@blamejs/exceptd-skills 0.13.77 → 0.13.79
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/data/_indexes/_meta.json +8 -8
- package/data/_indexes/activity-feed.json +2 -2
- package/data/_indexes/catalog-summaries.json +2 -2
- package/data/_indexes/chains.json +2276 -0
- package/data/attack-techniques.json +8 -0
- package/data/cve-catalog.json +603 -1
- package/data/cwe-catalog.json +6 -0
- package/data/framework-control-gaps.json +52 -3
- package/data/zeroday-lessons.json +300 -0
- package/manifest.json +44 -44
- package/package.json +2 -2
- package/sbom.cdx.json +23 -23
|
@@ -20485,6 +20485,2146 @@
|
|
|
20485
20485
|
]
|
|
20486
20486
|
}
|
|
20487
20487
|
},
|
|
20488
|
+
"CVE-2025-23254": {
|
|
20489
|
+
"name": "NVIDIA TensorRT-LLM Python Executor Deserialization RCE (ShadowMQ)",
|
|
20490
|
+
"rwep": 29,
|
|
20491
|
+
"cvss": 8.8,
|
|
20492
|
+
"cisa_kev": false,
|
|
20493
|
+
"epss_score": null,
|
|
20494
|
+
"referencing_skills": [
|
|
20495
|
+
"kernel-lpe-triage",
|
|
20496
|
+
"ai-attack-surface",
|
|
20497
|
+
"compliance-theater",
|
|
20498
|
+
"attack-surface-pentest",
|
|
20499
|
+
"ot-ics-security",
|
|
20500
|
+
"coordinated-vuln-disclosure",
|
|
20501
|
+
"sector-energy"
|
|
20502
|
+
],
|
|
20503
|
+
"chain": {
|
|
20504
|
+
"cwes": [
|
|
20505
|
+
{
|
|
20506
|
+
"id": "CWE-1037",
|
|
20507
|
+
"name": "Processor Optimization Removal or Modification of Security-critical Code",
|
|
20508
|
+
"category": "Hardware / Side Channel"
|
|
20509
|
+
},
|
|
20510
|
+
{
|
|
20511
|
+
"id": "CWE-1039",
|
|
20512
|
+
"name": "Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations",
|
|
20513
|
+
"category": "AI/ML"
|
|
20514
|
+
},
|
|
20515
|
+
{
|
|
20516
|
+
"id": "CWE-125",
|
|
20517
|
+
"name": "Out-of-bounds Read",
|
|
20518
|
+
"category": "Memory Safety"
|
|
20519
|
+
},
|
|
20520
|
+
{
|
|
20521
|
+
"id": "CWE-1357",
|
|
20522
|
+
"name": "Reliance on Insufficiently Trustworthy Component",
|
|
20523
|
+
"category": "Supply Chain"
|
|
20524
|
+
},
|
|
20525
|
+
{
|
|
20526
|
+
"id": "CWE-1395",
|
|
20527
|
+
"name": "Dependency on Vulnerable Third-Party Component",
|
|
20528
|
+
"category": "Supply Chain"
|
|
20529
|
+
},
|
|
20530
|
+
{
|
|
20531
|
+
"id": "CWE-1426",
|
|
20532
|
+
"name": "Improper Validation of Generative AI Output",
|
|
20533
|
+
"category": "AI/ML"
|
|
20534
|
+
},
|
|
20535
|
+
{
|
|
20536
|
+
"id": "CWE-22",
|
|
20537
|
+
"name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)",
|
|
20538
|
+
"category": "Path/Resource"
|
|
20539
|
+
},
|
|
20540
|
+
{
|
|
20541
|
+
"id": "CWE-269",
|
|
20542
|
+
"name": "Improper Privilege Management",
|
|
20543
|
+
"category": "Authorization"
|
|
20544
|
+
},
|
|
20545
|
+
{
|
|
20546
|
+
"id": "CWE-287",
|
|
20547
|
+
"name": "Improper Authentication",
|
|
20548
|
+
"category": "Authentication"
|
|
20549
|
+
},
|
|
20550
|
+
{
|
|
20551
|
+
"id": "CWE-306",
|
|
20552
|
+
"name": "Missing Authentication for Critical Function",
|
|
20553
|
+
"category": "Authentication"
|
|
20554
|
+
},
|
|
20555
|
+
{
|
|
20556
|
+
"id": "CWE-352",
|
|
20557
|
+
"name": "Cross-Site Request Forgery (CSRF)",
|
|
20558
|
+
"category": "Session"
|
|
20559
|
+
},
|
|
20560
|
+
{
|
|
20561
|
+
"id": "CWE-362",
|
|
20562
|
+
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
|
|
20563
|
+
"category": "Concurrency"
|
|
20564
|
+
},
|
|
20565
|
+
{
|
|
20566
|
+
"id": "CWE-416",
|
|
20567
|
+
"name": "Use After Free",
|
|
20568
|
+
"category": "Memory Safety"
|
|
20569
|
+
},
|
|
20570
|
+
{
|
|
20571
|
+
"id": "CWE-434",
|
|
20572
|
+
"name": "Unrestricted Upload of File with Dangerous Type",
|
|
20573
|
+
"category": "File Handling"
|
|
20574
|
+
},
|
|
20575
|
+
{
|
|
20576
|
+
"id": "CWE-672",
|
|
20577
|
+
"name": "Operation on a Resource after Expiration or Release",
|
|
20578
|
+
"category": "Memory Safety"
|
|
20579
|
+
},
|
|
20580
|
+
{
|
|
20581
|
+
"id": "CWE-732",
|
|
20582
|
+
"name": "Incorrect Permission Assignment for Critical Resource",
|
|
20583
|
+
"category": "Authorization"
|
|
20584
|
+
},
|
|
20585
|
+
{
|
|
20586
|
+
"id": "CWE-78",
|
|
20587
|
+
"name": "Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
|
|
20588
|
+
"category": "Injection"
|
|
20589
|
+
},
|
|
20590
|
+
{
|
|
20591
|
+
"id": "CWE-787",
|
|
20592
|
+
"name": "Out-of-bounds Write",
|
|
20593
|
+
"category": "Memory Safety"
|
|
20594
|
+
},
|
|
20595
|
+
{
|
|
20596
|
+
"id": "CWE-79",
|
|
20597
|
+
"name": "Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)",
|
|
20598
|
+
"category": "Injection"
|
|
20599
|
+
},
|
|
20600
|
+
{
|
|
20601
|
+
"id": "CWE-798",
|
|
20602
|
+
"name": "Use of Hard-coded Credentials",
|
|
20603
|
+
"category": "Credentials"
|
|
20604
|
+
},
|
|
20605
|
+
{
|
|
20606
|
+
"id": "CWE-89",
|
|
20607
|
+
"name": "Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
|
|
20608
|
+
"category": "Injection"
|
|
20609
|
+
},
|
|
20610
|
+
{
|
|
20611
|
+
"id": "CWE-918",
|
|
20612
|
+
"name": "Server-Side Request Forgery (SSRF)",
|
|
20613
|
+
"category": "Network"
|
|
20614
|
+
},
|
|
20615
|
+
{
|
|
20616
|
+
"id": "CWE-94",
|
|
20617
|
+
"name": "Improper Control of Generation of Code (Code Injection)",
|
|
20618
|
+
"category": "Injection"
|
|
20619
|
+
}
|
|
20620
|
+
],
|
|
20621
|
+
"atlas": [
|
|
20622
|
+
{
|
|
20623
|
+
"id": "AML.T0010",
|
|
20624
|
+
"name": "ML Supply Chain Compromise",
|
|
20625
|
+
"tactic": "Initial Access"
|
|
20626
|
+
},
|
|
20627
|
+
{
|
|
20628
|
+
"id": "AML.T0016",
|
|
20629
|
+
"name": "Obtain Capabilities: Develop Capabilities",
|
|
20630
|
+
"tactic": "Resource Development"
|
|
20631
|
+
},
|
|
20632
|
+
{
|
|
20633
|
+
"id": "AML.T0017",
|
|
20634
|
+
"name": "Discover ML Model Ontology",
|
|
20635
|
+
"tactic": "Discovery"
|
|
20636
|
+
},
|
|
20637
|
+
{
|
|
20638
|
+
"id": "AML.T0018",
|
|
20639
|
+
"name": "Backdoor ML Model",
|
|
20640
|
+
"tactic": "Persistence"
|
|
20641
|
+
},
|
|
20642
|
+
{
|
|
20643
|
+
"id": "AML.T0020",
|
|
20644
|
+
"name": "Poison Training Data",
|
|
20645
|
+
"tactic": "ML Attack Staging"
|
|
20646
|
+
},
|
|
20647
|
+
{
|
|
20648
|
+
"id": "AML.T0043",
|
|
20649
|
+
"name": "Craft Adversarial Data",
|
|
20650
|
+
"tactic": "ML Attack Staging"
|
|
20651
|
+
},
|
|
20652
|
+
{
|
|
20653
|
+
"id": "AML.T0051",
|
|
20654
|
+
"name": "LLM Prompt Injection",
|
|
20655
|
+
"tactic": "Execution"
|
|
20656
|
+
},
|
|
20657
|
+
{
|
|
20658
|
+
"id": "AML.T0054",
|
|
20659
|
+
"name": "LLM Jailbreak",
|
|
20660
|
+
"tactic": "Defense Evasion"
|
|
20661
|
+
},
|
|
20662
|
+
{
|
|
20663
|
+
"id": "AML.T0096",
|
|
20664
|
+
"name": "AI API as Covert C2 Channel",
|
|
20665
|
+
"tactic": "Command and Control"
|
|
20666
|
+
}
|
|
20667
|
+
],
|
|
20668
|
+
"d3fend": [
|
|
20669
|
+
{
|
|
20670
|
+
"id": "D3-ASLR",
|
|
20671
|
+
"name": "Address Space Layout Randomization",
|
|
20672
|
+
"tactic": "Harden"
|
|
20673
|
+
},
|
|
20674
|
+
{
|
|
20675
|
+
"id": "D3-CSPP",
|
|
20676
|
+
"name": "Client-server Payload Profiling",
|
|
20677
|
+
"tactic": "Detect"
|
|
20678
|
+
},
|
|
20679
|
+
{
|
|
20680
|
+
"id": "D3-EAL",
|
|
20681
|
+
"name": "Executable Allowlisting",
|
|
20682
|
+
"tactic": "Harden"
|
|
20683
|
+
},
|
|
20684
|
+
{
|
|
20685
|
+
"id": "D3-IOPR",
|
|
20686
|
+
"name": "Input/Output Profiling Resource",
|
|
20687
|
+
"tactic": "Detect"
|
|
20688
|
+
},
|
|
20689
|
+
{
|
|
20690
|
+
"id": "D3-NTA",
|
|
20691
|
+
"name": "Network Traffic Analysis",
|
|
20692
|
+
"tactic": "Detect"
|
|
20693
|
+
},
|
|
20694
|
+
{
|
|
20695
|
+
"id": "D3-PHRA",
|
|
20696
|
+
"name": "Process Hardware Resource Access",
|
|
20697
|
+
"tactic": "Isolate"
|
|
20698
|
+
},
|
|
20699
|
+
{
|
|
20700
|
+
"id": "D3-PSEP",
|
|
20701
|
+
"name": "Process Segment Execution Prevention",
|
|
20702
|
+
"tactic": "Harden"
|
|
20703
|
+
}
|
|
20704
|
+
],
|
|
20705
|
+
"framework_gaps": [
|
|
20706
|
+
{
|
|
20707
|
+
"id": "ALL-AI-PIPELINE-INTEGRITY",
|
|
20708
|
+
"framework": "ALL",
|
|
20709
|
+
"control_name": "AI Pipeline Integrity"
|
|
20710
|
+
},
|
|
20711
|
+
{
|
|
20712
|
+
"id": "ALL-PROMPT-INJECTION-ACCESS-CONTROL",
|
|
20713
|
+
"framework": "ALL",
|
|
20714
|
+
"control_name": "Prompt Injection as Access Control Failure"
|
|
20715
|
+
},
|
|
20716
|
+
{
|
|
20717
|
+
"id": "CIS-Controls-v8-Control7",
|
|
20718
|
+
"framework": "CIS Controls v8",
|
|
20719
|
+
"control_name": "Continuous Vulnerability Management"
|
|
20720
|
+
},
|
|
20721
|
+
{
|
|
20722
|
+
"id": "CMMC-2.0-Level-2",
|
|
20723
|
+
"framework": "CMMC 2.0 (Cybersecurity Maturity Model Certification) Level 2",
|
|
20724
|
+
"control_name": "Level 2 — Advanced (110 NIST 800-171 Rev 2 controls)"
|
|
20725
|
+
},
|
|
20726
|
+
{
|
|
20727
|
+
"id": "FedRAMP-Rev5-Moderate",
|
|
20728
|
+
"framework": "FedRAMP Rev 5 Moderate",
|
|
20729
|
+
"control_name": "FedRAMP Moderate baseline (NIST 800-53 Rev 5 tailoring)"
|
|
20730
|
+
},
|
|
20731
|
+
{
|
|
20732
|
+
"id": "IEC-62443-3-3",
|
|
20733
|
+
"framework": "IEC 62443-3-3 (Industrial communication networks — security for IACS)",
|
|
20734
|
+
"control_name": "System security requirements and security levels"
|
|
20735
|
+
},
|
|
20736
|
+
{
|
|
20737
|
+
"id": "ISO-27001-2022-A.8.28",
|
|
20738
|
+
"framework": "ISO/IEC 27001:2022",
|
|
20739
|
+
"control_name": "Secure coding"
|
|
20740
|
+
},
|
|
20741
|
+
{
|
|
20742
|
+
"id": "ISO-27001-2022-A.8.8",
|
|
20743
|
+
"framework": "ISO/IEC 27001:2022",
|
|
20744
|
+
"control_name": "Management of technical vulnerabilities"
|
|
20745
|
+
},
|
|
20746
|
+
{
|
|
20747
|
+
"id": "ISO-IEC-23894-2023-clause-7",
|
|
20748
|
+
"framework": "ISO/IEC 23894:2023 (AI Risk Management Guidance)",
|
|
20749
|
+
"control_name": "AI risk management process"
|
|
20750
|
+
},
|
|
20751
|
+
{
|
|
20752
|
+
"id": "NERC-CIP-007-6-R4",
|
|
20753
|
+
"framework": "NERC CIP-007-6 (BES Cyber System Security Management)",
|
|
20754
|
+
"control_name": "Security event monitoring"
|
|
20755
|
+
},
|
|
20756
|
+
{
|
|
20757
|
+
"id": "NIS2-Art21-patch-management",
|
|
20758
|
+
"framework": "EU NIS2 Directive",
|
|
20759
|
+
"control_name": "Vulnerability handling and disclosure"
|
|
20760
|
+
},
|
|
20761
|
+
{
|
|
20762
|
+
"id": "NIST-800-115",
|
|
20763
|
+
"framework": "NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)",
|
|
20764
|
+
"control_name": "Technical Guide to Information Security Testing and Assessment"
|
|
20765
|
+
},
|
|
20766
|
+
{
|
|
20767
|
+
"id": "NIST-800-218-SSDF",
|
|
20768
|
+
"framework": "NIST SP 800-218 (Secure Software Development Framework v1.1)",
|
|
20769
|
+
"control_name": "Secure Software Development Framework"
|
|
20770
|
+
},
|
|
20771
|
+
{
|
|
20772
|
+
