the cloud", "records.neat-rollout-recheck.body": "This update removes the advisory's old statement that firmware was being prepared. NeatOS26.5.4 remains in staged rollout, Pulse deployment varies by organization, and non-Pulse OTA is targeted for 10/28. The cloud-side fix is separate and expected to take about 2 weeks; this wording update does not prove completion of all deployments.", "records.neat-rollout-recheck.action": "Check the Pulse Roadmap and actual device versions, and distinguish any necessary webhook credential rotation from confirmation that the cloud fix is complete. Do not infer that all devices are fixed from dates or advisory edits alone.", "records.neat-rollout-recheck.time": "18:10:22 JST (Summary edit in the official advisory)", "records.icewarp-after-cutoff.title": "Reference: the retrieved IceWarp version was revised after the cutoff", "records.icewarp-after-cutoff.body": "The article was created on 10/21, but the official API records a revision after the cutoff. Do not backdate the retrieved list of bundled PHP patches or future-release statements as confirmed content available before 21:35. Do not independently reconcile body text such as 14.3.0.14 and download names such as 14.3.0.15 into an earliest fixed version.", "records.icewarp-after-cutoff.action": "Users can consult current official guidance for their release branch and OS, but this article does not include version numbers retrieved later in the confirmed changes. Do not treat partial mitigation for older branches as a complete fix.", "records.icewarp-after-cutoff.time": "Edited 21:39:58 / updated 21:40:23 JST (after the 21:35 cutoff)", "records.kawanishi-restoration-reference.title": "Reference: Kawanishi Town's restoration notice does not establish the exact restoration time", "records.kawanishi-restoration-reference.body": "The current page states that inquiries, FAQs, evacuation shelter management, waste sorting searches, and other functions suspended for the PHP response have been restored, and that compromise or disclosure has not been confirmed. The server resource update time is not treated as the actual restoration or initial publication time; this is retained as reference information because the state at the relevant time cannot be fully reconstructed.", "records.kawanishi-restoration-reference.action": "Check the official status of the functions you use. Do not treat a precautionary suspension as confirmed compromise or generalize this town's notice to restoration across all municipalities.", "records.kawanishi-restoration-reference.time": "Dated 10/26. HTTP Last-Modified 16:00:20 JST; restoration and publication times remain undetermined", "caveats.0": "This is the current revision retrieved after the target time. Distinguish publication, database inclusion, intrusion, and availability of fixes.", "caveats.1": "The delta includes first database inclusion and official alerts within the window; it does not uniformly mean new discoveries or new harm.", "caveats.2": "All 99 new NVD entries overlap with the 1434 updated entries. All 111 GHSA publications overlap with the 151 modified entries.", "caveats.3": "This time, GHSA publications and modified records were retrieved with reviewed/unreviewed/malware explicitly specified. The scope differs from earlier default queries, so do not compare additional malware counts with an assumed absence in previous windows.", "caveats.4": "Distinguish GitHub's malware category from classifications such as PROBABLY_PENTEST in the original analyses.", "caveats.5": "CVE-2012-20006 is Rejected and is not recommended as a new valid vulnerability.", "caveats.6": "Absence from KEV, no updates, or no feed delivery does not prove the absence of exploitation or harm.", "caveats.7": "Code comparison is not experimental testing or confirmation of actual exploitation, nor does it establish the earliest shipped fixed version.", "caveats.8": "GNOME GitLab returned a challenge screen despite HTTP success. Distinguish the PictShare Release API's 404 from the existence of a tag.", "caveats.9": "Retrieved at 21:37:41–21:43:21 JST. The original HTTP responses contain current revisions from after the cutoff, and unmarked additions cannot be fully reconstructed.", "caveats.10": "Time evidence came from GMO's 21:00 display, Blastmail's 17:00 display, JPCERT's official RSS at 16:25, the JVN homepage at 18:00, and page update metadata with times other than midnight (0 hours). Do not treat these as intrusion or attack start times.", "caveats.11": "The PHP honeypot, Huntress, Wiz, and Ovi primary research was published before the previous review. Do not recount evening coverage as new harm or discoveries.", "caveats.12": "Reading researcher reports is not independent reanalysis of every packet or execution of a PoC. Do not convert observed counts of shells, branches, or sign-ins into numbers of affected people or organizations.", "caveats.13": "Tailworm source merges and distributed releases are separate. The earliest fixed version remains undetermined in this review, and check mode or disabling forwarding alone does not complete fixes for every item.", "caveats.14": "ConnectWise's next scheduled update at 23:00 JST is after the cutoff. Keep affected connections disabled until specific instructions are provided, and do not treat a restoration target as permission to connect.", "caveats.15": "The retrieved IceWarp body was revised at 21:39:58–21:40:23 JST, so it is not included as a confirmed patch list available before the 21:35 cutoff.", "caveats.16": "Kawanishi Town's HTTP Last-Modified reflects a resource update, not the actual restoration or initial publication time. It is retained with reservations as reference information.", "caveats.17": "Direct Reddit access returned HTTP 200 with an unreadable challenge; JSON returned 403. The vendor's body text was checked separately through browser-rendered text, and the post's exact edit time remains unconfirmed.", "caveats.18": "This does not cover every incident worldwide. News and social media are used only as starting points for primary-source research; attacker claims and the previous year's infection counts are not added to confirmed harm.", "caveats.19": "The consolidated ledger contains 37 topics: 23 changes, 12 supplements to existing cases, and 2 references. JPCERT/CC's PHP and Brotli information is consolidated into 1 API-side group; the 2 vendor-side groups are not counted again.", "caveats.20": "Of 169 saved or referenced responses, 27 refer to earlier originals. 