{ "append_only": true, "archive_index_url": "https://vuln.signal-radar.com/data/vuln/archive/index.json", "archive_version": "v0.1", "generated_at": "2026-08-11T22:18:06.707962+00:00", "immutable_run": true, "item_count": 20, "items": [ { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-18814/", "current_public_safe_latest": true, "cvss_score": 7.3, "cvss_severity": "HIGH", "epss_percentile": 0.84563, "epss_score": 0.02705, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-18814", "impact_tags": [ "command injection risk" ], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-18814.json", "product": null, "public_safe_summary": "NVD: A vulnerability was found in H3C NX15 V100R017. NVD: This impacts the function reload.reload_config of the file /api/esps. NVD: The manipulation results in command injection.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-18814.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes command injection risk. Possible impact: An attacker may be able to run unintended system commands through the affected component.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: A vulnerability was found in H3C NX15 V100R017. NVD: This impacts the function reload.reload_config of the file /api/esps. NVD: The manipulation results in command injection.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-18814/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-18816/", "current_public_safe_latest": true, "cvss_score": 2.3, "cvss_severity": "LOW", "epss_percentile": 0.26628, "epss_score": 0.00339, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-18816", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-18816.json", "product": null, "public_safe_summary": "NVD: A vulnerability was identified in Baserow up to 2.3.2. NVD: Affected by this vulnerability is the function verify of the file backend/src/baserow/api/two_factor_auth/views.py of the component 2FA Verify Endpoint. NVD: Such manipulation leads to improper authentication.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-18816.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review.", "source_published_remediation": "Patch confirmed by source text; fixed version context: of.", "source_published_summary": "NVD: A vulnerability was identified in Baserow up to 2.3.2. NVD: Affected by this vulnerability is the function verify of the file backend/src/baserow/api/two_factor_auth/views.py of the component 2FA Verify Endpoint. NVD: Such manipulation leads to improper authentication.", "sources": [ "NVD", "OSV", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-18816/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-18817/", "current_public_safe_latest": true, "cvss_score": 2.1, "cvss_severity": "LOW", "epss_percentile": 0.10429, "epss_score": 0.00203, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-18817", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-18817.json", "product": null, "public_safe_summary": "NVD: A security flaw has been discovered in Baserow up to 2.3.2. NVD: Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. NVD: Performing a manipulation results in improper authorization.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-18817.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: A security flaw has been discovered in Baserow up to 2.3.2. NVD: Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. NVD: Performing a manipulation results in improper authorization.", "sources": [ "NVD", "OSV", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-18817/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-45084/", "current_public_safe_latest": true, "cvss_score": 8.7, "cvss_severity": "HIGH", "epss_percentile": 0.37984, "epss_score": 0.00464, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-45084", "impact_tags": [ "service availability review", "remote exposure relevant" ], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-45084.json", "product": null, "public_safe_summary": "NVD: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. NVD: Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. NVD: When the presence module's handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while the configuration option enable_sphere_check=1 is set, it invokes the get_content_type() macro without first calling...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-45084.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes service availability risk · remote exposure. Possible impact: The affected service may become unavailable or unreliable.", "source_published_remediation": "Patch confirmed by source text; fixed version context: version.", "source_published_summary": "NVD: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. NVD: Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence module. NVD: When the presence module's handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while the configuration option enable_sphere_check=1 is set, it invokes the get_content_type() macro without first calling...", "sources": [ "NVD", "OSV", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-45084/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-45100/", "current_public_safe_latest": true, "cvss_score": 9.1, "cvss_severity": "CRITICAL", "epss_percentile": 0.44943, "epss_score": 0.00587, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-45100", "impact_tags": [ "memory safety review", "remote exposure relevant" ], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-45100.json", "product": null, "public_safe_summary": "NVD: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. NVD: Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. NVD: The size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third, so an input between about 49,153 and 65,535 bytes produces more output than the buffer can hold...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-45100.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes memory safety review · remote exposure. Possible impact: The affected component has memory-safety risk that may lead to crash, privilege, or code-execution impact depending on exposure.", "source_published_remediation": "Patch confirmed by source text; fixed version context: versions.", "source_published_summary": "NVD: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. NVD: Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. NVD: The size check for {s.b64encode} only verifies that the input fits within the 64 KB transformation buffer, but base64 encoding expands the data by roughly a third, so an input between about 49,153 and 65,535 bytes produces more output than the buffer can hold...", "sources": [ "NVD", "OSV", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-45100/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-45103/", "current_public_safe_latest": true, "cvss_score": 7.5, "cvss_severity": "HIGH", "epss_percentile": 0.25394, "epss_score": 0.00328, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-45103", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-45103.json", "product": null, "public_safe_summary": "NVD: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. NVD: In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. NVD: When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the framing layer computes a wrapped-around value (e.g., 0) and splits the TCP stream at the wrong boundary, causing the body of the first SIP message to be...", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-45103.