"id": "NIST-800-53-AC-2",
|
|
20773
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
20774
|
+
"control_name": "Account Management"
|
|
20775
|
+
},
|
|
20776
|
+
{
|
|
20777
|
+
"id": "NIST-800-53-SC-8",
|
|
20778
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
20779
|
+
"control_name": "Transmission Confidentiality and Integrity"
|
|
20780
|
+
},
|
|
20781
|
+
{
|
|
20782
|
+
"id": "NIST-800-53-SI-2",
|
|
20783
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
20784
|
+
"control_name": "Flaw Remediation"
|
|
20785
|
+
},
|
|
20786
|
+
{
|
|
20787
|
+
"id": "NIST-800-53-SI-3",
|
|
20788
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
20789
|
+
"control_name": "Malicious Code Protection"
|
|
20790
|
+
},
|
|
20791
|
+
{
|
|
20792
|
+
"id": "NIST-800-82r3",
|
|
20793
|
+
"framework": "NIST SP 800-82 Rev 3 (Guide to OT Security)",
|
|
20794
|
+
"control_name": "Guide to Operational Technology (OT) Security"
|
|
20795
|
+
},
|
|
20796
|
+
{
|
|
20797
|
+
"id": "OWASP-LLM-Top-10-2025-LLM01",
|
|
20798
|
+
"framework": "OWASP Top 10 for LLM Applications 2025",
|
|
20799
|
+
"control_name": "Prompt Injection"
|
|
20800
|
+
},
|
|
20801
|
+
{
|
|
20802
|
+
"id": "OWASP-LLM-Top-10-2025-LLM02",
|
|
20803
|
+
"framework": "OWASP Top 10 for LLM Applications 2025",
|
|
20804
|
+
"control_name": "Sensitive Information Disclosure"
|
|
20805
|
+
},
|
|
20806
|
+
{
|
|
20807
|
+
"id": "OWASP-Pen-Testing-Guide-v5",
|
|
20808
|
+
"framework": "OWASP Web Security Testing Guide v5 (WSTG)",
|
|
20809
|
+
"control_name": "Web application penetration testing methodology"
|
|
20810
|
+
},
|
|
20811
|
+
{
|
|
20812
|
+
"id": "PCI-DSS-4.0-6.3.3",
|
|
20813
|
+
"framework": "PCI DSS 4.0",
|
|
20814
|
+
"control_name": "All system components are protected from known vulnerabilities by installing applicable security patches/updates"
|
|
20815
|
+
},
|
|
20816
|
+
{
|
|
20817
|
+
"id": "PTES-Pre-engagement",
|
|
20818
|
+
"framework": "Penetration Testing Execution Standard (PTES)",
|
|
20819
|
+
"control_name": "Pre-engagement Interactions"
|
|
20820
|
+
},
|
|
20821
|
+
{
|
|
20822
|
+
"id": "SOC2-CC6-logical-access",
|
|
20823
|
+
"framework": "SOC 2 (AICPA Trust Services Criteria)",
|
|
20824
|
+
"control_name": "Logical and Physical Access Controls"
|
|
20825
|
+
},
|
|
20826
|
+
{
|
|
20827
|
+
"id": "SOC2-CC9-vendor-management",
|
|
20828
|
+
"framework": "SOC 2 (AICPA Trust Services Criteria)",
|
|
20829
|
+
"control_name": "Risk Mitigation — Vendor and Business Partner Risk"
|
|
20830
|
+
}
|
|
20831
|
+
],
|
|
20832
|
+
"attack_refs": [
|
|
20833
|
+
"T0855",
|
|
20834
|
+
"T0883",
|
|
20835
|
+
"T1059",
|
|
20836
|
+
"T1068",
|
|
20837
|
+
"T1078",
|
|
20838
|
+
"T1133",
|
|
20839
|
+
"T1190",
|
|
20840
|
+
"T1548.001",
|
|
20841
|
+
"T1566"
|
|
20842
|
+
],
|
|
20843
|
+
"rfc_refs": [
|
|
20844
|
+
"RFC-4301",
|
|
20845
|
+
"RFC-4303",
|
|
20846
|
+
"RFC-7296"
|
|
20847
|
+
]
|
|
20848
|
+
}
|
|
20849
|
+
},
|
|
20850
|
+
"CVE-2025-30165": {
|
|
20851
|
+
"name": "vLLM V0 Engine ZeroMQ Deserialization RCE (ShadowMQ)",
|
|
20852
|
+
"rwep": 46,
|
|
20853
|
+
"cvss": 8,
|
|
20854
|
+
"cisa_kev": false,
|
|
20855
|
+
"epss_score": null,
|
|
20856
|
+
"referencing_skills": [
|
|
20857
|
+
"kernel-lpe-triage",
|
|
20858
|
+
"ai-attack-surface",
|
|
20859
|
+
"compliance-theater",
|
|
20860
|
+
"attack-surface-pentest",
|
|
20861
|
+
"ot-ics-security",
|
|
20862
|
+
"coordinated-vuln-disclosure",
|
|
20863
|
+
"sector-energy"
|
|
20864
|
+
],
|
|
20865
|
+
"chain": {
|
|
20866
|
+
"cwes": [
|
|
20867
|
+
{
|
|
20868
|
+
"id": "CWE-1037",
|
|
20869
|
+
"name": "Processor Optimization Removal or Modification of Security-critical Code",
|
|
20870
|
+
"category": "Hardware / Side Channel"
|
|
20871
|
+
},
|
|
20872
|
+
{
|
|
20873
|
+
"id": "CWE-1039",
|
|
20874
|
+
"name": "Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations",
|
|
20875
|
+
"category": "AI/ML"
|
|
20876
|
+
},
|
|
20877
|
+
{
|
|
20878
|
+
"id": "CWE-125",
|
|
20879
|
+
"name": "Out-of-bounds Read",
|
|
20880
|
+
"category": "Memory Safety"
|
|
20881
|
+
},
|
|
20882
|
+
{
|
|
20883
|
+
"id": "CWE-1357",
|
|
20884
|
+
"name": "Reliance on Insufficiently Trustworthy Component",
|
|
20885
|
+
"category": "Supply Chain"
|
|
20886
|
+
},
|
|
20887
|
+
{
|
|
20888
|
+
"id": "CWE-1395",
|
|
20889
|
+
"name": "Dependency on Vulnerable Third-Party Component",
|
|
20890
|
+
"category": "Supply Chain"
|
|
20891
|
+
},
|
|
20892
|
+
{
|
|
20893
|
+
"id": "CWE-1426",
|
|
20894
|
+
"name": "Improper Validation of Generative AI Output",
|
|
20895
|
+
"category": "AI/ML"
|
|
20896
|
+
},
|
|
20897
|
+
{
|
|
20898
|
+
"id": "CWE-22",
|
|
20899
|
+
"name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)",
|
|
20900
|
+
"category": "Path/Resource"
|
|
20901
|
+
},
|
|
20902
|
+
{
|
|
20903
|
+
"id": "CWE-269",
|
|
20904
|
+
"name": "Improper Privilege Management",
|
|
20905
|
+
"category": "Authorization"
|
|
20906
|
+
},
|
|
20907
|
+
{
|
|
20908
|
+
"id": "CWE-287",
|
|
20909
|
+
"name": "Improper Authentication",
|
|
20910
|
+
"category": "Authentication"
|
|
20911
|
+
},
|
|
20912
|
+
{
|
|
20913
|
+
"id": "CWE-306",
|
|
20914
|
+
"name": "Missing Authentication for Critical Function",
|
|
20915
|
+
"category": "Authentication"
|
|
20916
|
+
},
|
|
20917
|
+
{
|
|
20918
|
+
"id": "CWE-352",
|
|
20919
|
+
"name": "Cross-Site Request Forgery (CSRF)",
|
|
20920
|
+
"category": "Session"
|
|
20921
|
+
},
|
|
20922
|
+
{
|
|
20923
|
+
"id": "CWE-362",
|
|
20924
|
+
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
|
|
20925
|
+
"category": "Concurrency"
|
|
20926
|
+
},
|
|
20927
|
+
{
|
|
20928
|
+
"id": "CWE-416",
|
|
20929
|
+
"name": "Use After Free",
|
|
20930
|
+
"category": "Memory Safety"
|
|
20931
|
+
},
|
|
20932
|
+
{
|
|
20933
|
+
"id": "CWE-434",
|
|
20934
|
+
"name": "Unrestricted Upload of File with Dangerous Type",
|
|
20935
|
+
"category": "File Handling"
|
|
20936
|
+
},
|
|
20937
|
+
{
|
|
20938
|
+
"id": "CWE-672",
|
|
20939
|
+
"name": "Operation on a Resource after Expiration or Release",
|
|
20940
|
+
"category": "Memory Safety"
|
|
20941
|
+
},
|
|
20942
|
+
{
|
|
20943
|
+
"id": "CWE-732",
|
|
20944
|
+
"name": "Incorrect Permission Assignment for Critical Resource",
|
|
20945
|
+
"category": "Authorization"
|
|
20946
|
+
},
|
|
20947
|
+
{
|
|
20948
|
+
"id": "CWE-78",
|
|
20949
|
+
"name": "Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
|
|
20950
|
+
"category": "Injection"
|
|
20951
|
+
},
|
|
20952
|
+
{
|
|
20953
|
+
"id": "CWE-787",
|
|
20954
|
+
"name": "Out-of-bounds Write",
|
|
20955
|
+
"category": "Memory Safety"
|
|
20956
|
+
},
|
|
20957
|
+
{
|
|
20958
|
+
"id": "CWE-79",
|
|
20959
|
+
"name": "Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)",
|
|
20960
|
+
"category": "Injection"
|
|
20961
|
+
},
|
|
20962
|
+
{
|
|
20963
|
+
"id": "CWE-798",
|
|
20964
|
+
"name": "Use of Hard-coded Credentials",
|
|
20965
|
+
"category": "Credentials"
|
|
20966
|
+
},
|
|
20967
|
+
{
|
|
20968
|
+
"id": "CWE-89",
|
|
20969
|
+
"name": "Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
|
|
20970
|
+
"category": "Injection"
|
|
20971
|
+
},
|
|
20972
|
+
{
|
|
20973
|
+
"id": "CWE-918",
|
|
20974
|
+
"name": "Server-Side Request Forgery (SSRF)",
|
|
20975
|
+
"category": "Network"
|
|
20976
|
+
},
|
|
20977
|
+
{
|
|
20978
|
+
"id": "CWE-94",
|
|
20979
|
+
"name": "Improper Control of Generation of Code (Code Injection)",
|
|
20980
|
+
"category": "Injection"
|
|
20981
|
+
}
|
|
20982
|
+
],
|
|
20983
|
+
"atlas": [
|
|
20984
|
+
{
|
|
20985
|
+
"id": "AML.T0010",
|
|
20986
|
+
"name": "ML Supply Chain Compromise",
|
|
20987
|
+
"tactic": "Initial Access"
|
|
20988
|
+
},
|
|
20989
|
+
{
|
|
20990
|
+
"id": "AML.T0016",
|
|
20991
|
+
"name": "Obtain Capabilities: Develop Capabilities",
|
|
20992
|
+
"tactic": "Resource Development"
|
|
20993
|
+
},
|
|
20994
|
+
{
|
|
20995
|
+
"id": "AML.T0017",
|
|
20996
|
+
"name": "Discover ML Model Ontology",
|
|
20997
|
+
"tactic": "Discovery"
|
|
20998
|
+
},
|
|
20999
|
+
{
|
|
21000
|
+
"id": "AML.T0018",
|
|
21001
|
+
"name": "Backdoor ML Model",
|
|
21002
|
+
"tactic": "Persistence"
|
|
21003
|
+
},
|
|
21004
|
+
{
|
|
21005
|
+
"id": "AML.T0020",
|
|
21006
|
+
"name": "Poison Training Data",
|
|
21007
|
+
"tactic": "ML Attack Staging"
|
|
21008
|
+
},
|
|
21009
|
+
{
|
|
21010
|
+
"id": "AML.T0043",
|
|
21011
|
+
"name": "Craft Adversarial Data",
|
|
21012
|
+
"tactic": "ML Attack Staging"
|
|
21013
|
+
},
|
|
21014
|
+
{
|
|
21015
|
+
"id": "AML.T0051",
|
|
21016
|
+
"name": "LLM Prompt Injection",
|
|
21017
|
+
"tactic": "Execution"
|
|
21018
|
+
},
|
|
21019
|
+
{
|
|
21020
|
+
"id": "AML.T0054",
|
|
21021
|
+
"name": "LLM Jailbreak",
|
|
21022
|
+
"tactic": "Defense Evasion"
|
|
21023
|
+
},
|
|
21024
|
+
{
|
|
21025
|
+
"id": "AML.T0096",
|
|
21026
|
+
"name": "AI API as Covert C2 Channel",
|
|
21027
|
+
"tactic": "Command and Control"
|
|
21028
|
+
}
|
|
21029
|
+
],
|
|
21030
|
+
"d3fend": [
|
|
21031
|
+
{
|
|
21032
|
+
"id": "D3-ASLR",
|
|
21033
|
+
"name": "Address Space Layout Randomization",
|
|
21034
|
+
"tactic": "Harden"
|
|
21035
|
+
},
|
|
21036
|
+
{
|
|
21037
|
+
"id": "D3-CSPP",
|
|
21038
|
+
"name": "Client-server Payload Profiling",
|
|
21039
|
+
"tactic": "Detect"
|
|
21040
|
+
},
|
|
21041
|
+
{
|
|
21042
|
+
"id": "D3-EAL",
|
|
21043
|
+
"name": "Executable Allowlisting",
|
|
21044
|
+
"tactic": "Harden"
|
|
21045
|
+
},
|
|
21046
|
+
{
|
|
21047
|
+
"id": "D3-IOPR",
|
|
21048
|
+
"name": "Input/Output Profiling Resource",
|
|
21049
|
+
"tactic": "Detect"
|
|
21050
|
+
},
|
|
21051
|
+
{
|
|
21052
|
+
"id": "D3-NTA",
|
|
21053
|
+
"name": "Network Traffic Analysis",
|
|
21054
|
+
"tactic": "Detect"
|
|
21055
|
+
},
|
|
21056
|
+
{
|
|
21057
|
+
"id": "D3-PHRA",
|
|
21058
|
+
"name": "Process Hardware Resource Access",
|
|
21059
|
+
"tactic": "Isolate"
|
|
21060
|
+
},
|
|
21061
|
+
{
|
|
21062
|
+
"id": "D3-PSEP",
|
|
21063
|
+
"name": "Process Segment Execution Prevention",
|
|
21064
|
+
"tactic": "Harden"
|
|
21065
|
+
}
|
|
21066
|
+
],
|
|
21067
|
+
"framework_gaps": [
|
|
21068
|
+
{
|
|
21069
|
+
"id": "ALL-AI-PIPELINE-INTEGRITY",
|
|
21070
|
+
"framework": "ALL",
|
|
21071
|
+
"control_name": "AI Pipeline Integrity"
|
|
21072
|
+
},
|
|
21073
|
+
{
|
|
21074
|
+
"id": "ALL-PROMPT-INJECTION-ACCESS-CONTROL",
|
|
21075
|
+
"framework": "ALL",
|
|
21076
|
+
"control_name": "Prompt Injection as Access Control Failure"
|
|
21077
|
+
},
|
|
21078
|
+
{
|
|
21079
|
+
"id": "CIS-Controls-v8-Control7",
|
|
21080
|
+
"framework": "CIS Controls v8",
|
|
21081
|
+
"control_name": "Continuous Vulnerability Management"
