[{"id":"EUVD-2026-118028","enisaUuid":"a94da31d-d920-3553-8c2a-96b401394cf0","description":"SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.","datePublished":"Nov 6, 2026, 9:30:48 AM","dateUpdated":"Nov 10, 2026, 5:45:11 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-atmiras-sirec\n","aliases":"CVE-2026-123087\nGHSA-x2hr-mpw9-c694\n","assigner":"INCIBE","epss":0.25,"enisaIdVendor":[{"id":"4a1a20fb-66b5-3c7c-b171-152fcbd0e0b6","vendor":{"name":"Atmira"}}]},{"id":"EUVD-2026-118025","enisaUuid":"3d598bb1-a5d9-3a88-bead-bdf45496583d","description":"In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification\u0027s payload template. Each placeholder\u0027s format specifier was passed unchanged to Python\u0027s string formatting, which builds the padded result before its size can be checked. A template of a few dozen bytes, such as {\"text\": \"{title:\u003e999999999}\"}, therefore produced a string of about 1 GB when the notification form test-rendered it on save, and repeating such fields multiplied the cost. Templates that passed the save check could also repeat placeholders such as {text} thousands of times; the notification daemon rebuilt those on every webhook delivery. Deeply nested templates raised an unhandled recursion error (HTTP 500). An attacker needs only an account, which the default configuration lets anyone create after e-mail confirmation. They could exhaust the memory of web workers or the notification daemon, causing a denial of service. Version 6.4.1 caps every number in a format specifier at 256, limits a rendered template to 1,000,000 characters both on save and at delivery, and rejects templates nested deeper than 32 levels.","datePublished":"Nov 6, 2026, 8:58:24 AM","dateUpdated":"Nov 10, 2026, 5:40:09 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/vulnerability-lookup/vulnerability-lookup/commit/2076ffdae3d024649114eeb6fd185338d4bb1f40\n","aliases":"GHSA-fjqr-7p2w-j9wx\nCVE-2026-123660\n","assigner":"CIRCL","epss":0.29,"enisaIdVendor":[{"id":"3d373f74-fd7b-398f-a472-ef08602328e0","vendor":{"name":"vulnerability-lookup"}}]},{"id":"EUVD-2026-117820","enisaUuid":"e98ae1ec-8be2-3b88-b472-dd0ce2bc358d","description":"Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim\u0027s traffic could read and modify communications, including credentials and personal data.","datePublished":"Nov 5, 2026, 9:58:02 PM","dateUpdated":"Nov 10, 2026, 5:02:02 PM","baseScore":9.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint\n","aliases":"GHSA-j2mc-9j97-fjf4\nCVE-2026-111494\n","assigner":"INCIBE","epss":0.16,"enisaIdVendor":[{"id":"958bd78f-ba22-3db2-a87f-69e634bdd40a","vendor":{"name":"TPC Software"}}]},{"id":"EUVD-2026-121039","enisaUuid":"dbf63a9d-dc1b-367b-8637-2ddf46a12024","description":"The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type \u0027link\u0027 or \u0027url\u0027 submits an attribute value, the module passes the URL directly to its internal archiving function without any validation of the target address. An attacker can therefore craft a URL pointing to loopback addresses (e.g., 127.0.0.1), private network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254). The MISP server will issue an HTTP request to that target and store the response body in the event, effectively exfiltrating data from internal services to the attacker through the MISP interface. Non-HTTP schemes such as file:// are also accepted, potentially allowing local file disclosure. The vulnerability requires an authenticated MISP user with the ability to create or edit attributes of the affected types. The security impact is information disclosure from internal services reachable by the MISP server, including sensitive data such as cloud credentials, internal application data, or local files.","datePublished":"Nov 10, 2026, 12:57:57 PM","dateUpdated":"Nov 10, 2026, 3:45:50 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/MISP/misp-modules/commit/7cb31e96a1f59bec9afbc087b27b26d9986c6841\n","aliases":"GHSA-vmhf-j68f-c7h8\nCVE-2026-125871\n","assigner":"CIRCL","epss":0.0,"enisaIdVendor":[{"id":"7a6b1951-19bc-379b-b610-e85367335f20","vendor":{"name":"MISP"}}]}]