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review.", "source_published_remediation": "Patch confirmed by source text; fixed version context: versions.", "source_published_summary": "NVD: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. NVD: In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. NVD: When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the framing layer computes a wrapped-around value (e.g., 0) and splits the TCP stream at the wrong boundary, causing the body of the first SIP message to be...", "sources": [ "NVD", "OSV", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-45103/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-51144/", "current_public_safe_latest": true, "cvss_score": 6.1, "cvss_severity": "MEDIUM", "epss_percentile": 0.11924, "epss_score": 0.00214, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-51144", "impact_tags": [ "code execution review", "XSS risk", "remote exposure relevant" ], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-51144.json", "product": null, "public_safe_summary": "NVD: Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-51144.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes code execution review · XSS risk · remote exposure. Possible impact: A remote attacker may be able to run code or commands on affected systems.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-51144/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-52370/", "current_public_safe_latest": true, "cvss_score": 6.1, "cvss_severity": "MEDIUM", "epss_percentile": 0.0875, "epss_score": 0.00189, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-52370", "impact_tags": [ "XSS risk" ], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-52370.json", "product": null, "public_safe_summary": "NVD: A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-52370.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes XSS risk. Possible impact: This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-52370/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-67855/", "current_public_safe_latest": true, "cvss_score": 7.5, "cvss_severity": "HIGH", "epss_percentile": 0.21317, "epss_score": 0.0029, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-67855", "impact_tags": [ "service availability review", "memory safety review", "remote exposure relevant" ], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-67855.json", "product": null, "public_safe_summary": "NVD: open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. NVD: This allows a remote attacker to cause a denial of service.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-67855.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes service availability risk · memory safety review · remote exposure. Possible impact: The affected service may become unavailable or unreliable.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. NVD: This allows a remote attacker to cause a denial of service.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-67855/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-67856/", "current_public_safe_latest": true, "cvss_score": 7.5, "cvss_severity": "HIGH", "epss_percentile": 0.34925, "epss_score": 0.00422, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-67856", "impact_tags": [ "service availability review", "remote exposure relevant" ], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-67856.json", "product": null, "public_safe_summary": "NVD: An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItems(Sampling), Publish, TransferSubscriptions, and DeleteSubscriptions requests", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-67856.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes service availability risk · remote exposure. Possible impact: The affected service may become unavailable or unreliable.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItems(Sampling), Publish, TransferSubscriptions, and DeleteSubscriptions requests", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-67856/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-67857/", "current_public_safe_latest": true, "cvss_score": 7.5, "cvss_severity": "HIGH", "epss_percentile": 0.27826, "epss_score": 0.0035, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-67857", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-67857.json", "product": null, "public_safe_summary": "NVD: open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/client/ua_client_connect.c.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-67857.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/client/ua_client_connect.c.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-67857/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-67858/", "current_public_safe_latest": true, "cvss_score": 7.5, "cvss_severity": "HIGH", "epss_percentile": 0.39453, "epss_score": 0.00487, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-67858", "impact_tags": [ "service availability review", "memory safety review", "remote exposure relevant" ], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-67858.json", "product": null, "public_safe_summary": "NVD: Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled through the MDNSD backend. NVD: An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. NVD: This allows remote attackers to cause a denial of service.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-67858.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes service availability risk · memory safety review · remote exposure. Possible impact: The affected service may become unavailable or unreliable.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled through the MDNSD backend. NVD: An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. NVD: This allows remote attackers to cause a denial of service.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-67858/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-67859/", "current_public_safe_latest": true, "cvss_score": 7.5, "cvss_severity": "HIGH", "epss_percentile": 0.38099, "epss_score": 0.00466, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-67859", "impact_tags": [ "service availability review", "memory safety review", "remote exposure relevant" ], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-67859.json", "product": null, "public_safe_summary": "NVD: Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Discovery/LDS handling.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-67859.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes service availability risk · memory safety review · remote exposure. Possible impact: The affected service may become unavailable or unreliable.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Discovery/LDS handling.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-67859/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-67860/", "current_public_safe_latest": true, "cvss_score": 7.5, "cvss_severity": "HIGH", "epss_percentile": 0.18692, "epss_score": 0.00267, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-67860", "impact_tags": [ "memory safety review" ], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-67860.json", "product": null, "public_safe_summary": "NVD: open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-67860.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes memory safety review. Possible impact: The affected component has memory-safety risk that may lead to crash, privilege, or code-execution impact depending on exposure.