|
|
21082
|
+
},
|
|
21083
|
+
{
|
|
21084
|
+
"id": "CMMC-2.0-Level-2",
|
|
21085
|
+
"framework": "CMMC 2.0 (Cybersecurity Maturity Model Certification) Level 2",
|
|
21086
|
+
"control_name": "Level 2 — Advanced (110 NIST 800-171 Rev 2 controls)"
|
|
21087
|
+
},
|
|
21088
|
+
{
|
|
21089
|
+
"id": "FedRAMP-Rev5-Moderate",
|
|
21090
|
+
"framework": "FedRAMP Rev 5 Moderate",
|
|
21091
|
+
"control_name": "FedRAMP Moderate baseline (NIST 800-53 Rev 5 tailoring)"
|
|
21092
|
+
},
|
|
21093
|
+
{
|
|
21094
|
+
"id": "IEC-62443-3-3",
|
|
21095
|
+
"framework": "IEC 62443-3-3 (Industrial communication networks — security for IACS)",
|
|
21096
|
+
"control_name": "System security requirements and security levels"
|
|
21097
|
+
},
|
|
21098
|
+
{
|
|
21099
|
+
"id": "ISO-27001-2022-A.8.28",
|
|
21100
|
+
"framework": "ISO/IEC 27001:2022",
|
|
21101
|
+
"control_name": "Secure coding"
|
|
21102
|
+
},
|
|
21103
|
+
{
|
|
21104
|
+
"id": "ISO-27001-2022-A.8.8",
|
|
21105
|
+
"framework": "ISO/IEC 27001:2022",
|
|
21106
|
+
"control_name": "Management of technical vulnerabilities"
|
|
21107
|
+
},
|
|
21108
|
+
{
|
|
21109
|
+
"id": "ISO-IEC-23894-2023-clause-7",
|
|
21110
|
+
"framework": "ISO/IEC 23894:2023 (AI Risk Management Guidance)",
|
|
21111
|
+
"control_name": "AI risk management process"
|
|
21112
|
+
},
|
|
21113
|
+
{
|
|
21114
|
+
"id": "NERC-CIP-007-6-R4",
|
|
21115
|
+
"framework": "NERC CIP-007-6 (BES Cyber System Security Management)",
|
|
21116
|
+
"control_name": "Security event monitoring"
|
|
21117
|
+
},
|
|
21118
|
+
{
|
|
21119
|
+
"id": "NIS2-Art21-patch-management",
|
|
21120
|
+
"framework": "EU NIS2 Directive",
|
|
21121
|
+
"control_name": "Vulnerability handling and disclosure"
|
|
21122
|
+
},
|
|
21123
|
+
{
|
|
21124
|
+
"id": "NIST-800-115",
|
|
21125
|
+
"framework": "NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)",
|
|
21126
|
+
"control_name": "Technical Guide to Information Security Testing and Assessment"
|
|
21127
|
+
},
|
|
21128
|
+
{
|
|
21129
|
+
"id": "NIST-800-218-SSDF",
|
|
21130
|
+
"framework": "NIST SP 800-218 (Secure Software Development Framework v1.1)",
|
|
21131
|
+
"control_name": "Secure Software Development Framework"
|
|
21132
|
+
},
|
|
21133
|
+
{
|
|
21134
|
+
"id": "NIST-800-53-AC-2",
|
|
21135
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
21136
|
+
"control_name": "Account Management"
|
|
21137
|
+
},
|
|
21138
|
+
{
|
|
21139
|
+
"id": "NIST-800-53-SC-8",
|
|
21140
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
21141
|
+
"control_name": "Transmission Confidentiality and Integrity"
|
|
21142
|
+
},
|
|
21143
|
+
{
|
|
21144
|
+
"id": "NIST-800-53-SI-2",
|
|
21145
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
21146
|
+
"control_name": "Flaw Remediation"
|
|
21147
|
+
},
|
|
21148
|
+
{
|
|
21149
|
+
"id": "NIST-800-53-SI-3",
|
|
21150
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
21151
|
+
"control_name": "Malicious Code Protection"
|
|
21152
|
+
},
|
|
21153
|
+
{
|
|
21154
|
+
"id": "NIST-800-82r3",
|
|
21155
|
+
"framework": "NIST SP 800-82 Rev 3 (Guide to OT Security)",
|
|
21156
|
+
"control_name": "Guide to Operational Technology (OT) Security"
|
|
21157
|
+
},
|
|
21158
|
+
{
|
|
21159
|
+
"id": "OWASP-LLM-Top-10-2025-LLM01",
|
|
21160
|
+
"framework": "OWASP Top 10 for LLM Applications 2025",
|
|
21161
|
+
"control_name": "Prompt Injection"
|
|
21162
|
+
},
|
|
21163
|
+
{
|
|
21164
|
+
"id": "OWASP-LLM-Top-10-2025-LLM02",
|
|
21165
|
+
"framework": "OWASP Top 10 for LLM Applications 2025",
|
|
21166
|
+
"control_name": "Sensitive Information Disclosure"
|
|
21167
|
+
},
|
|
21168
|
+
{
|
|
21169
|
+
"id": "OWASP-Pen-Testing-Guide-v5",
|
|
21170
|
+
"framework": "OWASP Web Security Testing Guide v5 (WSTG)",
|
|
21171
|
+
"control_name": "Web application penetration testing methodology"
|
|
21172
|
+
},
|
|
21173
|
+
{
|
|
21174
|
+
"id": "PCI-DSS-4.0-6.3.3",
|
|
21175
|
+
"framework": "PCI DSS 4.0",
|
|
21176
|
+
"control_name": "All system components are protected from known vulnerabilities by installing applicable security patches/updates"
|
|
21177
|
+
},
|
|
21178
|
+
{
|
|
21179
|
+
"id": "PTES-Pre-engagement",
|
|
21180
|
+
"framework": "Penetration Testing Execution Standard (PTES)",
|
|
21181
|
+
"control_name": "Pre-engagement Interactions"
|
|
21182
|
+
},
|
|
21183
|
+
{
|
|
21184
|
+
"id": "SOC2-CC6-logical-access",
|
|
21185
|
+
"framework": "SOC 2 (AICPA Trust Services Criteria)",
|
|
21186
|
+
"control_name": "Logical and Physical Access Controls"
|
|
21187
|
+
},
|
|
21188
|
+
{
|
|
21189
|
+
"id": "SOC2-CC9-vendor-management",
|
|
21190
|
+
"framework": "SOC 2 (AICPA Trust Services Criteria)",
|
|
21191
|
+
"control_name": "Risk Mitigation — Vendor and Business Partner Risk"
|
|
21192
|
+
}
|
|
21193
|
+
],
|
|
21194
|
+
"attack_refs": [
|
|
21195
|
+
"T0855",
|
|
21196
|
+
"T0883",
|
|
21197
|
+
"T1059",
|
|
21198
|
+
"T1068",
|
|
21199
|
+
"T1078",
|
|
21200
|
+
"T1133",
|
|
21201
|
+
"T1190",
|
|
21202
|
+
"T1548.001",
|
|
21203
|
+
"T1566"
|
|
21204
|
+
],
|
|
21205
|
+
"rfc_refs": [
|
|
21206
|
+
"RFC-4301",
|
|
21207
|
+
"RFC-4303",
|
|
21208
|
+
"RFC-7296"
|
|
21209
|
+
]
|
|
21210
|
+
}
|
|
21211
|
+
},
|
|
21212
|
+
"CVE-2024-50050": {
|
|
21213
|
+
"name": "Meta Llama Stack Socket Deserialization RCE (ShadowMQ)",
|
|
21214
|
+
"rwep": 27,
|
|
21215
|
+
"cvss": 6.3,
|
|
21216
|
+
"cisa_kev": false,
|
|
21217
|
+
"epss_score": null,
|
|
21218
|
+
"referencing_skills": [
|
|
21219
|
+
"kernel-lpe-triage",
|
|
21220
|
+
"ai-attack-surface",
|
|
21221
|
+
"compliance-theater",
|
|
21222
|
+
"attack-surface-pentest",
|
|
21223
|
+
"ot-ics-security",
|
|
21224
|
+
"coordinated-vuln-disclosure",
|
|
21225
|
+
"sector-energy"
|
|
21226
|
+
],
|
|
21227
|
+
"chain": {
|
|
21228
|
+
"cwes": [
|
|
21229
|
+
{
|
|
21230
|
+
"id": "CWE-1037",
|
|
21231
|
+
"name": "Processor Optimization Removal or Modification of Security-critical Code",
|
|
21232
|
+
"category": "Hardware / Side Channel"
|
|
21233
|
+
},
|
|
21234
|
+
{
|
|
21235
|
+
"id": "CWE-1039",
|
|
21236
|
+
"name": "Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations",
|
|
21237
|
+
"category": "AI/ML"
|
|
21238
|
+
},
|
|
21239
|
+
{
|
|
21240
|
+
"id": "CWE-125",
|
|
21241
|
+
"name": "Out-of-bounds Read",
|
|
21242
|
+
"category": "Memory Safety"
|
|
21243
|
+
},
|
|
21244
|
+
{
|
|
21245
|
+
"id": "CWE-1357",
|
|
21246
|
+
"name": "Reliance on Insufficiently Trustworthy Component",
|
|
21247
|
+
"category": "Supply Chain"
|
|
21248
|
+
},
|
|
21249
|
+
{
|
|
21250
|
+
"id": "CWE-1395",
|
|
21251
|
+
"name": "Dependency on Vulnerable Third-Party Component",
|
|
21252
|
+
"category": "Supply Chain"
|
|
21253
|
+
},
|
|
21254
|
+
{
|
|
21255
|
+
"id": "CWE-1426",
|
|
21256
|
+
"name": "Improper Validation of Generative AI Output",
|
|
21257
|
+
"category": "AI/ML"
|
|
21258
|
+
},
|
|
21259
|
+
{
|
|
21260
|
+
"id": "CWE-22",
|
|
21261
|
+
"name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)",
|
|
21262
|
+
"category": "Path/Resource"
|
|
21263
|
+
},
|
|
21264
|
+
{
|
|
21265
|
+
"id": "CWE-269",
|
|
21266
|
+
"name": "Improper Privilege Management",
|
|
21267
|
+
"category": "Authorization"
|
|
21268
|
+
},
|
|
21269
|
+
{
|
|
21270
|
+
"id": "CWE-287",
|
|
21271
|
+
"name": "Improper Authentication",
|
|
21272
|
+
"category": "Authentication"
|
|
21273
|
+
},
|
|
21274
|
+
{
|
|
21275
|
+
"id": "CWE-306",
|
|
21276
|
+
"name": "Missing Authentication for Critical Function",
|
|
21277
|
+
"category": "Authentication"
|
|
21278
|
+
},
|
|
21279
|
+
{
|
|
21280
|
+
"id": "CWE-352",
|
|
21281
|
+
"name": "Cross-Site Request Forgery (CSRF)",
|
|
21282
|
+
"category": "Session"
|
|
21283
|
+
},
|
|
21284
|
+
{
|
|
21285
|
+
"id": "CWE-362",
|
|
21286
|
+
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
|
|
21287
|
+
"category": "Concurrency"
|
|
21288
|
+
},
|
|
21289
|
+
{
|
|
21290
|
+
"id": "CWE-416",
|
|
21291
|
+
"name": "Use After Free",
|
|
21292
|
+
"category": "Memory Safety"
|
|
21293
|
+
},
|
|
21294
|
+
{
|
|
21295
|
+
"id": "CWE-434",
|
|
21296
|
+
"name": "Unrestricted Upload of File with Dangerous Type",
|
|
21297
|
+
"category": "File Handling"
|
|
21298
|
+
},
|
|
21299
|
+
{
|
|
21300
|
+
"id": "CWE-672",
|
|
21301
|
+
"name": "Operation on a Resource after Expiration or Release",
|
|
21302
|
+
"category": "Memory Safety"
|
|
21303
|
+
},
|
|
21304
|
+
{
|
|
21305
|
+
"id": "CWE-732",
|
|
21306
|
+
"name": "Incorrect Permission Assignment for Critical Resource",
|
|
21307
|
+
"category": "Authorization"
|
|
21308
|
+
},
|
|
21309
|
+
{
|
|
21310
|
+
"id": "CWE-78",
|
|
21311
|
+
"name": "Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
|
|
21312
|
+
"category": "Injection"
|
|
21313
|
+
},
|
|
21314
|
+
{
|
|
21315
|
+
"id": "CWE-787",
|
|
21316
|
+
"name": "Out-of-bounds Write",
|
|
21317
|
+
"category": "Memory Safety"
|
|
21318
|
+
},
|
|
21319
|
+
{
|
|
21320
|
+
"id": "CWE-79",
|
|
21321
|
+
"name": "Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)",
|
|
21322
|
+
"category": "Injection"
|
|
21323
|
+
},
|
|
21324
|
+
{
|
|
21325
|
+
"id": "CWE-798",
|
|
21326
|
+
"name": "Use of Hard-coded Credentials",
|
|
21327
|
+
"category": "Credentials"
|
|
21328
|
+
},
|
|
21329
|
+
{
|
|
21330
|
+
"id": "CWE-89",
|
|
21331
|
+
"name": "Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
|
|
21332
|
+
"category": "Injection"
|
|
21333
|
+
},
|
|
21334
|
+
{
|
|
21335
|
+
"id": "CWE-918",
|
|
21336
|
+
"name": "Server-Side Request Forgery (SSRF)",
|
|
21337
|
+
"category": "Network"
|
|
21338
|
+
},
|
|
21339
|
+
{
|
|
21340
|
+
"id": "CWE-94",
|
|
21341
|
+
"name": "Improper Control of Generation of Code (Code Injection)",
|
|
21342
|
+
"category": "Injection"
|
|
21343
|
+
}
|
|
21344
|
+
],
|
|
21345
|
+
"atlas": [
|
|
21346
|
+
{
|
|
21347
|
+
"id": "AML.T0010",
|
|
21348
|
+
"name": "ML Supply Chain Compromise",
|
|
21349
|
+
"tactic": "Initial Access"
|
|
21350
|
+
},
|
|
21351
|
+
{
|
|
21352
|
+
"id": "AML.T0016",
|
|
21353
|
+
"name": "Obtain Capabilities: Develop Capabilities",
|
|
21354
|
+
"tactic": "Resource Development"
|
|
21355
|
+
},
|
|
21356
|
+
{
|
|
21357
|
+
"id": "AML.T0017",
|
|
21358
|
+
"name": "Discover ML Model Ontology",
|
|
21359
|
+
"tactic": "Discovery"
|
|
21360
|
+
},
|
|
21361
|
+
{
|
|
21362
|
+
"id": "AML.T0018",
|
|
21363
|
+
"name": "Backdoor ML Model",
|
|
21364
|
+
"tactic": "Persistence"
|
|
21365
|
+
},
|
|
21366
|
+
{
|
|
21367
|
+
"id": "AML.T0020",
|
|
21368
|
+
"name": "Poison Training Data",
|
|
21369
|
+
"tactic": "ML Attack Staging"
|
|
21370
|
+
},
|
|
21371
|
+
{
|
|
21372
|
+
"id": "AML.T0043",
|
|
21373