1 browser-rendered text record was saved separately and distinguished from original HTTP responses.", "caveats.21": "GHSA malware records were explicitly retrieved this time. Because the previous search scope also differed, do not directly equate an increase in records with an increase in new attacks.", "report.title": "10/26, 21:35 — Reviewing incidents, vulnerabilities, and response measures", "report.headline": "Start tonight's checks with what you use.", "report.intro": "We reviewed account protection, malicious packages, application authentication and permissions, and updates on services in Japan. The 37 topics are organized to help you find necessary measures and primary sources.", "quick.0.title": "For GMO users", "quick.0.text": "The 6th report at 21 advises checking linked services such as email and Google, as well as browser sync, in addition to disconnecting all sessions. Proceed from another trusted device.", "quick.0.label": "Official guidance and scope of checks", "quick.1.title": "For those managing development and build environments", "quick.1.text": "Check the affected npm and PyPI packages and versions. If malicious versions have run, review environment isolation, revocation of keys they could access, and whether rebuilding is necessary.", "quick.1.label": "Package-specific conditions and measures", "quick.2.title": "For administrators of applications and public-facing services", "quick.2.text": "Review Japanese PHP/Brotli alerts and the conditions affecting Frappe, MISP, SAML, NocoDB, and others. Camel may require configuration even after updating.", "quick.2.label": "Japanese alerts and distributor guidance", "quick.3.title": "For users of delivery and booking services", "quick.3.text": "Blastmail's notice covers 345 contracts, and the resumption time remains undetermined. Even if someone knows your hotel booking details, verify payment links through official support channels.", "quick.3.label": "Updates on services in Japan", "ui.title": "Incident and vulnerability research data", "ui.intro": "Research records based on public primary sources. They are organized so you can review conditions and reservations and return to official guidance.", "ui.cutoff": "Research cutoff time", "ui.actions": "What to check", "ui.sources": "Primary sources and references", "ui.delta": "Updates to records and advisories reviewed this time", "ui.scope-complement": "Additional measures and conditions for existing cases", "ui.reference-only": "Reference information with publication times or other details still undetermined", "ui.notice": "This is an AI translation by Codex and has not been reviewed by a native speaker. Check product names, versions, settings, and measures against the original text and official guidance.", "ui.original": "Japanese original", "ui.data": "Download translation data as JSON", "ui.home": "Go to motion", "ui.languages": "Select a language", "ui.evidence": "Retrieved originals and research methods", "ui.counts": "The number of topics covered here is not the number of new incidents involving harm.", "ui.pending": "Preparing translation data." }, "provenance": { "engine": "OpenAI Codex CLI", "model_selection": "CLI default; not overridden", "prompt_version": "incident-translation-v1", "generated_at": "2026-10-26T13:59:04.292147+00:00", "usage": { "input_tokens": 27679, "cached_input_tokens": 0, "cache_write_input_tokens": 0, "output_tokens": 6819, "reasoning_output_tokens": 42 }, "human_reviewed": false, "format_corrections": { "engine": "Codex workspace assistant", "at": "2026-10-26T14:07:50.344429+00:00", "scope": "ASCII numerals and source-format dates; unchanged claims" } }, "register_hash": "fe134a9745b1c69c9242f9fe22aa2566f98f636814d61d797d69b4c3ca154ebd", "database": { "cutoff": "2026-10-26T12:35:00Z", "cutoff_jst": "2026-10-26T21:35:00+09:00", "delta_start": "2026-10-26T05:56:00Z", "counts": { "nvd_published": 99, "nvd_modified": 1434, "published_modified_overlap": 99, "ghsa": 111, "ghsa_unreviewed": 103, "ghsa_reviewed": 0, "ghsa_malware": 8, "ghsa_modified": 151, "ghsa_published_modified_overlap": 111, "ghsa_current_published_overlap": 95, "ghsa_previous_published_overlap": 8, "delta_topic_groups": 23, "scope_complement_topic_groups": 12, "reference_only_topic_groups": 2, "record_topic_groups": 37, "nvd_rejected_records": 1, "verified_response_records": 169, "deduplicated_previous_references": 27, "rendered_supplement_captures": 1 }, "kev": { "catalog_version": "2026.10.23", "count": 1756, "same_bytes": true, "added_ids": [] }, "caveats": [ "This is the current revision retrieved after the target time. Distinguish publication, database inclusion, intrusion, and availability of fixes.", "The delta includes first database inclusion and official alerts within the window; it does not uniformly mean new discoveries or new harm.", "All 99 new NVD entries overlap with the 1434 updated entries. All 111 GHSA publications overlap with the 151 modified entries.", "This time, GHSA publications and modified records were retrieved with reviewed/unreviewed/malware explicitly specified. The scope differs from earlier default queries, so do not compare additional malware counts with an assumed absence in previous windows.", "Distinguish GitHub's malware category from classifications such as PROBABLY_PENTEST in the original analyses.", "CVE-2012-20006 is Rejected and is not recommended as a new valid vulnerability.", "Absence from KEV, no updates, or no feed delivery does not prove the absence of exploitation or harm.", "Code comparison is not experimental testing or confirmation of actual exploitation, nor does it establish the earliest shipped fixed version.", "GNOME GitLab returned a challenge screen despite HTTP success. Distinguish the PictShare Release API's 404 from the existence of a tag.", "Retrieved at 21:37:41–21:43:21 JST. The original HTTP responses contain current revisions from after the cutoff, and unmarked additions cannot be fully reconstructed.", "Time evidence came from GMO's 21:00 display, Blastmail's 17:00 display, JPCERT's official RSS at 16:25, the JVN homepage at 18:00, and page update metadata with times other than midnight (0 hours). Do not treat these as intrusion or attack start times.", "The PHP honeypot, Huntress, Wiz, and Ovi primary research was published before the previous review. Do not recount evening coverage as new harm or discoveries.", "Reading researcher reports is not independent reanalysis of every packet or execution of a PoC. Do not convert observed counts of shells, branches, or sign-ins into numbers of affected people or organizations.", "Tailworm source merges and distributed releases are separate. The earliest fixed version remains undetermined in this review, and check mode or disabling forwarding alone does not complete fixes for every item.", "ConnectWise's next scheduled update at 23:00 JST is after the cutoff. Keep affected connections disabled until specific instructions are provided, and do not treat a restoration target as permission to connect.", "The retrieved IceWarp body was revised at 21:39:58–21:40:23 JST, so it is not included as a confirmed patch list available before the 21:35 cutoff.", "Kawanishi Town's HTTP Last-Modified reflects a resource update, not the actual restoration or initial publication time. It is retained with reservations as reference information.", "Direct Reddit access returned HTTP 200 with an unreadable challenge; JSON returned 403. The vendor's body text was checked separately through browser-rendered text, and the post's exact edit time remains unconfirmed.", "This does not cover every incident worldwide. News and social media are used only as starting points for primary-source research; attacker claims and the previous year's infection counts are not added to confirmed harm.", "The consolidated ledger contains 37 topics: 23 changes, 12 supplements to existing cases, and 2 references. JPCERT/CC's PHP and Brotli information is consolidated into 1 API-side group; the 2 vendor-side groups are not counted again.", "Of 169 saved or referenced responses, 27 refer to earlier originals. 