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-67860/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-67861/", "current_public_safe_latest": true, "cvss_score": 7.5, "cvss_severity": "HIGH", "epss_percentile": 0.34511, "epss_score": 0.00417, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-67861", "impact_tags": [ "service availability review", "remote exposure relevant" ], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-67861.json", "product": null, "public_safe_summary": "NVD: An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA_Client_getRemoteDataTypes component", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-67861.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes service availability risk · remote exposure. Possible impact: The affected service may become unavailable or unreliable.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA_Client_getRemoteDataTypes component", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-67861/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-67862/", "current_public_safe_latest": true, "cvss_score": 7.5, "cvss_severity": "HIGH", "epss_percentile": 0.25865, "epss_score": 0.00332, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-67862", "impact_tags": [ "service availability review", "remote exposure relevant" ], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-67862.json", "product": null, "public_safe_summary": "NVD: open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_highlevel.c. NVD: This allows a remote attacker to cause a denial of service.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-67862.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes service availability risk · remote exposure. Possible impact: The affected service may become unavailable or unreliable.", "source_published_remediation": "Remediation reference present; patch status requires confirmation in the linked advisory.", "source_published_summary": "NVD: open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_highlevel.c. NVD: This allows a remote attacker to cause a denial of service.", "sources": [ "NVD", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-67862/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-70589/", "current_public_safe_latest": true, "cvss_score": 4.8, "cvss_severity": "MEDIUM", "epss_percentile": 0.06787, "epss_score": 0.00171, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-70589", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-70589.json", "product": null, "public_safe_summary": "NVD: Ghost is a Node.js content management system. NVD: From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. NVD: This issue is fixed in version 6.54.1.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-70589.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review.", "source_published_remediation": "Patch confirmed by source text; fixed version context: version.", "source_published_summary": "NVD: Ghost is a Node.js content management system. NVD: From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. NVD: This issue is fixed in version 6.54.1.", "sources": [ "NVD", "OSV", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-70589/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-70590/", "current_public_safe_latest": true, "cvss_score": 4.8, "cvss_severity": "MEDIUM", "epss_percentile": 0.09396, "epss_score": 0.00195, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-70590", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-70590.json", "product": null, "public_safe_summary": "NVD: Ghost is a Node.js content management system. NVD: Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. NVD: An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-70590.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review.", "source_published_remediation": "Patch confirmed by source text; fixed version context: version.", "source_published_summary": "NVD: Ghost is a Node.js content management system. NVD: Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. NVD: An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password.", "sources": [ "NVD", "OSV", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-70590/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-70591/", "current_public_safe_latest": true, "cvss_score": 4.1, "cvss_severity": "MEDIUM", "epss_percentile": 0.13395, "epss_score": 0.00226, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-70591", "impact_tags": [], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-70591.json", "product": null, "public_safe_summary": "NVD: Ghost is a Node.js content management system. NVD: From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. NVD: No output was returned, but this could have been used to probe open ports on internal hosts.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-70591.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review.", "source_published_remediation": "Patch confirmed by source text; fixed version context: version.", "source_published_summary": "NVD: Ghost is a Node.js content management system. NVD: From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. NVD: No output was returned, but this could have been used to probe open ports on internal hosts.", "sources": [ "NVD", "OSV", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-70591/timeline.json", "vendor": null }, { "affected_label": "-", "canonical_url": "https://vuln.signal-radar.com/vuln/public-candidate/CVE-2026-70592/", "current_public_safe_latest": true, "cvss_score": 5.5, "cvss_severity": "MEDIUM", "epss_percentile": 0.22179, "epss_score": 0.00298, "first_observed_at": "2026-08-11T22:08:35.096641+00:00", "id": "CVE-2026-70592", "impact_tags": [ "path traversal review" ], "kev": false, "last_observed_at": "2026-08-11T22:08:35.096641+00:00", "latest_item_url": "https://vuln.signal-radar.com/data/vuln/items/CVE-2026-70592.json", "product": null, "public_safe_summary": "NVD: Ghost is a Node.js content management system. NVD: From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. NVD: The database export endpoint failed to reject path separators in the caller-supplied filename.", "run_item_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/items/CVE-2026-70592.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "snapshot_count": 1, "source_published_affected": "Affected product or version requires source confirmation.", "source_published_impact": "Source describes path traversal review. Possible impact: An attacker may be able to reach files outside the intended application path.", "source_published_remediation": "Patch confirmed by source text; fixed version context: version.", "source_published_summary": "NVD: Ghost is a Node.js content management system. NVD: From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. NVD: The database export endpoint failed to reject path separators in the caller-supplied filename.", "sources": [ "NVD", "OSV", "Vendor Advisory" ], "timeline_url": "https://vuln.signal-radar.com/data/vuln/archive/cves/CVE-2026-70592/timeline.json", "vendor": null } ], "public_safe_only": true, "radar": "vuln", "run_id": "20260811T221806Z", "run_index_url": "https://vuln.signal-radar.com/data/vuln/archive/runs/20260811T221806Z/index.json", "safety": { "auto_remediation_allowed": false, "exploit_detail_allowed": false, "external_execution_allowed": false, "github_issue_creation_allowed": false, "indexing_allowed": true, "noindex_removal_allowed": true, "noindex_required": false, "patch_allowed": false, "public_launch_allowed": true, "public_safe_only": true, "raw_source_included": false, "read_only": true, "scan_allowed": false, "search_console_registered": true, "signal_radar_integration_allowed": false }, "schema_version": "v0.1" }