|
+
"name": "Craft Adversarial Data",
|
|
21374
|
+
"tactic": "ML Attack Staging"
|
|
21375
|
+
},
|
|
21376
|
+
{
|
|
21377
|
+
"id": "AML.T0051",
|
|
21378
|
+
"name": "LLM Prompt Injection",
|
|
21379
|
+
"tactic": "Execution"
|
|
21380
|
+
},
|
|
21381
|
+
{
|
|
21382
|
+
"id": "AML.T0054",
|
|
21383
|
+
"name": "LLM Jailbreak",
|
|
21384
|
+
"tactic": "Defense Evasion"
|
|
21385
|
+
},
|
|
21386
|
+
{
|
|
21387
|
+
"id": "AML.T0096",
|
|
21388
|
+
"name": "AI API as Covert C2 Channel",
|
|
21389
|
+
"tactic": "Command and Control"
|
|
21390
|
+
}
|
|
21391
|
+
],
|
|
21392
|
+
"d3fend": [
|
|
21393
|
+
{
|
|
21394
|
+
"id": "D3-ASLR",
|
|
21395
|
+
"name": "Address Space Layout Randomization",
|
|
21396
|
+
"tactic": "Harden"
|
|
21397
|
+
},
|
|
21398
|
+
{
|
|
21399
|
+
"id": "D3-CSPP",
|
|
21400
|
+
"name": "Client-server Payload Profiling",
|
|
21401
|
+
"tactic": "Detect"
|
|
21402
|
+
},
|
|
21403
|
+
{
|
|
21404
|
+
"id": "D3-EAL",
|
|
21405
|
+
"name": "Executable Allowlisting",
|
|
21406
|
+
"tactic": "Harden"
|
|
21407
|
+
},
|
|
21408
|
+
{
|
|
21409
|
+
"id": "D3-IOPR",
|
|
21410
|
+
"name": "Input/Output Profiling Resource",
|
|
21411
|
+
"tactic": "Detect"
|
|
21412
|
+
},
|
|
21413
|
+
{
|
|
21414
|
+
"id": "D3-NTA",
|
|
21415
|
+
"name": "Network Traffic Analysis",
|
|
21416
|
+
"tactic": "Detect"
|
|
21417
|
+
},
|
|
21418
|
+
{
|
|
21419
|
+
"id": "D3-PHRA",
|
|
21420
|
+
"name": "Process Hardware Resource Access",
|
|
21421
|
+
"tactic": "Isolate"
|
|
21422
|
+
},
|
|
21423
|
+
{
|
|
21424
|
+
"id": "D3-PSEP",
|
|
21425
|
+
"name": "Process Segment Execution Prevention",
|
|
21426
|
+
"tactic": "Harden"
|
|
21427
|
+
}
|
|
21428
|
+
],
|
|
21429
|
+
"framework_gaps": [
|
|
21430
|
+
{
|
|
21431
|
+
"id": "ALL-AI-PIPELINE-INTEGRITY",
|
|
21432
|
+
"framework": "ALL",
|
|
21433
|
+
"control_name": "AI Pipeline Integrity"
|
|
21434
|
+
},
|
|
21435
|
+
{
|
|
21436
|
+
"id": "ALL-PROMPT-INJECTION-ACCESS-CONTROL",
|
|
21437
|
+
"framework": "ALL",
|
|
21438
|
+
"control_name": "Prompt Injection as Access Control Failure"
|
|
21439
|
+
},
|
|
21440
|
+
{
|
|
21441
|
+
"id": "CIS-Controls-v8-Control7",
|
|
21442
|
+
"framework": "CIS Controls v8",
|
|
21443
|
+
"control_name": "Continuous Vulnerability Management"
|
|
21444
|
+
},
|
|
21445
|
+
{
|
|
21446
|
+
"id": "CMMC-2.0-Level-2",
|
|
21447
|
+
"framework": "CMMC 2.0 (Cybersecurity Maturity Model Certification) Level 2",
|
|
21448
|
+
"control_name": "Level 2 — Advanced (110 NIST 800-171 Rev 2 controls)"
|
|
21449
|
+
},
|
|
21450
|
+
{
|
|
21451
|
+
"id": "FedRAMP-Rev5-Moderate",
|
|
21452
|
+
"framework": "FedRAMP Rev 5 Moderate",
|
|
21453
|
+
"control_name": "FedRAMP Moderate baseline (NIST 800-53 Rev 5 tailoring)"
|
|
21454
|
+
},
|
|
21455
|
+
{
|
|
21456
|
+
"id": "IEC-62443-3-3",
|
|
21457
|
+
"framework": "IEC 62443-3-3 (Industrial communication networks — security for IACS)",
|
|
21458
|
+
"control_name": "System security requirements and security levels"
|
|
21459
|
+
},
|
|
21460
|
+
{
|
|
21461
|
+
"id": "ISO-27001-2022-A.8.28",
|
|
21462
|
+
"framework": "ISO/IEC 27001:2022",
|
|
21463
|
+
"control_name": "Secure coding"
|
|
21464
|
+
},
|
|
21465
|
+
{
|
|
21466
|
+
"id": "ISO-27001-2022-A.8.8",
|
|
21467
|
+
"framework": "ISO/IEC 27001:2022",
|
|
21468
|
+
"control_name": "Management of technical vulnerabilities"
|
|
21469
|
+
},
|
|
21470
|
+
{
|
|
21471
|
+
"id": "ISO-IEC-23894-2023-clause-7",
|
|
21472
|
+
"framework": "ISO/IEC 23894:2023 (AI Risk Management Guidance)",
|
|
21473
|
+
"control_name": "AI risk management process"
|
|
21474
|
+
},
|
|
21475
|
+
{
|
|
21476
|
+
"id": "NERC-CIP-007-6-R4",
|
|
21477
|
+
"framework": "NERC CIP-007-6 (BES Cyber System Security Management)",
|
|
21478
|
+
"control_name": "Security event monitoring"
|
|
21479
|
+
},
|
|
21480
|
+
{
|
|
21481
|
+
"id": "NIS2-Art21-patch-management",
|
|
21482
|
+
"framework": "EU NIS2 Directive",
|
|
21483
|
+
"control_name": "Vulnerability handling and disclosure"
|
|
21484
|
+
},
|
|
21485
|
+
{
|
|
21486
|
+
"id": "NIST-800-115",
|
|
21487
|
+
"framework": "NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)",
|
|
21488
|
+
"control_name": "Technical Guide to Information Security Testing and Assessment"
|
|
21489
|
+
},
|
|
21490
|
+
{
|
|
21491
|
+
"id": "NIST-800-218-SSDF",
|
|
21492
|
+
"framework": "NIST SP 800-218 (Secure Software Development Framework v1.1)",
|
|
21493
|
+
"control_name": "Secure Software Development Framework"
|
|
21494
|
+
},
|
|
21495
|
+
{
|
|
21496
|
+
"id": "NIST-800-53-AC-2",
|
|
21497
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
21498
|
+
"control_name": "Account Management"
|
|
21499
|
+
},
|
|
21500
|
+
{
|
|
21501
|
+
"id": "NIST-800-53-SC-8",
|
|
21502
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
21503
|
+
"control_name": "Transmission Confidentiality and Integrity"
|
|
21504
|
+
},
|
|
21505
|
+
{
|
|
21506
|
+
"id": "NIST-800-53-SI-2",
|
|
21507
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
21508
|
+
"control_name": "Flaw Remediation"
|
|
21509
|
+
},
|
|
21510
|
+
{
|
|
21511
|
+
"id": "NIST-800-53-SI-3",
|
|
21512
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
21513
|
+
"control_name": "Malicious Code Protection"
|
|
21514
|
+
},
|
|
21515
|
+
{
|
|
21516
|
+
"id": "NIST-800-82r3",
|
|
21517
|
+
"framework": "NIST SP 800-82 Rev 3 (Guide to OT Security)",
|
|
21518
|
+
"control_name": "Guide to Operational Technology (OT) Security"
|
|
21519
|
+
},
|
|
21520
|
+
{
|
|
21521
|
+
"id": "OWASP-LLM-Top-10-2025-LLM01",
|
|
21522
|
+
"framework": "OWASP Top 10 for LLM Applications 2025",
|
|
21523
|
+
"control_name": "Prompt Injection"
|
|
21524
|
+
},
|
|
21525
|
+
{
|
|
21526
|
+
"id": "OWASP-LLM-Top-10-2025-LLM02",
|
|
21527
|
+
"framework": "OWASP Top 10 for LLM Applications 2025",
|
|
21528
|
+
"control_name": "Sensitive Information Disclosure"
|
|
21529
|
+
},
|
|
21530
|
+
{
|
|
21531
|
+
"id": "OWASP-Pen-Testing-Guide-v5",
|
|
21532
|
+
"framework": "OWASP Web Security Testing Guide v5 (WSTG)",
|
|
21533
|
+
"control_name": "Web application penetration testing methodology"
|
|
21534
|
+
},
|
|
21535
|
+
{
|
|
21536
|
+
"id": "PCI-DSS-4.0-6.3.3",
|
|
21537
|
+
"framework": "PCI DSS 4.0",
|
|
21538
|
+
"control_name": "All system components are protected from known vulnerabilities by installing applicable security patches/updates"
|
|
21539
|
+
},
|
|
21540
|
+
{
|
|
21541
|
+
"id": "PTES-Pre-engagement",
|
|
21542
|
+
"framework": "Penetration Testing Execution Standard (PTES)",
|
|
21543
|
+
"control_name": "Pre-engagement Interactions"
|
|
21544
|
+
},
|
|
21545
|
+
{
|
|
21546
|
+
"id": "SOC2-CC6-logical-access",
|
|
21547
|
+
"framework": "SOC 2 (AICPA Trust Services Criteria)",
|
|
21548
|
+
"control_name": "Logical and Physical Access Controls"
|
|
21549
|
+
},
|
|
21550
|
+
{
|
|
21551
|
+
"id": "SOC2-CC9-vendor-management",
|
|
21552
|
+
"framework": "SOC 2 (AICPA Trust Services Criteria)",
|
|
21553
|
+
"control_name": "Risk Mitigation — Vendor and Business Partner Risk"
|
|
21554
|
+
}
|
|
21555
|
+
],
|
|
21556
|
+
"attack_refs": [
|
|
21557
|
+
"T0855",
|
|
21558
|
+
"T0883",
|
|
21559
|
+
"T1059",
|
|
21560
|
+
"T1068",
|
|
21561
|
+
"T1078",
|
|
21562
|
+
"T1133",
|
|
21563
|
+
"T1190",
|
|
21564
|
+
"T1548.001",
|
|
21565
|
+
"T1566"
|
|
21566
|
+
],
|
|
21567
|
+
"rfc_refs": [
|
|
21568
|
+
"RFC-4301",
|
|
21569
|
+
"RFC-4303",
|
|
21570
|
+
"RFC-7296"
|
|
21571
|
+
]
|
|
21572
|
+
}
|
|
21573
|
+
},
|
|
21574
|
+
"CVE-2025-60455": {
|
|
21575
|
+
"name": "Modular Max Server KVCache-Agent Deserialization RCE (ShadowMQ)",
|
|
21576
|
+
"rwep": 23,
|
|
21577
|
+
"cvss": 8.4,
|
|
21578
|
+
"cisa_kev": false,
|
|
21579
|
+
"epss_score": null,
|
|
21580
|
+
"referencing_skills": [
|
|
21581
|
+
"kernel-lpe-triage",
|
|
21582
|
+
"ai-attack-surface",
|
|
21583
|
+
"compliance-theater",
|
|
21584
|
+
"attack-surface-pentest",
|
|
21585
|
+
"ot-ics-security",
|
|
21586
|
+
"coordinated-vuln-disclosure",
|
|
21587
|
+
"sector-energy"
|
|
21588
|
+
],
|
|
21589
|
+
"chain": {
|
|
21590
|
+
"cwes": [
|
|
21591
|
+
{
|
|
21592
|
+
"id": "CWE-1037",
|
|
21593
|
+
"name": "Processor Optimization Removal or Modification of Security-critical Code",
|
|
21594
|
+
"category": "Hardware / Side Channel"
|
|
21595
|
+
},
|
|
21596
|
+
{
|
|
21597
|
+
"id": "CWE-1039",
|
|
21598
|
+
"name": "Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations",
|
|
21599
|
+
"category": "AI/ML"
|
|
21600
|
+
},
|
|
21601
|
+
{
|
|
21602
|
+
"id": "CWE-125",
|
|
21603
|
+
"name": "Out-of-bounds Read",
|
|
21604
|
+
"category": "Memory Safety"
|
|
21605
|
+
},
|
|
21606
|
+
{
|
|
21607
|
+
"id": "CWE-1357",
|
|
21608
|
+
"name": "Reliance on Insufficiently Trustworthy Component",
|
|
21609
|
+
"category": "Supply Chain"
|
|
21610
|
+
},
|
|
21611
|
+
{
|
|
21612
|
+
"id": "CWE-1395",
|
|
21613
|
+
"name": "Dependency on Vulnerable Third-Party Component",
|
|
21614
|
+
"category": "Supply Chain"
|
|
21615
|
+
},
|
|
21616
|
+
{
|
|
21617
|
+
"id": "CWE-1426",
|
|
21618
|
+
"name": "Improper Validation of Generative AI Output",
|
|
21619
|
+
"category": "AI/ML"
|
|
21620
|
+
},
|
|
21621
|
+
{
|
|
21622
|
+
"id": "CWE-22",
|
|
21623
|
+
"name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)",
|
|
21624
|
+
"category": "Path/Resource"
|
|
21625
|
+
},
|
|
21626
|
+
{
|
|
21627
|
+
"id": "CWE-269",
|
|
21628
|
+
"name": "Improper Privilege Management",
|
|
21629
|
+
"category": "Authorization"
|
|
21630
|
+
},
|
|
21631
|
+
{
|
|
21632
|
+
"id": "CWE-287",
|
|
21633
|
+
"name": "Improper Authentication",
|
|
21634
|
+
"category": "Authentication"
|
|
21635
|
+
},
|
|
21636
|
+
{
|
|
21637
|
+
"id": "CWE-306",
|
|
21638
|
+
"name": "Missing Authentication for Critical Function",
|
|
21639
|
+
"category": "Authentication"
|
|
21640
|
+
},
|
|
21641
|
+
{
|
|
21642
|
+
"id": "CWE-352",
|
|
21643
|
+
"name": "Cross-Site Request Forgery (CSRF)",
|
|
21644
|
+
"category": "Session"
|
|
21645
|
+
},
|
|
21646
|
+
{
|
|
21647
|
+
"id": "CWE-362",
|
|
21648
|
+
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
|
|
21649
|
+
"category": "Concurrency"
|
|
21650
|
+
},
|
|
21651
|
+
{
|
|
21652
|
+
"id": "CWE-416",
|
|
21653
|
+
"name": "Use After Free",
|
|
21654
|
+
"category": "Memory Safety"
|
|
21655
|
+
},
|
|
21656
|
+
{
|
|
21657
|
+
"id": "CWE-434",
|
|
21658
|
+
"name": "Unrestricted Upload of File with Dangerous Type",
|
|
21659
|
+
"category": "File Handling"
|
|
21660
|
+
},
|
|
21661
|
+
{
|
|
21662
|
+
"id": "CWE-672",
|
|
21663
|
+
"name": "Operation on a Resource after Expiration or Release",
|
|
21664
|
+
"category": "Memory Safety"
|
|