1 browser-rendered text record was saved separately and distinguished from original HTTP responses.", "GHSA malware records were explicitly retrieved this time. Because the previous search scope also differed, do not directly equate an increase in records with an increase in new attacks." ], "provenance": { "summary": "collection-summary.json", "nvd": "nvd-index.json", "ghsa_modified": "ghsa-modified-index.json", "feeds": "feed-index.json", "research": "../../docs/research-collection-2026-10-26-2135.md", "collector": "../../tools/intel/snapshot-2135.py", "vendor_summary": "../2026-10-26-2135-vendors/collection-summary.json", "vendor_research": "../../docs/research-2026-10-26-2135.md", "vendor_analysis": "../2026-10-26-2135-vendors/analysis.json" }, "records": [ { "id": "npm-miners", "title": "2 npm packages: mining during installation", "kind": "delta", "time": "15:30 JST (GHSA publication)", "date": "2026-10-26", "body": "GitHub malware advisories describe mining programs and persistence mechanisms run through postinstall in dsh-plugin-blender-3d 0.2.1 and @walknpm/todo-cli 2.0.1. Behavior differs depending on whether root access or passwordless sudo is available. This does not mean that all npm packages or Blender itself have been compromised.", "action": "Check installation records for the affected versions. If they have run, isolate the environment, investigate persistence, external communications, and access to credentials, and revoke any necessary keys from a safe environment.", "sources": [ { "name": "GitHub malware勧告", "url": "https://github.com/advisories/GHSA-c7hg-7rf4-q54h" }, { "name": "GitHub malware勧告", "url": "https://github.com/advisories/GHSA-q4qv-538q-m27m" }, { "name": "OpenSSF原記録", "url": "https://raw.githubusercontent.com/ossf/malicious-packages/eac9baa31aaebdf7ba1cb053549c9fcddb5bb60f/osv/malicious/npm/dsh-plugin-blender-3d/MAL-2026-18321.json" } ], "certainty": "confirmed-publication", "cve_ids": [] }, { "id": "npm-worca", "title": "@worca/app: malware advisory for affected RC versions", "kind": "delta", "time": "16:33 JST (GHSA publication)", "date": "2026-10-26", "body": "GitHub classifies @worca/app 1.14.0-rc.2 / 1.14.0-rc.4 as malware and advises treating devices on which it was run or installed as compromised. The public record does not specify the number of affected organizations or when the intrusion began.", "action": "Isolate and investigate environments where the affected versions were installed. Rotate keys and secrets from another safe device, and do not consider recovery complete simply because the package has been removed.", "sources": [ { "name": "GitHub malware勧告", "url": "https://github.com/advisories/GHSA-rmc5-cxrx-5fh9" } ], "certainty": "confirmed-publication", "cve_ids": [] }, { "id": "npm-publish-poc", "title": "npm publish-poc packages: publishing permissions in the installation environment", "kind": "delta", "time": "18:31 JST (GHSA publication)", "date": "2026-10-26", "body": "The 7 affected versions of publish-poc-test3 reportedly attempt to publish using the environment's npm credentials during postinstall. publish-poc-base 1.0.7 prepares a temporary file containing a README fragment and credentials, but the description states that this version deletes it before publishing or communicating externally. Do not count both as successful external transmission.", "action": "Check the affected versions, CI installation logs, and npm publishing history. If suspicious publications are found, revoke the relevant tokens and review dependencies and publishing permissions.", "sources": [ { "name": "test3勧告", "url": "https://github.com/advisories/GHSA-mq69-4j49-gmx8" }, { "name": "base勧告", "url": "https://github.com/advisories/GHSA-35j9-6ggx-3fcq" }, { "name": "OpenSSF原記録", "url": "https://raw.githubusercontent.com/ossf/malicious-packages/4f27542fecd13e7f077489c04a2f3503d1189f32/osv/malicious/npm/publish-poc-test3/MAL-2026-18324.json" } ], "certainty": "confirmed-publication", "cve_ids": [] }, { "id": "pypi-netweavex", "title": "PyPI netweavex: fetching remote code on import", "kind": "delta", "time": "21:30 JST (GHSA publication)", "date": "2026-10-26", "body": "The affected versions are netweavex 1.1.0 / 1.1.1 / 1.1.2. The original analysis describes copying a legitimate package, obfuscation, and fetching and executing code from GitHub on import. It also states that the retrieval destination was a placeholder at the time of analysis, and does not confirm successful theft of any specific information.", "action": "Check installation records without running the affected versions. If they have run, investigate external communications and execution history, and revoke secrets and rebuild as appropriate to the exposure.", "sources": [ { "name": "GitHub malware勧告", "url": "https://github.com/advisories/GHSA-rr8h-gqmw-34rx" }, { "name": "OpenSSF原記録", "url": "https://raw.githubusercontent.com/ossf/malicious-packages/704cd12348e734be09a1c7c2f3bdba3e5f889d84/osv/malicious/pypi/netweavex/MAL-2026-18328.json" } ], "certainty": "confirmed-publication", "cve_ids": [] }, { "id": "pypi-pentest", "title": "2 PyPI cases: transmission of basic device information and analysis classifications", "kind": "delta", "time": "18:31 JST (GHSA publication)", "date": "2026-10-26", "body": "zagents-framework 6.25.30.10b5 / 99.25.30.10b5 and changes-lxc-wrapper 0.0.0 / 0.1.0 are recorded as sending basic device information during installation or import. GitHub categorizes them as malware, while the original analysis classifies them as PROBABLY_PENTEST. Do not equate them with large-scale credential theft incidents.", "action": "Check their intended use and how they were installed, and exclude unnecessary affected packages. If they have run, investigate the destinations and actual impact.", "sources": [ { "name": "zagents勧告", "url": "https://github.com/advisories/GHSA-vqh8-gjqw-v2r3" }, { "name": "changes-lxc-wrapper勧告", "url": "https://github.com/advisories/GHSA-3rm9-gfp2-hphh" }, { "name": "OpenSSF原記録", "url": "https://raw.githubusercontent.com/ossf/malicious-packages/6338462adbfe05eae85d7721e0235915b2a4e352/osv/malicious/pypi/zagents-framework/MAL-2026-18327.json" } ], "certainty": "confirmed-publication", "cve_ids": [] }, { "id": "frappe-builder", "title": "Frappe Builder: SSRF in image retrieval and permissions for AI use", "kind": "delta", "time": "14:58 JST (developer advisory), 21:17 JST (NVD inclusion)", "date": "2026-10-26", "body": "The developer published 3 advisories at 14:58 JST. They cover authenticated users controlling image retrieval destinations, reaching internal destinations through redirects and DNS re-resolution, and insufficient authorization for improve_prompt, which uses an AI provider key. They do not describe compromise of every server by any unauthenticated user.", "action": "Check the requirements for Builder 1.36.1 or later and Frappe v16.36.1 or later. Review image retrieval destinations, publicly stored content, and AI usage logs. If updating is not possible, consider restricting the affected APIs and temporarily removing AI keys.", "sources": [ { "name": "画像取得勧告", "url": "https://github.com/frappe/builder/security/advisories/GHSA-5qcg-q3jf-fjcg" }, { "name": "AI利用権限勧告", "url": "https://github.com/frappe/builder/security/advisories/GHSA-58mj-c563-p78w" }, { "name": "redirect対策勧告", "url": "https://github.com/frappe/builder/security/advisories/GHSA-hvrf-fhv3-3v7p" } ], "certainty": "confirmed-publication", "cve_ids": [ "CVE-2026-115717", "CVE-2026-115718", "CVE-2026-115720" ] }, { "id": "misp-guard", "title": "MISP Guard: check sharing policy evaluation", "kind": "delta", "time": "18:16 JST (NVD inclusion)", "date": "2026-10-26", "body": "CVE-2026-116372 allows distribution filters to be bypassed through successful responses other than 200; 116469 allows bypasses through letter casing in tags, categories, and sharing group UUIDs. The developer addressed these in commits at 16:53 / 18:25 JST. This does not confirm compromise of all of MISP itself or disclosure of all feed data.", "action": "Check that the running code includes both fixes, and review permission settings such as TLP and distribution history. The earliest distributed release containing the fixes has not been established in this review.", "sources": [ { "name": "成功応答の修正", "url": "https://github.com/MISP/misp-guard/commit/b5f606a4e57a49cc4dbf9b3ef0c6ddd19f866735" }, { "name": "大文字小文字の修正", "url": "https://github.com/MISP/misp-guard/commit/9868b1d93fc9cc40cc7c69ca11c86afd825bbc1c" } ], "certainty": "confirmed-publication", "cve_ids": [ "CVE-2026-116372", "CVE-2026-116469" ] }, { "id": "mendix-saml", "title": "Mendix SAML: reusing IdP-initiated responses", "kind": "delta", "time": "20:16 JST (NVD inclusion)", "date": "2026-10-26", "body": "CVE-2026-89209 is an authentication bypass under conditions involving reuse of a valid SAML response in IdP-initiated SSO. It affects module versions below 3.6.29 for Mendix 9 and below 4.2.4 for 10/11. It does not state that merely creating an arbitrary SAML response is sufficient.", "action": "Update the SAML module in use to 3.6.29 or 4.2.4 or later. If an immediate update is not possible, consult the developer's guidance on disabling IdP-initiated SSO.", "sources": [ { "name": "Siemens公式勧告", "url": "https://cert-portal.siemens.com/productcert/html/ssa-137528.html" } ], "certainty": "confirmed-publication", "cve_ids": [ "CVE-2026-89209" ] }, { "id": "ash-multitenancy", "title": "Ash: tenant boundaries in upsert", "kind": "scope-complement", "time": "14:32 JST (developer advisory), 17:17 JST (NVD inclusion)", "date": "2026-10-26", "body": "The developer advisory for CVE-2026-96581 was published at 14:32 JST, before the previous cutoff. It describes conditions under attribute multitenancy in which a create action with upsert that accepts primary keys or similar values can update or retrieve another tenant's records. Not every create action or Ash application has this configuration.", "action": "Check for Ash 3.37.2 or later, and review cross-tenant upserts and record movement history. Also note the exception that the temporary upsert_condition workaround does not work with Mnesia.", "sources": [ { "name": "開発元勧告", "url": "https://github.com/ash-project/ash/security/advisories/GHSA-vw7c-67pf-gh96" } ], "certainty": "confirmed-publication", "cve_ids": [ "CVE-2026-96581" ] }, { "id": "camel-components", "title": "Apache Camel: Docling configuration is still needed after updating", "kind": "scope-complement", "time": "Published 10/22; included in NVD 10/26", "date": "2026-10-26", "body": "5 advisories published on 10/22 have been supplemented to reflect their inclusion in NVD. Docling input and output paths, expiration of Keycloak introspection results, expression evaluation in AWS2-S3 object names, and information disclosure in CoAP errors involve distinct conditions. The Keycloak issue applies when token introspection is enabled, which is not the default.", "action": "Update to versions such as 4.18.5 / 4.22.2 / 4.23.0, as applicable. Where external input can specify a Docling output destination, configure outputBaseDirectory even after updating. Check handling of S3 headers and expired tokens.", "sources": [ { "name": "Docling出力先", "url": "https://camel.apache.org/security/CVE-2026-95629.html" }, { "name": "Docling引数", "url": "https://camel.apache.org/security/CVE-2026-95628.html" }, { "name": "Keycloak期限", "url": "https://camel.apache.org/security/CVE-2026-95663.html" }, { "name": "S3式評価", "url": "https://camel.apache.org/security/CVE-2026-95664.html" }, { "name": "CoAPエラー", "url": "https://camel.apache.org/security/CVE-2026-101259.html" } ], "certainty": "confirmed-publication", "cve_ids": [ "CVE-2026-95628", "CVE-2026-95629", "CVE-2026-95663", "CVE-2026-95664", "CVE-2026-101259" ] }, { "id": "soem-ethercat", "title": "SOEM: device responses on the same EtherCAT network", "kind": "scope-complement", "time": "Advisory dated 9/21; included in NVD 10/26", "date": "2026-10-26", "body": "RT-Labs documentation dated 9/21 describes 6 issues affecting SOEM 2.0.0 and earlier. They require a malicious or compromised EtherCAT device to return invalid responses to the master. Insufficient validation of lengths, cumulative quantities, array indices, and similar values may cause memory corruption, information disclosure, or shutdown. General internet reachability alone is not sufficient.", "action": "Check with the product vendor whether SOEM 2.0.1 or later is integrated. Review device additions to the EtherCAT segment, maintenance connections, and master privileges, and update in accordance with equipment shutdown procedures and a validation plan.", "sources": [ { "name": "RT-Labs原勧告PDF", "url": "https://rt-labs.com/wp-content/uploads/2026/10/RRTL-260921-01.pdf" } ], "certainty": "confirmed-publication", "cve_ids": [ "CVE-2026-70388", "CVE-2026-82943", "CVE-2026-82944", "CVE-2026-82945", "CVE-2026-82946", "CVE-2026-82947" ] }, { "id": "woocommerce-callbacks", "title": "WooCommerce payment integrations: payment notifications and order status", "kind": "scope-complement", "time": "Original reports published 10/23; 16:17 JST (NVD inclusion)", "date": "2026-10-26", "body": "6 issues published on 10/23 have been supplemented to reflect their inclusion in NVD. They affect individual plugins for CCAvenue, nexi Alpha Bank, Eurobank, iKhokha, OPay, and Mintpay, involving changes to states such as paid or canceled due to notification authenticity issues or a secret that is empty by default. They do not represent compromises of the banks themselves or WooCommerce itself.", "action": "For iKhokha, check for version 3.0.4 or later. The original sources list no known fixed versions for the other 5, so consider suspending or replacing affected integrations and reconciling payments against payment provider records.", "sources": [ { "name": "CCAvenue原報告", "url": "https://wpscan.com/vulnerability/7224481a-60f8-42c2-87e9-4615ce666357/" }, { "name": "nexi Alpha Bank原報告", "url": "https://wpscan.com/vulnerability/0a1c3070-181d-49ea-9488-d0d7e4be419c/" }, { "name": "Eurobank原報告", "url": "https://wpscan.com/vulnerability/37851403-0765-4fc2-80f6-f70d3fc34a88/" }, { "name": "iKhokha原報告", "url": "https://wpscan.com/vulnerability/2d888e78-ed1f-4968-9bdc-19e9420f6956/" }, { "name": "OPay原報告", "url": "https://wpscan.com/vulnerability/c07f15a0-3c15-429f-bcde-1511ad658c6c/" }, { "name": "Mintpay原報告", "url": "https://wpscan.com/vulnerability/593fa052-8917-416c-944b-11b890c9ab50/" } ], "certainty": "confirmed-publication", "cve_ids": [ "CVE-2026-103298", "CVE-2026-103299", "CVE-2026-103300", "CVE-2026-103306", "CVE-2026-103319", "CVE-2026-103381" ] }, { "id": "wordpress-plugins", "title": "Additional WordPress issues: check privileges and individual fixed versions", "kind": "delta", "time": "20:16 JST (NVD inclusion)", "date": "2026-10-26", "body": "The original sources confirm privilege requirements of Contributor for SQL injection in JetEngine 3.9.0 and earlier, Author for SQL injection in Media Library Assistant 3.42 and earlier, and Contributor for insufficient authorization in AI Engine 3.8.6 and earlier. These and the other XSS and CSRF entries are not all treated as unauthenticated RCE or confirmed exploitation.", "action": "Check for JetEngine 3.9.0.1, Media Library Assistant 3.43, and AI Engine 3.8.7 or later, and review contributor privileges and installed plugins. For the remaining individual records, use the NVD index to check product-specific fixes.", "sources": [ { "name": "JetEngine原報告", "url": "https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-9-0-sql-injection-vulnerability?_s_id=cve" }, { "name": "Media Library Assistant原報告", "url": "https://patchstack.com/database/wordpress/plugin/media-library-assistant/vulnerability/wordpress-media-library-assistant-plugin-3-42-sql-injection-vulnerability?_s_id=cve" }, { "name": "AI Engine原報告", "url": "https://patchstack.com/database/wordpress/plugin/ai-engine/vulnerability/wordpress-ai-engine-plugin-3-8-6-broken-access-control-vulnerability?_s_id=cve" } ], "certainty": "confirmed-publication", "cve_ids": [ "CVE-2026-115608", "CVE-2026-115948", "CVE-2026-112828" ] }, { "id": "nocodb-auth-extra", "title": "4 additional NocoDB issues: authentication processing and the role of rate limits", "kind": "delta", "time": "15:17 JST (NVD inclusion)", "date": "2026-10-26", "body": "CVE-2026-116120–116123 are CNA records concerning resource consumption during signup and reset, signup races, differences in sign-in information, and limits on authentication attempts. The official PublicApiLimiterGuard explicitly states a design that relies on a reverse proxy or similar component for rate limiting, and the current signup processing also includes withSignupClaim. An increase in record identifiers alone does not establish that every version remains unfixed.", "action": "Check rate limits for externally exposed signup, reset, and login endpoints, including proxy-side controls. Compare unusual signup and session revocation logs with the version in use, and treat the earliest shipped fixed version as undetermined.", "sources": [ { "name": "CVE-2026-116120", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116120" }, { "name": "CVE-2026-116121", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116121" }, { "name": "CVE-2026-116122", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116122" }, { "name": "CVE-2026-116123", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116123" }, { "name": "公式guardコード", "url": "https://raw.githubusercontent.com/nocodb/nocodb/develop/packages/nocodb/src/guards/public-api-limiter.guard.ts" }, { "name": "公式登録処理", "url": "https://raw.githubusercontent.com/nocodb/nocodb/develop/packages/nocodb/src/services/users/users.service.ts" } ], "certainty": "CNA-unreviewed", "cve_ids": [ "CVE-2026-116120", "CVE-2026-116121", "CVE-2026-116122", "CVE-2026-116123" ] }, { "id": "libimobiledevice", "title": "libimobiledevice: protocol responses from connected peers", "kind": "delta", "time": "20:16 JST (NVD inclusion)", "date": "2026-10-26", "body": "CVE-2026-116258–116262 are CNA entries concerning memory handling in AFC, Web Inspector, and other components through version 1.4.0. The device info entries also include issues with local conditions. Official code was checked, but details could not be retrieved from the researcher's dynamically rendered site, so the full connection and pairing requirements and earliest fixed version remain undetermined.", "action": "Check device management tools, bundled versions, and the devices trusted for connection. Do not interpret this as all iPhones being vulnerable to compromise merely by browsing any website; isolate processing of suspicious devices and protocol responses.", "sources": [ { "name": "CVE-2026-116258", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116258" }, { "name": "CVE-2026-116262", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116262" }, { "name": "公式AFCコード", "url": "https://raw.githubusercontent.com/libimobiledevice/libimobiledevice/master/src/afc.c" }, { "name": "研究者サイト・本文制限", "url": "https://bohmid-com.vercel.app/" } ], "certainty": "CNA-unreviewed", "cve_ids": [ "CVE-2026-116258", "CVE-2026-116259", "CVE-2026-116260", "CVE-2026-116261", "CVE-2026-116262" ] }, { "id": "libgsf-ole", "title": "libgsf: boundary checks in OLE2 file parsing", "kind": "delta", "time": "16:17 JST (NVD inclusion)", "date": "2026-10-26", "body": "CVE-2026-116124 is a CNA entry concerning the OLE2 parser through version 1.14.60. A 9/26 commit fixing an out-of-bounds write was confirmed in GNOME's official mirror. The original GitLab page returned a challenge screen despite HTTP success, so its body could not be read. This is not a newly issued fix, and the earliest distributed fixed version remains undetermined.", "action": "Inventory libgsf bundled with document parsing and conversion processes, and check which distributions include the fix. Restrict the environments and privileges used to process untrusted OLE2 documents.", "sources": [ { "name": "CVE-2026-116124", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116124" }, { "name": "GNOME公式mirrorの修正", "url": "https://github.com/GNOME/libgsf/commit/a8e25560b74f84c3f86df6ca0ac59195fa5af68a" } ], "certainty": "CNA-unreviewed", "cve_ids": [ "CVE-2026-116124" ] }, { "id": "qt-http2", "title": "Qt: denial of service caused by a malicious HTTP/2 peer", "kind": "delta", "time": "21:17 JST (NVD inclusion)", "date": "2026-10-26", "body": "CVE-2026-96432 concerns QNetworkAccessManager stopping while processing a sequence of responses from a malicious or compromised HTTP/2 server. The official table lists affected versions as 6.8.0–6.8.9 and 6.9.0–6.11.2. It does not confirm code execution through applications using Qt or compromise of all Qt products.", "action": "Check the applicable release branches, such as Qt 6.8.10 / 6.11.3, and update applications and bundled libraries. Also review control over connection destinations and restart monitoring.", "sources": [ { "name": "Qt公式脆弱性一覧", "url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products" }, { "name": "Qt修正", "url": "https://codereview.qt-project.org/c/qt/qtbase/+/759718" } ], "certainty": "confirmed-publication", "cve_ids": [ "CVE-2026-96432" ] }, { "id": "brain2-setup", "title": "BRAIN2: service credentials left in installation logs", "kind": "delta", "time": "19:16 JST (NVD inclusion)", "date": "2026-10-26", "body": "CVE-2026-112250 concerns plaintext passwords left in setup logs in BRAIN2 3.09 and earlier when SQL Server Integrated Security is combined with a specified Windows service account. The logs are usually in the installing administrator's temporary directory; the description does not say they are unconditionally exposed to standard users.", "action": "Update to 3.10 or later, and check secure removal and access permissions for the relevant setup logs. Change credentials for service accounts suspected of exposure.", "sources": [ { "name": "Bizerba公式勧告PDF", "url": "https://www.bizerba.com/downloads/global/information-security/2026/bizerba-sa-2026-0004.pdf" } ], "certainty": "confirmed-publication", "cve_ids": [ "CVE-2026-112250" ] }, { "id": "image-upload-races", "title": "Image uploads: temporary files and deletion permissions", "kind": "delta", "time": "21:17 JST (NVD inclusion)", "date": "2026-10-26", "body": "PictShare CVE-2026-116263 involves a race caused by predictable temporary filenames that allows content to be replaced after inspection. A fix dated 10/18 and the v3.7.2 tag were confirmed, but the GitHub Release API returned 404. EasyImage CVE-2026-116223 concerns deletion permissions, with a related hardening commit confirmed on 10/24. The conditions differ between the two products.", "action": "For PictShare, check the tag corresponding to 3.7.2 and inclusion of the fix; for EasyImage, check the relevant fix and authentication and storage destination settings. Do not infer an arbitrary version number as a new earliest fixed version.", "sources": [ { "name": "PictShare修正", "url": "https://github.com/HaschekSolutions/pictshare/commit/6306e33da630c04ddff60703922c2ec7b7539452" }, { "name": "PictShare v3.7.2タグ", "url": "https://github.com/HaschekSolutions/pictshare/tree/v3.7.2" }, { "name": "EasyImage関連修正", "url": "https://github.com/icret/EasyImages2.0/commit/b12cb67d447bcbb67e21c8f011d0f5638229760c" } ], "certainty": "CNA-unreviewed", "cve_ids": [ "CVE-2026-116263", "CVE-2026-116223" ] }, { "id": "local-agent-http", "title": "agent-teams-ai: boundaries of the local HTTP service", "kind": "delta", "time": "16:17 JST (NVD