21665
|
+
},
|
|
21666
|
+
{
|
|
21667
|
+
"id": "CWE-732",
|
|
21668
|
+
"name": "Incorrect Permission Assignment for Critical Resource",
|
|
21669
|
+
"category": "Authorization"
|
|
21670
|
+
},
|
|
21671
|
+
{
|
|
21672
|
+
"id": "CWE-78",
|
|
21673
|
+
"name": "Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
|
|
21674
|
+
"category": "Injection"
|
|
21675
|
+
},
|
|
21676
|
+
{
|
|
21677
|
+
"id": "CWE-787",
|
|
21678
|
+
"name": "Out-of-bounds Write",
|
|
21679
|
+
"category": "Memory Safety"
|
|
21680
|
+
},
|
|
21681
|
+
{
|
|
21682
|
+
"id": "CWE-79",
|
|
21683
|
+
"name": "Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)",
|
|
21684
|
+
"category": "Injection"
|
|
21685
|
+
},
|
|
21686
|
+
{
|
|
21687
|
+
"id": "CWE-798",
|
|
21688
|
+
"name": "Use of Hard-coded Credentials",
|
|
21689
|
+
"category": "Credentials"
|
|
21690
|
+
},
|
|
21691
|
+
{
|
|
21692
|
+
"id": "CWE-89",
|
|
21693
|
+
"name": "Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
|
|
21694
|
+
"category": "Injection"
|
|
21695
|
+
},
|
|
21696
|
+
{
|
|
21697
|
+
"id": "CWE-918",
|
|
21698
|
+
"name": "Server-Side Request Forgery (SSRF)",
|
|
21699
|
+
"category": "Network"
|
|
21700
|
+
},
|
|
21701
|
+
{
|
|
21702
|
+
"id": "CWE-94",
|
|
21703
|
+
"name": "Improper Control of Generation of Code (Code Injection)",
|
|
21704
|
+
"category": "Injection"
|
|
21705
|
+
}
|
|
21706
|
+
],
|
|
21707
|
+
"atlas": [
|
|
21708
|
+
{
|
|
21709
|
+
"id": "AML.T0010",
|
|
21710
|
+
"name": "ML Supply Chain Compromise",
|
|
21711
|
+
"tactic": "Initial Access"
|
|
21712
|
+
},
|
|
21713
|
+
{
|
|
21714
|
+
"id": "AML.T0016",
|
|
21715
|
+
"name": "Obtain Capabilities: Develop Capabilities",
|
|
21716
|
+
"tactic": "Resource Development"
|
|
21717
|
+
},
|
|
21718
|
+
{
|
|
21719
|
+
"id": "AML.T0017",
|
|
21720
|
+
"name": "Discover ML Model Ontology",
|
|
21721
|
+
"tactic": "Discovery"
|
|
21722
|
+
},
|
|
21723
|
+
{
|
|
21724
|
+
"id": "AML.T0018",
|
|
21725
|
+
"name": "Backdoor ML Model",
|
|
21726
|
+
"tactic": "Persistence"
|
|
21727
|
+
},
|
|
21728
|
+
{
|
|
21729
|
+
"id": "AML.T0020",
|
|
21730
|
+
"name": "Poison Training Data",
|
|
21731
|
+
"tactic": "ML Attack Staging"
|
|
21732
|
+
},
|
|
21733
|
+
{
|
|
21734
|
+
"id": "AML.T0043",
|
|
21735
|
+
"name": "Craft Adversarial Data",
|
|
21736
|
+
"tactic": "ML Attack Staging"
|
|
21737
|
+
},
|
|
21738
|
+
{
|
|
21739
|
+
"id": "AML.T0051",
|
|
21740
|
+
"name": "LLM Prompt Injection",
|
|
21741
|
+
"tactic": "Execution"
|
|
21742
|
+
},
|
|
21743
|
+
{
|
|
21744
|
+
"id": "AML.T0054",
|
|
21745
|
+
"name": "LLM Jailbreak",
|
|
21746
|
+
"tactic": "Defense Evasion"
|
|
21747
|
+
},
|
|
21748
|
+
{
|
|
21749
|
+
"id": "AML.T0096",
|
|
21750
|
+
"name": "AI API as Covert C2 Channel",
|
|
21751
|
+
"tactic": "Command and Control"
|
|
21752
|
+
}
|
|
21753
|
+
],
|
|
21754
|
+
"d3fend": [
|
|
21755
|
+
{
|
|
21756
|
+
"id": "D3-ASLR",
|
|
21757
|
+
"name": "Address Space Layout Randomization",
|
|
21758
|
+
"tactic": "Harden"
|
|
21759
|
+
},
|
|
21760
|
+
{
|
|
21761
|
+
"id": "D3-CSPP",
|
|
21762
|
+
"name": "Client-server Payload Profiling",
|
|
21763
|
+
"tactic": "Detect"
|
|
21764
|
+
},
|
|
21765
|
+
{
|
|
21766
|
+
"id": "D3-EAL",
|
|
21767
|
+
"name": "Executable Allowlisting",
|
|
21768
|
+
"tactic": "Harden"
|
|
21769
|
+
},
|
|
21770
|
+
{
|
|
21771
|
+
"id": "D3-IOPR",
|
|
21772
|
+
"name": "Input/Output Profiling Resource",
|
|
21773
|
+
"tactic": "Detect"
|
|
21774
|
+
},
|
|
21775
|
+
{
|
|
21776
|
+
"id": "D3-NTA",
|
|
21777
|
+
"name": "Network Traffic Analysis",
|
|
21778
|
+
"tactic": "Detect"
|
|
21779
|
+
},
|
|
21780
|
+
{
|
|
21781
|
+
"id": "D3-PHRA",
|
|
21782
|
+
"name": "Process Hardware Resource Access",
|
|
21783
|
+
"tactic": "Isolate"
|
|
21784
|
+
},
|
|
21785
|
+
{
|
|
21786
|
+
"id": "D3-PSEP",
|
|
21787
|
+
"name": "Process Segment Execution Prevention",
|
|
21788
|
+
"tactic": "Harden"
|
|
21789
|
+
}
|
|
21790
|
+
],
|
|
21791
|
+
"framework_gaps": [
|
|
21792
|
+
{
|
|
21793
|
+
"id": "ALL-AI-PIPELINE-INTEGRITY",
|
|
21794
|
+
"framework": "ALL",
|
|
21795
|
+
"control_name": "AI Pipeline Integrity"
|
|
21796
|
+
},
|
|
21797
|
+
{
|
|
21798
|
+
"id": "ALL-PROMPT-INJECTION-ACCESS-CONTROL",
|
|
21799
|
+
"framework": "ALL",
|
|
21800
|
+
"control_name": "Prompt Injection as Access Control Failure"
|
|
21801
|
+
},
|
|
21802
|
+
{
|
|
21803
|
+
"id": "CIS-Controls-v8-Control7",
|
|
21804
|
+
"framework": "CIS Controls v8",
|
|
21805
|
+
"control_name": "Continuous Vulnerability Management"
|
|
21806
|
+
},
|
|
21807
|
+
{
|
|
21808
|
+
"id": "CMMC-2.0-Level-2",
|
|
21809
|
+
"framework": "CMMC 2.0 (Cybersecurity Maturity Model Certification) Level 2",
|
|
21810
|
+
"control_name": "Level 2 — Advanced (110 NIST 800-171 Rev 2 controls)"
|
|
21811
|
+
},
|
|
21812
|
+
{
|
|
21813
|
+
"id": "FedRAMP-Rev5-Moderate",
|
|
21814
|
+
"framework": "FedRAMP Rev 5 Moderate",
|
|
21815
|
+
"control_name": "FedRAMP Moderate baseline (NIST 800-53 Rev 5 tailoring)"
|
|
21816
|
+
},
|
|
21817
|
+
{
|
|
21818
|
+
"id": "IEC-62443-3-3",
|
|
21819
|
+
"framework": "IEC 62443-3-3 (Industrial communication networks — security for IACS)",
|
|
21820
|
+
"control_name": "System security requirements and security levels"
|
|
21821
|
+
},
|
|
21822
|
+
{
|
|
21823
|
+
"id": "ISO-27001-2022-A.8.28",
|
|
21824
|
+
"framework": "ISO/IEC 27001:2022",
|
|
21825
|
+
"control_name": "Secure coding"
|
|
21826
|
+
},
|
|
21827
|
+
{
|
|
21828
|
+
"id": "ISO-27001-2022-A.8.8",
|
|
21829
|
+
"framework": "ISO/IEC 27001:2022",
|
|
21830
|
+
"control_name": "Management of technical vulnerabilities"
|
|
21831
|
+
},
|
|
21832
|
+
{
|
|
21833
|
+
"id": "ISO-IEC-23894-2023-clause-7",
|
|
21834
|
+
"framework": "ISO/IEC 23894:2023 (AI Risk Management Guidance)",
|
|
21835
|
+
"control_name": "AI risk management process"
|
|
21836
|
+
},
|
|
21837
|
+
{
|
|
21838
|
+
"id": "NERC-CIP-007-6-R4",
|
|
21839
|
+
"framework": "NERC CIP-007-6 (BES Cyber System Security Management)",
|
|
21840
|
+
"control_name": "Security event monitoring"
|
|
21841
|
+
},
|
|
21842
|
+
{
|
|
21843
|
+
"id": "NIS2-Art21-patch-management",
|
|
21844
|
+
"framework": "EU NIS2 Directive",
|
|
21845
|
+
"control_name": "Vulnerability handling and disclosure"
|
|
21846
|
+
},
|
|
21847
|
+
{
|
|
21848
|
+
"id": "NIST-800-115",
|
|
21849
|
+
"framework": "NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)",
|
|
21850
|
+
"control_name": "Technical Guide to Information Security Testing and Assessment"
|
|
21851
|
+
},
|
|
21852
|
+
{
|
|
21853
|
+
"id": "NIST-800-218-SSDF",
|
|
21854
|
+
"framework": "NIST SP 800-218 (Secure Software Development Framework v1.1)",
|
|
21855
|
+
"control_name": "Secure Software Development Framework"
|
|
21856
|
+
},
|
|
21857
|
+
{
|
|
21858
|
+
"id": "NIST-800-53-AC-2",
|
|
21859
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
21860
|
+
"control_name": "Account Management"
|
|
21861
|
+
},
|
|
21862
|
+
{
|
|
21863
|
+
"id": "NIST-800-53-SC-8",
|
|
21864
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
21865
|
+
"control_name": "Transmission Confidentiality and Integrity"
|
|
21866
|
+
},
|
|
21867
|
+
{
|
|
21868
|
+
"id": "NIST-800-53-SI-2",
|
|
21869
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
21870
|
+
"control_name": "Flaw Remediation"
|
|
21871
|
+
},
|
|
21872
|
+
{
|
|
21873
|
+
"id": "NIST-800-53-SI-3",
|
|
21874
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
21875
|
+
"control_name": "Malicious Code Protection"
|
|
21876
|
+
},
|
|
21877
|
+
{
|
|
21878
|
+
"id": "NIST-800-82r3",
|
|
21879
|
+
"framework": "NIST SP 800-82 Rev 3 (Guide to OT Security)",
|
|
21880
|
+
"control_name": "Guide to Operational Technology (OT) Security"
|
|
21881
|
+
},
|
|
21882
|
+
{
|
|
21883
|
+
"id": "OWASP-LLM-Top-10-2025-LLM01",
|
|
21884
|
+
"framework": "OWASP Top 10 for LLM Applications 2025",
|
|
21885
|
+
"control_name": "Prompt Injection"
|
|
21886
|
+
},
|
|
21887
|
+
{
|
|
21888
|
+
"id": "OWASP-LLM-Top-10-2025-LLM02",
|
|
21889
|
+
"framework": "OWASP Top 10 for LLM Applications 2025",
|
|
21890
|
+
"control_name": "Sensitive Information Disclosure"
|
|
21891
|
+
},
|
|
21892
|
+
{
|
|
21893
|
+
"id": "OWASP-Pen-Testing-Guide-v5",
|
|
21894
|
+
"framework": "OWASP Web Security Testing Guide v5 (WSTG)",
|
|
21895
|
+
"control_name": "Web application penetration testing methodology"
|
|
21896
|
+
},
|
|
21897
|
+
{
|
|
21898
|
+
"id": "PCI-DSS-4.0-6.3.3",
|
|
21899
|
+
"framework": "PCI DSS 4.0",
|
|
21900
|
+
"control_name": "All system components are protected from known vulnerabilities by installing applicable security patches/updates"
|
|
21901
|
+
},
|
|
21902
|
+
{
|
|
21903
|
+
"id": "PTES-Pre-engagement",
|
|
21904
|
+
"framework": "Penetration Testing Execution Standard (PTES)",
|
|
21905
|
+
"control_name": "Pre-engagement Interactions"
|
|
21906
|
+
},
|
|
21907
|
+
{
|
|
21908
|
+
"id": "SOC2-CC6-logical-access",
|
|
21909
|
+
"framework": "SOC 2 (AICPA Trust Services Criteria)",
|
|
21910
|
+
"control_name": "Logical and Physical Access Controls"
|
|
21911
|
+
},
|
|
21912
|
+
{
|
|
21913
|
+
"id": "SOC2-CC9-vendor-management",
|
|
21914
|
+
"framework": "SOC 2 (AICPA Trust Services Criteria)",
|
|
21915
|
+
"control_name": "Risk Mitigation — Vendor and Business Partner Risk"
|
|
21916
|
+
}
|
|
21917
|
+
],
|
|
21918
|
+
"attack_refs": [
|
|
21919
|
+
"T0855",
|
|
21920
|
+
"T0883",
|
|
21921
|
+
"T1059",
|
|
21922
|
+
"T1068",
|
|
21923
|
+
"T1078",
|
|
21924
|
+
"T1133",
|
|
21925
|
+
"T1190",
|
|
21926
|
+
"T1548.001",
|
|
21927
|
+
"T1566"
|
|
21928
|
+
],
|
|
21929
|
+
"rfc_refs": [
|
|
21930
|
+
"RFC-4301",
|
|
21931
|
+
"RFC-4303",
|
|
21932
|
+
"RFC-7296"
|
|
21933
|
+
]
|
|
21934
|
+
}
|
|
21935
|
+
},
|
|
21936
|
+
"CVE-2026-24207": {
|
|
21937
|
+
"name": "NVIDIA Triton Inference Server Authentication Bypass (Alternate Path) RCE",
|
|
21938
|
+
"rwep": 31,
|
|
21939
|
+
"cvss": 9.8,
|
|
21940
|
+
"cisa_kev": false,
|
|
21941
|
+
"epss_score": null,
|
|
21942
|
+
"referencing_skills": [
|
|
21943
|
+
"kernel-lpe-triage",
|
|
21944
|
+
"ai-attack-surface",
|
|
21945
|
+
"compliance-theater",
|
|
21946
|
+
"attack-surface-pentest",
|
|
21947
|
+
"ot-ics-security",
|
|
21948
|
+
"sector-energy"
|
|
21949
|
+
],
|
|
21950
|
+
"chain": {
|
|
21951
|
+
"cwes": [
|
|
21952
|
+
{
|
|
21953
|
+
"id": "CWE-1037",
|
|
21954
|
+
"name": "Processor Optimization Removal or Modification of Security-critical Code",
|
|
21955
|
+
"category": "Hardware / Side Channel"
|
|
21956
|
+
},
|
|
21957
|
+
{
|
|
21958
|
+
"id": "CWE-1039",
|
|
21959
|
+
"name": "Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations",