inclusion)", "date": "2026-10-26", "body": "CVE-2026-116228 is a CNA entry concerning insufficient authentication in the Local HTTP Service through version 2.17.10. Official code confirmed default handling of localhost origins, CORS conditions that broaden depending on configuration, and listening on the specified host. Unconditional compromise from an external webpage under every configuration has not been verified.", "action": "Check the local HTTP service's listening address, CORS_ORIGIN, execution user, and local users' privileges. The earliest fixed version remains undetermined.", "sources": [ { "name": "CVE-2026-116228", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116228" }, { "name": "公式HTTPコード", "url": "https://raw.githubusercontent.com/777genius/agent-teams-ai/main/src/main/services/infrastructure/HttpServer.ts" } ], "certainty": "CNA-unreviewed", "cve_ids": [ "CVE-2026-116228" ] }, { "id": "game-desktop-inputs", "title": "Game and desktop utilities: handling external input", "kind": "delta", "time": "17:17 JST (NVD inclusion)", "date": "2026-10-26", "body": "FFXIV Teamcraft CVE-2026-116229 concerns clipboard IPC in the renderer; Plague Inc Evolved CVE-2026-116230 concerns deserialization of Workshop scenarios. Teamcraft 11.4.32 was published on 10/13 and is not a new fix issued tonight. Avoid generalizing these issues to every part of the games or to ordinary browsing alone.", "action": "Compare fix guidance for Teamcraft 11.4.32, Plague Inc Evolved 1.24.0.4, and other applicable versions with your environment, and restrict untrusted scenarios and renderer input.", "sources": [ { "name": "Teamcraft公式release", "url": "https://github.com/ffxiv-teamcraft/ffxiv-teamcraft/releases/tag/v11.4.32" }, { "name": "Plague Inc公式更新", "url": "https://store.steampowered.com/news/app/246620/view/708909893000628135" }, { "name": "CVE-2026-116230", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116230" } ], "certainty": "CNA-unreviewed", "cve_ids": [ "CVE-2026-116229", "CVE-2026-116230" ] }, { "id": "pleasanter-nvd", "title": "Pleasanter: rechecking the previously reported LDAP authentication issue", "kind": "scope-complement", "time": "Developer publication 10/23; included in NVD 10/26", "date": "2026-10-26", "body": "Following NVD inclusion of CVE-2026-113438, the developer's explanation from 10/23 was reviewed again. The affected conditions combine LDAP authentication on Linux/Docker or with the Windows Novell provider with AD or an LDAP server permitting anonymous binds. This is not an authentication bypass for all users, including those using local authentication, SAML, or passkeys.", "action": "For affected configurations, update to 1.5.9.1 or later. Note that 1.5.9.0 does not include the fix and that LDAP users are affected when LDAP+Local is used.", "sources": [ { "name": "開発元説明", "url": "https://pleasanter.org/news/vulnerability-update-20261023/" } ], "certainty": "confirmed-publication", "cve_ids": [ "CVE-2026-113438" ] }, { "id": "vsft-nvd", "title": "V-SFT: NVD inclusion of 7 previously reported issues", "kind": "scope-complement", "time": "13:00 JST (previous JVN report), 16:17 JST (NVD inclusion)", "date": "2026-10-26", "body": "CVE-2026-107894–107900 are 7 issues previously listed using JVN information. Their inclusion in NVD this time does not mean 7 new incidents or 7 newly confirmed cases of exploitation. The requirement to open a crafted V7-format file on a design workstation still applies.", "action": "Check use of 6.2.11.0 and earlier and handling of external design files, and review improvement information and patches for 6.2.12.0.", "sources": [ { "name": "JVN一次勧告", "url": "https://jvn.jp/vu/JVNVU96549652/" }, { "name": "CVE-2026-107894", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107894" } ], "certainty": "confirmed-publication", "cve_ids": [ "CVE-2026-107894", "CVE-2026-107895", "CVE-2026-107896", "CVE-2026-107897", "CVE-2026-107898", "CVE-2026-107899", "CVE-2026-107900" ] }, { "id": "jpcert-php-brotli", "title": "JPCERT/CC: PHP update and Japanese Brotli alert", "kind": "delta", "time": "16:25 / 18:00 JST (official feeds)", "date": "2026-10-26", "body": "At 16:25 JST, JPCERT/CC added information on PHP demonstrations, environment-dependent conditions, and upload progress mitigation, and published a Brotli alert. JVN also listed Brotli at 18:00. These are updates to guidance for Japan, not separate new PHP/Brotli CVEs.", "action": "For PHP, continue updating to fixed versions and investigating compromise, and check session.upload_progress.enabled=0 for CVE-2026-115560 and restart all workers. For Brotli, check branch-specific fixes in 1.0.10 / 1.1.1 / 1.2.1 and guidance for products that bundle it.", "sources": [ { "name": "JPCERT PHP", "url": "https://www.jpcert.or.jp/at/2026/at260033.html" }, { "name": "JPCERT Brotli", "url": "https://www.jpcert.or.jp/at/2026/at260034.html" }, { "name": "JVN Brotli", "url": "https://jvn.jp/vu/JVNVU97400824/" } ], "certainty": "confirmed-publication", "cve_ids": [] }, { "id": "oray-router", "title": "Oray X5 Pro: newline and file handling through configuration values", "kind": "delta", "time": "17:17–19:16 JST (NVD inclusion)", "date": "2026-10-26", "body": "CVE-2026-116231–116237 are CNA entries concerning configuration processing for Ser2net, SNMP, Dnsmasq, IPsec, L2TP, PPPoE, and other components in Pugongying X5 Pro 7.6.1. Newline injection and uploads should not collectively be generalized as unauthenticated external intrusion; access to administrative operations and privilege requirements need further confirmation.", "action": "Check the model, firmware, management interface exposure, and configuration change history. The earliest fixed version remains undetermined, so review vendor guidance and restrictions on unnecessary administrative access.", "sources": [ { "name": "CNA/NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116231" }, { "name": "CNA/NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116236" } ], "certainty": "CNA-unreviewed", "cve_ids": [ "CVE-2026-116231", "CVE-2026-116232", "CVE-2026-116233", "CVE-2026-116234", "CVE-2026-116235", "CVE-2026-116236", "CVE-2026-116237" ] }, { "id": "siem-management", "title": "Logsign SIEM / Liman MYS: product-specific administrative paths", "kind": "delta", "time": "21:17 JST (NVD inclusion)", "date": "2026-10-26", "body": "The CNA records path traversal in Logsign SIEM from 6.4.120 up to but excluding 6.4.122, and password recovery in Liman MYS from 2.3.4-1124 up to but excluding 2.3.5-1131, as separate issues. The national authority's original notification pages were dynamically rendered and their bodies could not be retrieved, so exploit conditions and actual exploitation were not independently confirmed in this review.", "action": "Compare distributor guidance for Logsign 6.4.122, Liman 2.3.5-1131, and other applicable versions with the release branch in use, and review exposure of administrative paths, recovery procedures, and related logs.", "sources": [ { "name": "Logsign CNA/NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105947" }, { "name": "Liman CNA/NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94380" }, { "name": "トルコ当局・本文取得制限", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1397" } ], "certainty": "CNA-unreviewed", "cve_ids": [ "CVE-2026-105947", "CVE-2026-94380" ] }, { "id": "gmo-sixth", "title": "GMO: check linked services and browser sync as well as all sessions", "kind": "delta", "time": "21:00 JST (reference time for the 6th report)", "date": "2026-10-26", "body": "The guidance advises signing out all devices and all sessions from another safe device, changing passwords for FX, securities, email, Google, and other services, and using MFA. It also adds removal of unfamiliar linked apps, forwarding settings, extensions, and registered devices, and keeping browser sync off until checks are complete. This does not confirm infection of every connected device.", "action": "Check guidance through official support channels, revoke all sessions, and review newly added authentication methods and integrations. Run a full scan and keep a disconnected backup; for optional PC investigations, check the scope of the prior confirmation document.", "sources": [ { "name": "GMO第6報", "url": "https://group.gmo/info/alert/20261026/" } ], "certainty": "confirmed-publication" }, { "id": "blastmail-345", "title": "Blastmail: total rises to 345 contracts; resumption time remains undetermined", "kind": "delta", "time": "17:00 JST (operator's displayed update time)", "date": "2026-10-26", "body": "An external investigation newly confirmed exposure of information other than subscriber information for 1 additional contract. The operator states that the total is 345 contracts and that individual notifications to all 345 have been completed. This does not mean exposure involving 345 people or all recipients. The management interface, API, and delivery remain suspended; the next report is scheduled for around 10/27 12:00.", "action": "Compare the information affected under each contract with the latest notification, and continue alternative delivery arrangements, inquiry handling, and vigilance against fraudulent emails. Do not treat completion of notifications as the end of the investigation or authorization to resume.", "sources": [ { "name": "運営元17:00更新", "url": "https://info.blastmail.jp/information_20261021.html" } ], "certainty": "confirmed-publication" }, { "id": "tavinos-reservation-followup", "title": "Hotel Tavinos: beware of payment links even from someone who knows your booking", "kind": "delta", "time": "15:37:47 JST (page update metadata)", "date": "2026-10-26", "body": "Suspicious messages affected some bookings at the 3 Hamamatsucho, Asakusa, and Kyoto properties that met both conditions: made by 9/21 and with a stay date on or after 9/21. The notice explains that booking information may have been viewed and obtained through TEMAIRAZU. It does not confirm disclosure of all bookings or a new intrusion at this time.", "action": "Even if a message contains accurate booking details, do not enter information or transfer money through its URL; verify through the property's or booking site's official support channel. If you have already entered card information, contact your card issuer.", "sources": [ { "name": "ホテル公式続報", "url": "https://hoteltavinos.com/notices-events/about-phishing-scams2/" } ], "certainty": "confirmed-publication" }, { "id": "php-honeypot-observed", "title": "PHP2Shell: primary research observing execution in a limited honeypot setup", "kind": "scope-complement", "time": "Observed and first published 10/24; last addition 10/26 11:28:31 JST", "date": "2026-10-24", "body": "The researcher correlated HTTP requests with 35 Apache-child shell executions across 3 targets using PHP8.4.26, single-worker Apache mod_php, and 128MiB. Execution was under UID33; this does not mean 35 victims or root access. This article has not independently reanalyzed all PCAPs or run the PoC. The withdrawal of the connection to the government agency intrusion reported by Unit42 remains separately in effect.", "action": "In addition to updating, investigate suspicious child processes, communications, and file creation originating from PHP workers, together with surrounding HTTP records. Do not use 500 errors or large cookies alone to determine successful exploitation or absence of harm.", "sources": [ { "name": "研究者一次報告", "url": "https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md" }, { "name": "公開履歴", "url": "https://api.github.com/repos/0x4D31/honeypot-data/commits?path=reports%2Fphp2shell%2F2026-10-24-confirmed-rce.md&per_page=20" }, { "name": "証拠索引と限界", "url": "https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-rce-evidence/README.md" }, { "name": "Unit42現行訂正", "url": "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/" } ], "certainty": "prior-scope" }, { "id": "tailworm-code-and-release", "title": "Tailworm: distinguish source fixes from distributed releases and stop unnecessary forwarding", "kind": "scope-complement", "time": "SSH forwarding PR merged 10/26 12:08:59 JST. Change predates the previous review", "date": "2026-10-26", "body": "Official PR21942 changes Unix forwarding to use authenticated local user credentials. Serve PR21931 has also been merged, but the latest stable versions are 1.104.2 and headscale0.29.6, and the earliest fixed version covering all of Tailworm remains undetermined in this review. Connection policy PR21944 is open. A merge into main does not establish that a fix has been distributed.", "action": "After confirming an alternative management path, review the temporary measure of setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting it to stop unnecessary forwarding. Do not treat check mode or this flag alone as completing fixes for every research finding.", "sources": [ { "name": "ベンダー責任者の案内", "url": "https://www.reddit.com/r/Tailscale/comments/1xeoj1l/recent_tailscale_vulnerability_reports/" }, { "name": "公式転送PR21942", "url": "https://github.com/tailscale/tailscale/pull/21942" }, { "name": "1.104.2公式flag実装", "url": "https://github.com/tailscale/tailscale/blob/v1.104.2/ssh/tailssh/tailssh.go" }, { "name": "最新公式release一覧", "url": "https://api.github.com/repos/tailscale/tailscale/releases?per_page=5" } ], "certainty": "prior-scope" }, { "id": "m365-token-replay", "title": "Microsoft 365: check MFA and registered devices as well as sessions", "kind": "scope-complement", "time": "Primary research published 10/22 22:00 JST. Observed 7/14–9/22", "date": "2026-10-22", "body": "Huntress reports 497 successful sign-ins across 79 organizations, at least 48 unauthorized Entra device registrations, MFA replacement, and inbox rules. Distinguish reuse of stolen sessions from subsequent persistence. The source does not establish 79 intrusions today or the same cause as ConnectWise.", "action": "Alongside session revocation and password changes, investigate registered devices, MFA methods, inbox rules, new enterprise applications, and consent grants, and remove unauthorized entries. Do not prioritize response solely by the number of failed attempts.", "sources": [ { "name": "Huntress一次研究", "url": "https://www.huntress.com/blog/token-replay-spray" } ], "certainty": "prior-scope" }, { "id": "gheist-github-tokens", "title": "Gheist: exfiltration of secrets through GitHub logs", "kind": "scope-complement", "time": "Primary research published 10/26 02:55:33 JST. Observed since 9/15", "date": "2026-10-26", "body": "Wiz reports more than 850 accounts and over 13,500 suspicious branches involving stolen tokens. Workflows print secrets to logs, which are retrieved through the GitHub API before the runs are deleted. The public runs examined were blocked by approval holds, while execution and subsequent activity were observed in private / Enterprise environments. Branch counts are not counts of affected organizations.", "action": "Check for ci-sync- branches, sync-check workflows, runs deleted shortly after creation, and cloud-side role assumption. In repositories where execution occurred, revoke and replace tokens and accessible secrets, and investigate self-hosted runners and permissions. Do not approve pending suspicious workflows.", "sources": [ { "name": "Wiz一次研究", "url": "https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles" }, { "name": "GitHubの承認hold案内", "url": "https://github.blog/changelog/2026-07-28-github-actions-holds-potentially-malicious-workflows-for-approval/" } ], "certainty": "prior-scope" }, { "id": "ucreator-android", "title": "uCreator: research into surveillance capabilities through modified APKs and containers", "kind": "scope-complement", "time": "Primary research published 10/21 23:57:50 JST", "date": "2026-10-21", "body": "The research analyzes modified APKs for Telegram, WeChat, and other apps, and hooks inside Onion Box containers. It demonstrates capabilities to obtain 2FA information, sessions, and similar data, but a reliable victim count remains undetermined. It does not prove that the entire chain worked on Android17 or that OS updates alone can prevent every case.", "action": "Check distribution sources, signatures, and app provenance. If suspicious modified versions are present, investigate sessions and authentication methods from a safe device. Do not confirm infection solely from residual LSPatch files or add the previous year's infection counts to this case.", "sources": [ { "name": "研究者Oviの一次分析", "url": "https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/" }, { "name": "前年のDoctor Web原報告・件数は別", "url": "https://news.drweb.com/show/?i=15076" } ], "certainty": "prior-scope" }, { "id": "neat-rollout-recheck", "title": "Neat: confirm deployment completion separately for devices and the cloud", "kind": "scope-complement", "time": "18:10:22 JST (Summary edit in the official advisory)", "date": "2026-10-26", "body": "This update removes the advisory's old statement that firmware was being prepared. NeatOS26.5.4 remains in staged rollout, Pulse deployment varies by organization, and non-Pulse OTA is targeted for 10/28. The cloud-side fix is separate and expected to take about 2 weeks; this wording update does not prove completion of all deployments.", "action": "Check the Pulse Roadmap and actual device versions, and distinguish any necessary webhook credential rotation from confirmation that the cloud fix is complete. Do not infer that all devices are fixed from dates or advisory edits alone.", "sources": [ { "name": "公式セキュリティ勧告", "url": "https://support.neat.no/article/security-advisory-october-2026-compromised-emudhra-intermediate-ca-certificates-affecting-neat-devices-and-cloud-services/" }, { "name": "26.5.4配信案内", "url": "https://support.neat.no/article/neat-devices-version-26-5-4/" } ], "certainty": "prior-scope" }, { "id": "icewarp-after-cutoff", "title": "Reference: the retrieved IceWarp version was revised after the cutoff", "kind": "reference-only", "time": "Edited 21:39:58 / updated 21:40:23 JST (after the 21:35 cutoff)", "date": "2026-10-26", "body": "The article was created on 10/21, but the official API records a revision after the cutoff. Do not backdate the retrieved list of bundled PHP patches or future-release statements as confirmed content available before 21:35. Do not independently reconcile body text such as 14.3.0.14 and download names such as 14.3.0.15 into an earliest fixed version.", "action": "Users can consult current official guidance for their release branch and OS, but this article does not include version numbers retrieved later in the confirmed changes. Do not treat partial mitigation for older branches as a complete fix.", "sources": [ { "name": "公式記事の取得版", "url": "https://support.icewarp.com/hc/en-us/articles/52154202993041-Patch-and-mitigation-of-PHP-Vulnerabilities-CVE-2026-109618-CVE-2026-109619-and-CVE-2026-115560" }, { "name": "改訂時刻・公式Zendesk API", "url": "https://support.icewarp.com/api/v2/help_center/en-us/articles/52154202993041.json" } ], "certainty": "timestamp-unconfirmed" }, { "id": "kawanishi-restoration-reference", "title": "Reference: Kawanishi Town's restoration notice does not establish the exact restoration time", "kind": "reference-only", "time": "Dated 10/26. HTTP Last-Modified 16:00:20 JST; restoration and publication times remain undetermined", "date": "2026-10-26", "body": "The current page states that inquiries, FAQs, evacuation shelter management, waste sorting searches, and other functions suspended for the PHP response have been restored, and that compromise or disclosure has not been confirmed. The server resource update time is not treated as the actual restoration or initial publication time; this is retained as reference information because the state at the relevant time cannot be fully reconstructed.", "action": "Check the official status of the functions you use. Do not treat a precautionary suspension as confirmed compromise or generalize this town's notice to restoration across all municipalities.", "sources": [ { "name": "川西町公式案内", "url": "https://www.town.nara-kawanishi.lg.jp/0000009056.html" } ], "certainty": "timestamp-unconfirmed" } ], "additional_nvd_ids_not_individually_featured": [ "CVE-2026-111974", "CVE-2026-116224", "CVE-2026-116227", "CVE-2026-110376", "CVE-2026-111841", "CVE-2026-115425", "CVE-2026-103377", "CVE-2026-110377", "CVE-2026-112865", "CVE-2026-114709", "CVE-2026-115602", "CVE-2026-115613", "CVE-2026-115614", "CVE-2026-115949", "CVE-2026-115958", "CVE-2026-116253", "CVE-2026-116254", "CVE-2026-116255", "CVE-2026-4316", "CVE-2026-97254", "CVE-2026-97255", "CVE-2026-97295", "CVE-2026-114707", "CVE-2026-114708", "CVE-2026-115594", "CVE-2026-115595", "CVE-2026-115950", "CVE-2026-115951", "CVE-2026-115953", "CVE-2026-115954", "CVE-2026-115955", "CVE-2026-115956", "CVE-2026-115959", "CVE-2026-115960", "CVE-2026-115961", "CVE-2026-116256", "CVE-2026-116257" ], "rejected_nvd_ids": [ "CVE-2012-20006" ], "report": { "path": "update-20261026-2135.html", "title": "10/26, 21:35 — Reviewing incidents, vulnerabilities, and response measures", "headline": "Start tonight's checks with what you use.", "intro": "We reviewed account protection, malicious packages, application authentication and permissions, and updates on services in Japan. The 37 topics are organized to help you find necessary measures and primary sources.", "window_jst": "14:56〜21:35 JST", "cutoff_jst_label": "2026-10-26 21:35 JST / 12:35 UTC", "retrieved_jst": "21:37 JST以降", "previous": "update-20261026-1456.html", "previous_label": "14:56の調査記録", "motion_path": "./?lang=ja#56", "motion_label": "今夜のアカウント・パッケージ対応を2画面で →", "quick": [ { "title": "For GMO users", "text": "The 6th report at 21 advises checking linked services such as email and Google, as well as browser sync, in addition to disconnecting all sessions. Proceed from another trusted device.", "href": "#gmo-sixth", "label": "Official guidance and scope of checks" }, { "title": "For those managing development and build environments", "text": "Check the affected npm and PyPI packages and versions. If malicious versions have run, review environment isolation, revocation of keys they could access, and whether rebuilding is necessary.", "href": "#npm-worca", "label": "Package-specific conditions and measures" }, { "title": "For administrators of applications and public-facing services", "text": "Review Japanese PHP/Brotli alerts and the conditions affecting Frappe, MISP, SAML, NocoDB, and others. Camel may require configuration even after updating.", "href": "#jpcert-php-brotli", "label": "Japanese alerts and distributor guidance" }, { "title": "For users of delivery and booking services", "text": "Blastmail's notice covers 345 contracts, and the resumption time remains undetermined. Even if someone knows your hotel booking details, verify payment links through official support channels.", "href": "#blastmail-345", "label": "Updates on services in Japan" } ] } } }