|
|
21960
|
+
"category": "AI/ML"
|
|
21961
|
+
},
|
|
21962
|
+
{
|
|
21963
|
+
"id": "CWE-125",
|
|
21964
|
+
"name": "Out-of-bounds Read",
|
|
21965
|
+
"category": "Memory Safety"
|
|
21966
|
+
},
|
|
21967
|
+
{
|
|
21968
|
+
"id": "CWE-1395",
|
|
21969
|
+
"name": "Dependency on Vulnerable Third-Party Component",
|
|
21970
|
+
"category": "Supply Chain"
|
|
21971
|
+
},
|
|
21972
|
+
{
|
|
21973
|
+
"id": "CWE-1426",
|
|
21974
|
+
"name": "Improper Validation of Generative AI Output",
|
|
21975
|
+
"category": "AI/ML"
|
|
21976
|
+
},
|
|
21977
|
+
{
|
|
21978
|
+
"id": "CWE-22",
|
|
21979
|
+
"name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)",
|
|
21980
|
+
"category": "Path/Resource"
|
|
21981
|
+
},
|
|
21982
|
+
{
|
|
21983
|
+
"id": "CWE-269",
|
|
21984
|
+
"name": "Improper Privilege Management",
|
|
21985
|
+
"category": "Authorization"
|
|
21986
|
+
},
|
|
21987
|
+
{
|
|
21988
|
+
"id": "CWE-287",
|
|
21989
|
+
"name": "Improper Authentication",
|
|
21990
|
+
"category": "Authentication"
|
|
21991
|
+
},
|
|
21992
|
+
{
|
|
21993
|
+
"id": "CWE-306",
|
|
21994
|
+
"name": "Missing Authentication for Critical Function",
|
|
21995
|
+
"category": "Authentication"
|
|
21996
|
+
},
|
|
21997
|
+
{
|
|
21998
|
+
"id": "CWE-352",
|
|
21999
|
+
"name": "Cross-Site Request Forgery (CSRF)",
|
|
22000
|
+
"category": "Session"
|
|
22001
|
+
},
|
|
22002
|
+
{
|
|
22003
|
+
"id": "CWE-362",
|
|
22004
|
+
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
|
|
22005
|
+
"category": "Concurrency"
|
|
22006
|
+
},
|
|
22007
|
+
{
|
|
22008
|
+
"id": "CWE-416",
|
|
22009
|
+
"name": "Use After Free",
|
|
22010
|
+
"category": "Memory Safety"
|
|
22011
|
+
},
|
|
22012
|
+
{
|
|
22013
|
+
"id": "CWE-434",
|
|
22014
|
+
"name": "Unrestricted Upload of File with Dangerous Type",
|
|
22015
|
+
"category": "File Handling"
|
|
22016
|
+
},
|
|
22017
|
+
{
|
|
22018
|
+
"id": "CWE-672",
|
|
22019
|
+
"name": "Operation on a Resource after Expiration or Release",
|
|
22020
|
+
"category": "Memory Safety"
|
|
22021
|
+
},
|
|
22022
|
+
{
|
|
22023
|
+
"id": "CWE-732",
|
|
22024
|
+
"name": "Incorrect Permission Assignment for Critical Resource",
|
|
22025
|
+
"category": "Authorization"
|
|
22026
|
+
},
|
|
22027
|
+
{
|
|
22028
|
+
"id": "CWE-78",
|
|
22029
|
+
"name": "Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
|
|
22030
|
+
"category": "Injection"
|
|
22031
|
+
},
|
|
22032
|
+
{
|
|
22033
|
+
"id": "CWE-787",
|
|
22034
|
+
"name": "Out-of-bounds Write",
|
|
22035
|
+
"category": "Memory Safety"
|
|
22036
|
+
},
|
|
22037
|
+
{
|
|
22038
|
+
"id": "CWE-79",
|
|
22039
|
+
"name": "Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)",
|
|
22040
|
+
"category": "Injection"
|
|
22041
|
+
},
|
|
22042
|
+
{
|
|
22043
|
+
"id": "CWE-798",
|
|
22044
|
+
"name": "Use of Hard-coded Credentials",
|
|
22045
|
+
"category": "Credentials"
|
|
22046
|
+
},
|
|
22047
|
+
{
|
|
22048
|
+
"id": "CWE-89",
|
|
22049
|
+
"name": "Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
|
|
22050
|
+
"category": "Injection"
|
|
22051
|
+
},
|
|
22052
|
+
{
|
|
22053
|
+
"id": "CWE-918",
|
|
22054
|
+
"name": "Server-Side Request Forgery (SSRF)",
|
|
22055
|
+
"category": "Network"
|
|
22056
|
+
},
|
|
22057
|
+
{
|
|
22058
|
+
"id": "CWE-94",
|
|
22059
|
+
"name": "Improper Control of Generation of Code (Code Injection)",
|
|
22060
|
+
"category": "Injection"
|
|
22061
|
+
}
|
|
22062
|
+
],
|
|
22063
|
+
"atlas": [
|
|
22064
|
+
{
|
|
22065
|
+
"id": "AML.T0010",
|
|
22066
|
+
"name": "ML Supply Chain Compromise",
|
|
22067
|
+
"tactic": "Initial Access"
|
|
22068
|
+
},
|
|
22069
|
+
{
|
|
22070
|
+
"id": "AML.T0016",
|
|
22071
|
+
"name": "Obtain Capabilities: Develop Capabilities",
|
|
22072
|
+
"tactic": "Resource Development"
|
|
22073
|
+
},
|
|
22074
|
+
{
|
|
22075
|
+
"id": "AML.T0017",
|
|
22076
|
+
"name": "Discover ML Model Ontology",
|
|
22077
|
+
"tactic": "Discovery"
|
|
22078
|
+
},
|
|
22079
|
+
{
|
|
22080
|
+
"id": "AML.T0018",
|
|
22081
|
+
"name": "Backdoor ML Model",
|
|
22082
|
+
"tactic": "Persistence"
|
|
22083
|
+
},
|
|
22084
|
+
{
|
|
22085
|
+
"id": "AML.T0020",
|
|
22086
|
+
"name": "Poison Training Data",
|
|
22087
|
+
"tactic": "ML Attack Staging"
|
|
22088
|
+
},
|
|
22089
|
+
{
|
|
22090
|
+
"id": "AML.T0043",
|
|
22091
|
+
"name": "Craft Adversarial Data",
|
|
22092
|
+
"tactic": "ML Attack Staging"
|
|
22093
|
+
},
|
|
22094
|
+
{
|
|
22095
|
+
"id": "AML.T0051",
|
|
22096
|
+
"name": "LLM Prompt Injection",
|
|
22097
|
+
"tactic": "Execution"
|
|
22098
|
+
},
|
|
22099
|
+
{
|
|
22100
|
+
"id": "AML.T0054",
|
|
22101
|
+
"name": "LLM Jailbreak",
|
|
22102
|
+
"tactic": "Defense Evasion"
|
|
22103
|
+
},
|
|
22104
|
+
{
|
|
22105
|
+
"id": "AML.T0096",
|
|
22106
|
+
"name": "AI API as Covert C2 Channel",
|
|
22107
|
+
"tactic": "Command and Control"
|
|
22108
|
+
}
|
|
22109
|
+
],
|
|
22110
|
+
"d3fend": [
|
|
22111
|
+
{
|
|
22112
|
+
"id": "D3-ASLR",
|
|
22113
|
+
"name": "Address Space Layout Randomization",
|
|
22114
|
+
"tactic": "Harden"
|
|
22115
|
+
},
|
|
22116
|
+
{
|
|
22117
|
+
"id": "D3-CSPP",
|
|
22118
|
+
"name": "Client-server Payload Profiling",
|
|
22119
|
+
"tactic": "Detect"
|
|
22120
|
+
},
|
|
22121
|
+
{
|
|
22122
|
+
"id": "D3-EAL",
|
|
22123
|
+
"name": "Executable Allowlisting",
|
|
22124
|
+
"tactic": "Harden"
|
|
22125
|
+
},
|
|
22126
|
+
{
|
|
22127
|
+
"id": "D3-IOPR",
|
|
22128
|
+
"name": "Input/Output Profiling Resource",
|
|
22129
|
+
"tactic": "Detect"
|
|
22130
|
+
},
|
|
22131
|
+
{
|
|
22132
|
+
"id": "D3-NTA",
|
|
22133
|
+
"name": "Network Traffic Analysis",
|
|
22134
|
+
"tactic": "Detect"
|
|
22135
|
+
},
|
|
22136
|
+
{
|
|
22137
|
+
"id": "D3-PHRA",
|
|
22138
|
+
"name": "Process Hardware Resource Access",
|
|
22139
|
+
"tactic": "Isolate"
|
|
22140
|
+
},
|
|
22141
|
+
{
|
|
22142
|
+
"id": "D3-PSEP",
|
|
22143
|
+
"name": "Process Segment Execution Prevention",
|
|
22144
|
+
"tactic": "Harden"
|
|
22145
|
+
}
|
|
22146
|
+
],
|
|
22147
|
+
"framework_gaps": [
|
|
22148
|
+
{
|
|
22149
|
+
"id": "ALL-AI-PIPELINE-INTEGRITY",
|
|
22150
|
+
"framework": "ALL",
|
|
22151
|
+
"control_name": "AI Pipeline Integrity"
|
|
22152
|
+
},
|
|
22153
|
+
{
|
|
22154
|
+
"id": "ALL-PROMPT-INJECTION-ACCESS-CONTROL",
|
|
22155
|
+
"framework": "ALL",
|
|
22156
|
+
"control_name": "Prompt Injection as Access Control Failure"
|
|
22157
|
+
},
|
|
22158
|
+
{
|
|
22159
|
+
"id": "CIS-Controls-v8-Control7",
|
|
22160
|
+
"framework": "CIS Controls v8",
|
|
22161
|
+
"control_name": "Continuous Vulnerability Management"
|
|
22162
|
+
},
|
|
22163
|
+
{
|
|
22164
|
+
"id": "CMMC-2.0-Level-2",
|
|
22165
|
+
"framework": "CMMC 2.0 (Cybersecurity Maturity Model Certification) Level 2",
|
|
22166
|
+
"control_name": "Level 2 — Advanced (110 NIST 800-171 Rev 2 controls)"
|
|
22167
|
+
},
|
|
22168
|
+
{
|
|
22169
|
+
"id": "FedRAMP-Rev5-Moderate",
|
|
22170
|
+
"framework": "FedRAMP Rev 5 Moderate",
|
|
22171
|
+
"control_name": "FedRAMP Moderate baseline (NIST 800-53 Rev 5 tailoring)"
|
|
22172
|
+
},
|
|
22173
|
+
{
|
|
22174
|
+
"id": "IEC-62443-3-3",
|
|
22175
|
+
"framework": "IEC 62443-3-3 (Industrial communication networks — security for IACS)",
|
|
22176
|
+
"control_name": "System security requirements and security levels"
|
|
22177
|
+
},
|
|
22178
|
+
{
|
|
22179
|
+
"id": "ISO-27001-2022-A.8.28",
|
|
22180
|
+
"framework": "ISO/IEC 27001:2022",
|
|
22181
|
+
"control_name": "Secure coding"
|
|
22182
|
+
},
|
|
22183
|
+
{
|
|
22184
|
+
"id": "ISO-27001-2022-A.8.8",
|
|
22185
|
+
"framework": "ISO/IEC 27001:2022",
|
|
22186
|
+
"control_name": "Management of technical vulnerabilities"
|
|
22187
|
+
},
|
|
22188
|
+
{
|
|
22189
|
+
"id": "ISO-IEC-23894-2023-clause-7",
|
|
22190
|
+
"framework": "ISO/IEC 23894:2023 (AI Risk Management Guidance)",
|
|
22191
|
+
"control_name": "AI risk management process"
|
|
22192
|
+
},
|
|
22193
|
+
{
|
|
22194
|
+
"id": "NERC-CIP-007-6-R4",
|
|
22195
|
+
"framework": "NERC CIP-007-6 (BES Cyber System Security Management)",
|
|
22196
|
+
"control_name": "Security event monitoring"
|
|
22197
|
+
},
|
|
22198
|
+
{
|
|
22199
|
+
"id": "NIS2-Art21-patch-management",
|
|
22200
|
+
"framework": "EU NIS2 Directive",
|
|
22201
|
+
"control_name": "Vulnerability handling and disclosure"
|
|
22202
|
+
},
|
|
22203
|
+
{
|
|
22204
|
+
"id": "NIST-800-115",
|
|
22205
|
+
"framework": "NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)",
|
|
22206
|
+
"control_name": "Technical Guide to Information Security Testing and Assessment"
|
|
22207
|
+
},
|
|
22208
|
+
{
|
|
22209
|
+
"id": "NIST-800-53-AC-2",
|
|
22210
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
22211
|
+
"control_name": "Account Management"
|
|
22212
|
+
},
|
|
22213
|
+
{
|
|
22214
|
+
"id": "NIST-800-53-SC-8",
|
|
22215
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
22216
|
+
"control_name": "Transmission Confidentiality and Integrity"
|
|
22217
|
+
},
|
|
22218
|
+
{
|
|
22219
|
+
"id": "NIST-800-53-SI-2",
|
|
22220
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
22221
|
+
"control_name": "Flaw Remediation"
|
|
22222
|
+
},
|
|
22223
|
+
{
|
|
22224
|
+
"id": "NIST-800-53-SI-3",
|
|
22225
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
22226
|
+
"control_name": "Malicious Code Protection"
|
|
22227
|
+
},
|
|
22228
|
+
{
|
|
22229
|
+
"id": "NIST-800-82r3",
|
|
22230
|
+
"framework": "NIST SP 800-82 Rev 3 (Guide to OT Security)",
|
|
22231
|
+
"control_name": "Guide to Operational Technology (OT) Security"
|
|
22232
|
+
},
|
|
22233
|
+
{
|
|
22234
|
+
"id": "OWASP-LLM-Top-10-2025-LLM01",
|
|
22235
|
+
"framework": "OWASP Top 10 for LLM Applications 2025",
|
|
22236
|
+
"control_name": "Prompt Injection"
|
|
22237
|
+
},
|
|
22238
|
+
{
|
|
22239
|
+
"id": "OWASP-LLM-Top-10-2025-LLM02",
|
|
22240
|
+
"framework": "OWASP Top 10 for LLM Applications 2025",
|
|
22241
|
+
"control_name": "Sensitive Information Disclosure"
|
|
22242
|
+
},
|
|
22243
|
+
{
|
|
22244
|
+
"id": "OWASP-Pen-Testing-Guide-v5",
|
|
22245
|
+
"framework": "OWASP Web Security Testing Guide v5 (WSTG)",
|
|
22246
|
+
"control_name": "Web application penetration testing methodology"
|
|
22247
|
+
},
|
|
22248
|
+
{
|
|
22249
|
+
"id": "PCI-DSS-4.0-6.3.3",
|
|
22250
|
+
"framework": "PCI DSS 4.0",
|
|
22251
|
+
"control_name": "All system components are protected from known vulnerabilities by installing applicable security patches/updates"
|
|
22252
|
+
},
|
|
22253
|
+
{
|
|
22254
|
+
"id": "PTES-Pre-engagement",
|
|
22255
|
+
"framework": "Penetration Testing Execution Standard (PTES)",
|
|
22256
|
+
"control_name": "Pre-engagement Interactions"
|
|
22257
|
+
},
|
|
22258
|
+
{
|
|
22259
|
+
"id": "SOC2-CC6-logical-access",
|
|
22260
|
+
"framework": "SOC 2 (AICPA Trust Services Criteria)",
|
|
22261
|
+
"control_name": "Logical and Physical Access Controls"
|
|
22262
|
+
}
|
|
22263
|
+
],
|
|
22264
|
+
"attack_refs": [
|
|
22265
|
+
"T0855",
|
|
22266
|
+
"T0883",
|
|
22267
|
+
"T1059",
|
|
22268
|
+
"T1068",
|
|
22269
|
+
"T1078",
|
|
22270
|
+
"T1133",
|
|
22271
|
+
"T1190",
|
|
22272
|
+
"T1548.001",
|
|
22273
|
+
"T1566"
|
|
22274
|
+
],
|
|
22275
|
+
"rfc_refs": [
|
|
22276
|
+
"RFC-4301",
|
|
22277
|
+
"RFC-4303",
|
|
22278
|
+
"RFC-7296"
|
|
22279
|
+
]
|
|
22280
|
+
}
|
|
22281
|
+
},
|
|
22282
|
+
"CVE-2026-24206": {
|
|
22283
|
+
"name": "NVIDIA Triton Inference Server Authentication Bypass (Alternate Channel)",
|
|
22284
|
+
"rwep": 31,
|
|
22285
|
+
"cvss": 9.8,
|
|
22286
|
+
"cisa_kev": false,
|
|
22287
|
+
"epss_score": null,
|
|
22288
|
+
"referencing_skills": [
|
|
22289
|
+
"kernel-lpe-triage",
|
|
22290
|
+
"ai-attack-surface",
|
|
22291
|
+
"compliance-theater",
|
|
22292
|
+
"attack-surface-pentest",
|
|
22293
|
+
"ot-ics-security",
|
|
22294
|
+
"sector-energy"
|
|
22295
|
+
],
|
|
22296
|
+
"chain": {
|
|
22297
|
+
"cwes": [
|
|
22298
|
+
{
|
|
22299
|
+
"id": "CWE-1037",
|
|
22300
|
+
"name": "Processor Optimization Removal or Modification of Security-critical Code",
|
|
22301
|
+
"category": "Hardware / Side Channel"
|
|
22302
|
+
},
|
|
22303
|
+
{
|
|
22304
|
+
"id": "CWE-1039",
|
|
22305
|
+
"name": "Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations",
|
|
22306
|
+
"category": "AI/ML"
|
|
22307
|
+
},
|
|
22308
|
+
{
|
|
22309
|
+
"id": "CWE-125",
|
|
22310
|
+
"name": "Out-of-bounds Read",
|
|
22311
|
+
"category": "Memory Safety"
|
|
22312
|
+
},
|
|
22313
|
+
{
|
|
22314
|
+
"id": "CWE-1395",
|
|
22315
|
+
"name": "Dependency on Vulnerable Third-Party Component",
|
|
22316
|
+
"category": "Supply Chain"
|
|
22317
|
+
},
|
|
22318
|
+
{
|
|
22319
|
+
"id": "CWE-1426",
|
|
22320
|
+
"name": "Improper Validation of Generative AI Output",
|
|
22321
|
+
"category": "AI/ML"
|
|
22322
|
+
},
|
|
22323
|
+
{
|
|
22324
|
+
"id": "CWE-22",
|
|
22325
|
+
"name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)",
|
|
22326
|
+
"category": "Path/Resource"
|
|
22327
|
+
},
|
|
22328
|
+
{
|
|
22329
|
+
"id": "CWE-269",
|
|
22330
|
+
"name": "Improper Privilege Management",
|
|
22331
|
+
"category": "Authorization"
|
|
22332
|
+
},
|
|
22333
|
+
{
|
|
22334
|
+
"id": "CWE-287",
|
|
22335
|
+
"name": "Improper Authentication",
|
|
22336
|
+
"category": "Authentication"
|
|
22337
|
+
},
|
|
22338
|
+
{
|
|
22339
|
+
"id": "CWE-306",
|
|
22340
|
+
"name": "Missing Authentication for Critical Function",
|
|
22341
|
+
"category": "Authentication"
|
|
22342
|
+
},
|
|
22343
|
+
{
|
|
22344
|
+
"id": "CWE-352",
|
|
22345
|
+
"name": "Cross-Site Request Forgery (CSRF)",
|
|
22346
|
+
"category": "Session"
|
|
22347
|
+
},
|
|
22348
|
+
{
|
|
22349
|
+
"id": "CWE-362",
|
|
22350
|
+
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
|
|
22351
|
+
"category": "Concurrency"
|
|
22352
|
+
},
|
|
22353
|
+
{
|
|
22354
|
+
"id": "CWE-416",
|
|
22355
|
+
"name": "Use After Free",
|
|
22356
|
+
"category": "Memory Safety"
|
|
22357
|
+
},
|
|
22358
|
+
{
|
|
22359
|
+
"id": "CWE-434",
|
|
22360
|
+
"name": "Unrestricted Upload of File with Dangerous Type",
|
|
22361
|
+
"category": "File Handling"
|
|
22362
|
+
},
|
|
22363
|
+
{
|
|
22364
|
+
"id": "CWE-672",
|
|
22365
|
+
"name": "Operation on a Resource after Expiration or Release",
|
|
22366
|
+
"category": "Memory Safety"
|
|
22367
|
+
},
|
|
22368
|
+
{
|
|
22369
|
+
"id": "CWE-732",
|
|
22370
|
+
"name": "Incorrect Permission Assignment for Critical Resource",
|
|
22371
|
+
"category": "Authorization"
|
|
22372
|
+
},
|
|
22373
|
+
{
|
|
22374
|
+
"id": "CWE-78",
|
|
22375
|
+
"name": "Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)",
|
|
22376
|
+
"category": "Injection"
|
|
22377
|
+
},
|
|
22378
|
+
{
|
|
22379
|
+
"id": "CWE-787",
|
|
22380
|
+
"name": "Out-of-bounds Write",
|
|
22381
|
+
"category": "Memory Safety"
|
|
22382
|
+
},
|
|
22383
|
+
{
|
|
22384
|
+
"id": "CWE-79",
|
|
22385
|
+
"name": "Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)",
|
|
22386
|
+
"category": "Injection"
|
|
22387
|
+
},
|
|
22388
|
+
{
|
|
22389
|
+
"id": "CWE-798",
|
|
22390
|
+
"name": "Use of Hard-coded Credentials",
|
|
22391
|
+
"category": "Credentials"
|
|
22392
|
+
},
|
|
22393
|
+
{
|
|
22394
|
+
"id": "CWE-89",
|
|
22395
|
+
"name": "Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)",
|
|
22396
|
+
"category": "Injection"
|
|
22397
|
+
},
|
|
22398
|
+
{
|
|
22399
|
+
"id": "CWE-918",
|
|
22400
|
+
"name": "Server-Side Request Forgery (SSRF)",
|
|
22401
|
+
"category": "Network"
|
|
22402
|
+
},
|
|
22403
|
+
{
|
|
22404
|
+
"id": "CWE-94",
|
|
22405
|
+
"name": "Improper Control of Generation of Code (Code Injection)",
|
|
22406
|
+
"category": "Injection"
|
|
22407
|
+
}
|
|
22408
|
+
],
|
|
22409
|
+
"atlas": [
|
|
22410
|
+
{
|
|
22411
|
+
"id": "AML.T0010",
|
|
22412
|
+
"name": "ML Supply Chain Compromise",
|
|
22413
|
+
"tactic": "Initial Access"
|
|
22414
|
+
},
|
|
22415
|
+
{
|
|
22416
|
+
"id": "AML.T0016",
|
|
22417
|
+
"name": "Obtain Capabilities: Develop Capabilities",
|
|
22418
|
+
"tactic": "Resource Development"
|
|
22419
|
+
},
|
|
22420
|
+
{
|
|
22421
|
+
"id": "AML.T0017",
|
|
22422
|
+
"name": "Discover ML Model Ontology",
|
|
22423
|
+
"tactic": "Discovery"
|
|
22424
|
+
},
|
|
22425
|
+
{
|
|
22426
|
+
"id": "AML.T0018",
|
|
22427
|
+
"name": "Backdoor ML Model",
|
|
22428
|
+
"tactic": "Persistence"
|
|
22429
|
+
},
|
|
22430
|
+
{
|
|
22431
|
+
"id": "AML.T0020",
|
|
22432
|
+
"name": "Poison Training Data",
|
|
22433
|
+
"tactic": "ML Attack Staging"
|
|
22434
|
+
},
|
|
22435
|
+
{
|
|
22436
|
+
"id": "AML.T0043",
|
|
22437
|
+
"name": "Craft Adversarial Data",
|
|
22438
|
+
"tactic": "ML Attack Staging"
|
|
22439
|
+
},
|
|
22440
|
+
{
|
|
22441
|
+
"id": "AML.T0051",
|
|
22442
|
+
"name": "LLM Prompt Injection",
|
|
22443
|
+
"tactic": "Execution"
|
|
22444
|
+
},
|
|
22445
|
+
{
|
|
22446
|
+
"id": "AML.T0054",
|
|
22447
|
+
"name": "LLM Jailbreak",
|
|
22448
|
+
"tactic": "Defense Evasion"
|
|
22449
|
+
},
|
|
22450
|
+
{
|
|
22451
|
+
"id": "AML.T0096",
|
|
22452
|
+
"name": "AI API as Covert C2 Channel",
|
|
22453
|
+
"tactic": "Command and Control"
|
|
22454
|
+
}
|
|
22455
|
+
],
|
|
22456
|
+
"d3fend": [
|
|
22457
|
+
{
|
|
22458
|
+
"id": "D3-ASLR",
|
|
22459
|
+
"name": "Address Space Layout Randomization",
|
|
22460
|
+
"tactic": "Harden"
|
|
22461
|
+
},
|
|
22462
|
+
{
|
|
22463
|
+
"id": "D3-CSPP",
|
|
22464
|
+
"name": "Client-server Payload Profiling",
|
|
22465
|
+
"tactic": "Detect"
|
|
22466
|
+
},
|
|
22467
|
+
{
|
|
22468
|
+
"id": "D3-EAL",
|
|
22469
|
+
"name": "Executable Allowlisting",
|
|
22470
|
+
"tactic": "Harden"
|
|
22471
|
+
},
|
|
22472
|
+
{
|
|
22473
|
+
"id": "D3-IOPR",
|
|
22474
|
+
"name": "Input/Output Profiling Resource",
|
|
22475
|
+
"tactic": "Detect"
|
|
22476
|
+
},
|
|
22477
|
+
{
|
|
22478
|
+
"id": "D3-NTA",
|
|
22479
|
+
"name": "Network Traffic Analysis",
|
|
22480
|
+
"tactic": "Detect"
|
|
22481
|
+
},
|
|
22482
|
+
{
|
|
22483
|
+
"id": "D3-PHRA",
|
|
22484
|
+
"name": "Process Hardware Resource Access",
|
|
22485
|
+
"tactic": "Isolate"
|
|
22486
|
+
},
|
|
22487
|
+
{
|
|
22488
|
+
"id": "D3-PSEP",
|
|
22489
|
+
"name": "Process Segment Execution Prevention",
|
|
22490
|
+
"tactic": "Harden"
|
|
22491
|
+
}
|
|
22492
|
+
],
|
|
22493
|
+
"framework_gaps": [
|
|
22494
|
+
{
|
|
22495
|
+
"id": "ALL-AI-PIPELINE-INTEGRITY",
|
|
22496
|
+
"framework": "ALL",
|
|
22497
|
+
"control_name": "AI Pipeline Integrity"
|
|
22498
|
+
},
|
|
22499
|
+
{
|
|
22500
|
+
"id": "ALL-PROMPT-INJECTION-ACCESS-CONTROL",
|
|
22501
|
+
"framework": "ALL",
|
|
22502
|
+
"control_name": "Prompt Injection as Access Control Failure"
|
|
22503
|
+
},
|
|
22504
|
+
{
|
|
22505
|
+
"id": "CIS-Controls-v8-Control7",
|
|
22506
|
+
"framework": "CIS Controls v8",
|
|
22507
|
+
"control_name": "Continuous Vulnerability Management"
|
|
22508
|
+
},
|
|
22509
|
+
{
|
|
22510
|
+
"id": "CMMC-2.0-Level-2",
|
|
22511
|
+
"framework": "CMMC 2.0 (Cybersecurity Maturity Model Certification) Level 2",
|
|
22512
|
+
"control_name": "Level 2 — Advanced (110 NIST 800-171 Rev 2 controls)"
|
|
22513
|
+
},
|
|
22514
|
+
{
|
|
22515
|
+
"id": "FedRAMP-Rev5-Moderate",
|
|
22516
|
+
"framework": "FedRAMP Rev 5 Moderate",
|
|
22517
|
+
"control_name": "FedRAMP Moderate baseline (NIST 800-53 Rev 5 tailoring)"
|
|
22518
|
+
},
|
|
22519
|
+
{
|
|
22520
|
+
"id": "IEC-62443-3-3",
|
|
22521
|
+
"framework": "IEC 62443-3-3 (Industrial communication networks — security for IACS)",
|
|
22522
|
+
"control_name": "System security requirements and security levels"
|
|
22523
|
+
},
|
|
22524
|
+
{
|
|
22525
|
+
"id": "ISO-27001-2022-A.8.28",
|
|
22526
|
+
"framework": "ISO/IEC 27001:2022",
|
|
22527
|
+
"control_name": "Secure coding"
|
|
22528
|
+
},
|
|
22529
|
+
{
|
|
22530
|
+
"id": "ISO-27001-2022-A.8.8",
|
|
22531
|
+
"framework": "ISO/IEC 27001:2022",
|
|
22532
|
+
"control_name": "Management of technical vulnerabilities"
|
|
22533
|
+
},
|
|
22534
|
+
{
|
|
22535
|
+
"id": "ISO-IEC-23894-2023-clause-7",
|
|
22536
|
+
"framework": "ISO/IEC 23894:2023 (AI Risk Management Guidance)",
|
|
22537
|
+
"control_name": "AI risk management process"
|
|
22538
|
+
},
|
|
22539
|
+
{
|
|
22540
|
+
"id": "NERC-CIP-007-6-R4",
|
|
22541
|
+
"framework": "NERC CIP-007-6 (BES Cyber System Security Management)",
|
|
22542
|
+
"control_name": "Security event monitoring"
|
|
22543
|
+
},
|
|
22544
|
+
{
|
|
22545
|
+
"id": "NIS2-Art21-patch-management",
|
|
22546
|
+
"framework": "EU NIS2 Directive",
|
|
22547
|
+
"control_name": "Vulnerability handling and disclosure"
|
|
22548
|
+
},
|
|
22549
|
+
{
|
|
22550
|
+
"id": "NIST-800-115",
|
|
22551
|
+
"framework": "NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)",
|
|
22552
|
+
"control_name": "Technical Guide to Information Security Testing and Assessment"
|
|
22553
|
+
},
|
|
22554
|
+
{
|
|
22555
|
+
"id": "NIST-800-53-AC-2",
|
|
22556
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
22557
|
+
"control_name": "Account Management"
|
|
22558
|
+
},
|
|
22559
|
+
{
|
|
22560
|
+
"id": "NIST-800-53-SC-8",
|
|
22561
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
22562
|
+
"control_name": "Transmission Confidentiality and Integrity"
|
|
22563
|
+
},
|
|
22564
|
+
{
|
|
22565
|
+
"id": "NIST-800-53-SI-2",
|
|
22566
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
22567
|
+
"control_name": "Flaw Remediation"
|
|
22568
|
+
},
|
|
22569
|
+
{
|
|
22570
|
+
"id": "NIST-800-53-SI-3",
|
|
22571
|
+
"framework": "NIST SP 800-53 Rev 5",
|
|
22572
|
+
"control_name": "Malicious Code Protection"
|
|
22573
|
+
},
|
|
22574
|
+
{
|
|
22575
|
+
"id": "NIST-800-82r3",
|
|
22576
|
+
"framework": "NIST SP 800-82 Rev 3 (Guide to OT Security)",
|
|
22577
|
+
"control_name": "Guide to Operational Technology (OT) Security"
|
|
22578
|
+
},
|
|
22579
|
+
{
|
|
22580
|
+
"id": "OWASP-LLM-Top-10-2025-LLM01",
|
|
22581
|
+
"framework": "OWASP Top 10 for LLM Applications 2025",
|
|
22582
|
+
"control_name": "Prompt Injection"
|
|
22583
|
+
},
|
|
22584
|
+
{
|
|
22585
|
+
"id": "OWASP-LLM-Top-10-2025-LLM02",
|
|
22586
|
+
"framework": "OWASP Top 10 for LLM Applications 2025",
|
|
22587
|
+
"control_name": "Sensitive Information Disclosure"
|
|
22588
|
+
},
|
|
22589
|
+
{
|
|
22590
|
+
"id": "OWASP-Pen-Testing-Guide-v5",
|
|
22591
|
+
"framework": "OWASP Web Security Testing Guide v5 (WSTG)",
|
|
22592
|
+
"control_name": "Web application penetration testing methodology"
|
|
22593
|
+
},
|
|
22594
|
+
{
|
|
22595
|
+
"id": "PCI-DSS-4.0-6.3.3",
|
|
22596
|
+
"framework": "PCI DSS 4.0",
|
|
22597
|
+
"control_name": "All system components are protected from known vulnerabilities by installing applicable security patches/updates"
|
|
22598
|
+
},
|
|
22599
|
+
{
|
|
22600
|
+
"id": "PTES-Pre-engagement",
|
|
22601
|
+
"framework": "Penetration Testing Execution Standard (PTES)",
|
|
22602
|
+
"control_name": "Pre-engagement Interactions"
|
|
22603
|
+
},
|
|
22604
|
+
{
|
|
22605
|
+
"id": "SOC2-CC6-logical-access",
|
|
22606
|
+
"framework": "SOC 2 (AICPA Trust Services Criteria)",
|
|
22607
|
+
"control_name": "Logical and Physical Access Controls"
|
|
22608
|
+
}
|
|
22609
|
+
],
|
|
22610
|
+
"attack_refs": [
|
|
22611
|
+
"T0855",
|
|
22612
|
+
"T0883",
|
|
22613
|
+
"T1059",
|
|
22614
|
+
"T1068",
|
|
22615
|
+
"T1078",
|
|
22616
|
+
"T1133",
|
|
22617
|
+
"T1190",
|
|
22618
|
+
"T1548.001",
|
|
22619
|
+
"T1566"
|
|
22620
|
+
],
|
|
22621
|
+
"rfc_refs": [
|
|
22622
|
+
"RFC-4301",
|
|
22623
|
+
"RFC-4303",
|
|
22624
|
+
"RFC-7296"
|
|
22625
|
+
]
|
|
22626
|
+
}
|
|
22627
|
+
},
|
|
20488
22628
|
"CVE-2026-41091": {
|
|
20489
22629
|
"name": "Microsoft Defender (Malware Protection Engine) Link-Following LPE to SYSTEM",
|
|
20490
22630
|
"rwep": 45,
|
|
@@ -46863,10 +49003,13 @@
|
|
|
46863
49003
|
"CVE-2023-43472",
|
|
46864
49004
|
"CVE-2024-3094",
|
|
46865
49005
|
"CVE-2024-3154",
|
|
49006
|
+
"CVE-2024-50050",
|
|
46866
49007
|
"CVE-2025-0133",
|
|
46867
49008
|
"CVE-2025-10585",
|
|
46868
49009
|
"CVE-2025-1094",
|
|
46869
49010
|
"CVE-2025-14174",
|
|
49011
|
+
"CVE-2025-23254",
|
|
49012
|
+
"CVE-2025-30165",
|
|
46870
49013
|
"CVE-2025-34291",
|
|
46871
49014
|
"CVE-2025-38352",
|
|
46872
49015
|
"CVE-2025-43300",
|
|
@@ -46874,9 +49017,12 @@
|
|
|
46874
49017
|
"CVE-2025-49844",
|
|
46875
49018
|
"CVE-2025-53773",
|
|
46876
49019
|
"CVE-2025-54136",
|
|
49020
|
+
"CVE-2025-60455",
|
|
46877
49021
|
"CVE-2025-6965",
|
|
46878
49022
|
"CVE-2026-22252",
|
|
46879
49023
|
"CVE-2026-22688",
|
|
49024
|
+
"CVE-2026-24206",
|
|
49025
|
+
"CVE-2026-24207",
|
|
46880
49026
|
"CVE-2026-25592",
|
|
46881
49027
|
"CVE-2026-26015",
|
|
46882
49028
|
"CVE-2026-30615",
|
|
@@ -47221,18 +49367,24 @@
|
|
|
47221
49367
|
},
|
|
47222
49368
|
"related_cves": [
|
|
47223
49369
|
"CVE-2023-43472",
|
|
49370
|
+
"CVE-2024-50050",
|
|
47224
49371
|
"CVE-2025-0133",
|
|
47225
49372
|
"CVE-2025-10585",
|
|
47226
49373
|
"CVE-2025-1094",
|
|
47227
49374
|
"CVE-2025-14174",
|
|
49375
|
+
"CVE-2025-23254",
|
|
49376
|
+
"CVE-2025-30165",
|
|
47228
49377
|
"CVE-2025-34291",
|
|
47229
49378
|
"CVE-2025-38352",
|
|
47230
49379
|
"CVE-2025-43300",
|
|
47231
49380
|
"CVE-2025-49596",
|
|
47232
49381
|
"CVE-2025-54136",
|
|
49382
|
+
"CVE-2025-60455",
|
|
47233
49383
|
"CVE-2025-6965",
|
|
47234
49384
|
"CVE-2026-22252",
|
|
47235
49385
|
"CVE-2026-22688",
|
|
49386
|
+
"CVE-2026-24206",
|
|
49387
|
+
"CVE-2026-24207",
|
|
47236
49388
|
"CVE-2026-25592",
|
|
47237
49389
|
"CVE-2026-26015",
|
|
47238
49390
|
"CVE-2026-30616",
|
|
@@ -47372,18 +49524,24 @@
|
|
|
47372
49524
|
},
|
|
47373
49525
|
"related_cves": [
|
|
47374
49526
|
"CVE-2023-43472",
|
|
49527
|
+
"CVE-2024-50050",
|
|
47375
49528
|
"CVE-2025-0133",
|
|
47376
49529
|
"CVE-2025-10585",
|
|
47377
49530
|
"CVE-2025-1094",
|
|
47378
49531
|
"CVE-2025-14174",
|
|
49532
|
+
"CVE-2025-23254",
|
|
49533
|
+
"CVE-2025-30165",
|
|
47379
49534
|
"CVE-2025-34291",
|
|
47380
49535
|
"CVE-2025-38352",
|
|
47381
49536
|
"CVE-2025-43300",
|
|
47382
49537
|
"CVE-2025-49596",
|
|
47383
49538
|
"CVE-2025-54136",
|
|
49539
|
+
"CVE-2025-60455",
|
|
47384
49540
|
"CVE-2025-6965",
|
|
47385
49541
|
"CVE-2026-22252",
|
|
47386
49542
|
"CVE-2026-22688",
|
|
49543
|
+
"CVE-2026-24206",
|
|
49544
|
+
"CVE-2026-24207",
|
|
47387
49545
|
"CVE-2026-25592",
|
|
47388
49546
|
"CVE-2026-26015",
|
|
47389
49547
|
"CVE-2026-30616",
|
|
@@ -47537,18 +49695,24 @@
|
|
|
47537
49695
|
},
|
|
47538
49696
|
"related_cves": [
|
|
47539
49697
|
"CVE-2023-43472",
|
|
49698
|
+
"CVE-2024-50050",
|
|
47540
49699
|
"CVE-2025-0133",
|
|
47541
49700
|
"CVE-2025-10585",
|
|
47542
49701
|
"CVE-2025-1094",
|
|
47543
49702
|
"CVE-2025-14174",
|
|
49703
|
+
"CVE-2025-23254",
|
|
49704
|
+
"CVE-2025-30165",
|
|
47544
49705
|
"CVE-2025-34291",
|
|
47545
49706
|
"CVE-2025-38352",
|
|
47546
49707
|
"CVE-2025-43300",
|
|
47547
49708
|
"CVE-2025-49596",
|
|
47548
49709
|
"CVE-2025-54136",
|
|
49710
|
+
"CVE-2025-60455",
|
|
47549
49711
|
"CVE-2025-6965",
|
|
47550
49712
|
"CVE-2026-22252",
|
|
47551
49713
|
"CVE-2026-22688",
|
|
49714
|
+
"CVE-2026-24206",
|
|
49715
|
+
"CVE-2026-24207",
|
|
47552
49716
|
"CVE-2026-25592",
|
|
47553
49717
|
"CVE-2026-26015",
|
|
47554
49718
|
"CVE-2026-30616",
|
|
@@ -47808,18 +49972,24 @@
|
|
|
47808
49972
|
"CVE-2023-43472",
|
|
47809
49973
|
"CVE-2024-3094",
|
|
47810
49974
|
"CVE-2024-3154",
|
|
49975
|
+
"CVE-2024-50050",
|
|
47811
49976
|
"CVE-2025-0133",
|
|
47812
49977
|
"CVE-2025-1094",
|
|
47813
49978
|
"CVE-2025-11837",
|
|
49979
|
+
"CVE-2025-23254",
|
|
49980
|
+
"CVE-2025-30165",
|
|
47814
49981
|
"CVE-2025-34291",
|
|
47815
49982
|
"CVE-2025-49596",
|
|
47816
49983
|
"CVE-2025-49844",
|
|
47817
49984
|
"CVE-2025-53773",
|
|
47818
49985
|
"CVE-2025-54136",
|
|
49986
|
+
"CVE-2025-60455",
|
|
47819
49987
|
"CVE-2025-6965",
|
|
47820
49988
|
"CVE-2026-22252",
|
|
47821
49989
|
"CVE-2026-22688",
|
|
47822
49990
|
"CVE-2026-22778",
|
|
49991
|
+
"CVE-2026-24206",
|
|
49992
|
+
"CVE-2026-24207",
|
|
47823
49993
|
"CVE-2026-25592",
|
|
47824
49994
|
"CVE-2026-26015",
|
|
47825
49995
|
"CVE-2026-30615",
|
|
@@ -48041,6 +50211,7 @@
|
|
|
48041
50211
|
"CVE-2024-37079",
|
|
48042
50212
|
"CVE-2024-42009",
|
|
48043
50213
|
"CVE-2024-43468",
|
|
50214
|
+
"CVE-2024-50050",
|
|
48044
50215
|
"CVE-2024-54085",
|
|
48045
50216
|
"CVE-2024-56145",
|
|
48046
50217
|
"CVE-2024-57726",
|
|
@@ -48071,6 +50242,7 @@
|
|
|
48071
50242
|
"CVE-2025-21043",
|
|
48072
50243
|
"CVE-2025-21479",
|
|
48073
50244
|
"CVE-2025-21480",
|
|
50245
|
+
"CVE-2025-23254",
|
|
48074
50246
|
"CVE-2025-24016",
|
|
48075
50247
|
"CVE-2025-24201",
|
|
48076
50248
|
"CVE-2025-24893",
|
|
@@ -48086,6 +50258,7 @@
|
|
|
48086
50258
|
"CVE-2025-27915",
|
|
48087
50259
|
"CVE-2025-27920",
|
|
48088
50260
|
"CVE-2025-29635",
|
|
50261
|
+
"CVE-2025-30165",
|
|
48089
50262
|
"CVE-2025-30397",
|
|
48090
50263
|
"CVE-2025-31125",
|
|
48091
50264
|
"CVE-2025-31277",
|
|
@@ -48161,6 +50334,7 @@
|
|
|
48161
50334
|
"CVE-2025-59389",
|
|
48162
50335
|
"CVE-2025-59689",
|
|
48163
50336
|
"CVE-2025-59718",
|
|
50337
|
+
"CVE-2025-60455",
|
|
48164
50338
|
"CVE-2025-60710",
|
|
48165
50339
|
"CVE-2025-61757",
|
|
48166
50340
|
"CVE-2025-61882",
|
|
@@ -48220,6 +50394,8 @@
|
|
|
48220
50394
|
"CVE-2026-22769",
|
|
48221
50395
|
"CVE-2026-23760",
|
|
48222
50396
|
"CVE-2026-24061",
|
|
50397
|
+
"CVE-2026-24206",
|
|
50398
|
+
"CVE-2026-24207",
|
|
48223
50399
|
"CVE-2026-2441",
|
|
48224
50400
|
"CVE-2026-24423",
|
|
48225
50401
|
"CVE-2026-24858",
|
|
@@ -48834,10 +51010,13 @@
|
|
|
48834
51010
|
"CVE-2023-43472",
|
|
48835
51011
|
"CVE-2024-3094",
|
|
48836
51012
|
"CVE-2024-3154",
|
|
51013
|
+
"CVE-2024-50050",
|
|
48837
51014
|
"CVE-2025-0133",
|
|
48838
51015
|
"CVE-2025-10585",
|
|
48839
51016
|
"CVE-2025-1094",
|
|
48840
51017
|
"CVE-2025-14174",
|
|
51018
|
+
"CVE-2025-23254",
|
|
51019
|
+
"CVE-2025-30165",
|
|
48841
51020
|
"CVE-2025-34291",
|
|
48842
51021
|
"CVE-2025-38352",
|
|
48843
51022
|
"CVE-2025-43300",
|
|
@@ -48845,9 +51024,12 @@
|
|
|
48845
51024
|
"CVE-2025-49844",
|
|
48846
51025
|
"CVE-2025-53773",
|
|
48847
51026
|
"CVE-2025-54136",
|
|
51027
|
+
"CVE-2025-60455",
|
|
48848
51028
|
"CVE-2025-6965",
|
|
48849
51029
|
"CVE-2026-22252",
|
|
48850
51030
|
"CVE-2026-22688",
|
|
51031
|
+
"CVE-2026-24206",
|
|
51032
|
+
"CVE-2026-24207",
|
|
48851
51033
|
"CVE-2026-25592",
|
|
48852
51034
|
"CVE-2026-26015",
|
|
48853
51035
|
"CVE-2026-30615",
|
|
@@ -49424,10 +51606,13 @@
|
|
|
49424
51606
|
"CVE-2023-43472",
|
|
49425
51607
|
"CVE-2024-3094",
|
|
49426
51608
|
"CVE-2024-3154",
|
|
51609
|
+
"CVE-2024-50050",
|
|
49427
51610
|
"CVE-2025-0133",
|
|
49428
51611
|
"CVE-2025-10585",
|
|
49429
51612
|
"CVE-2025-1094",
|
|
49430
51613
|
"CVE-2025-14174",
|
|
51614
|
+
"CVE-2025-23254",
|
|
51615
|
+
"CVE-2025-30165",
|
|
49431
51616
|
"CVE-2025-34291",
|
|
49432
51617
|
"CVE-2025-38352",
|
|
49433
51618
|
"CVE-2025-43300",
|
|
@@ -49435,9 +51620,12 @@
|
|
|
49435
51620
|
"CVE-2025-49844",
|
|
49436
51621
|
"CVE-2025-53773",
|
|
49437
51622
|
"CVE-2025-54136",
|
|
51623
|
+
"CVE-2025-60455",
|
|
49438
51624
|
"CVE-2025-6965",
|
|
49439
51625
|
"CVE-2026-22252",
|
|
49440
51626
|
"CVE-2026-22688",
|
|
51627
|
+
"CVE-2026-24206",
|
|
51628
|
+
"CVE-2026-24207",
|
|
49441
51629
|
"CVE-2026-25592",
|
|
49442
51630
|
"CVE-2026-26015",
|
|
49443
51631
|
"CVE-2026-30615",
|
|
@@ -49651,17 +51839,23 @@
|
|
|
49651
51839
|
},
|
|
49652
51840
|
"related_cves": [
|
|
49653
51841
|
"CVE-2024-3094",
|
|
51842
|
+
"CVE-2024-50050",
|
|
49654
51843
|
"CVE-2025-10585",
|
|
49655
51844
|
"CVE-2025-1094",
|
|
49656
51845
|
"CVE-2025-14174",
|
|
51846
|
+
"CVE-2025-23254",
|
|
51847
|
+
"CVE-2025-30165",
|
|
49657
51848
|
"CVE-2025-34291",
|
|
49658
51849
|
"CVE-2025-38352",
|
|
49659
51850
|
"CVE-2025-43300",
|
|
49660
51851
|
"CVE-2025-49596",
|
|
49661
51852
|
"CVE-2025-53773",
|
|
49662
51853
|
"CVE-2025-54136",
|
|
51854
|
+
"CVE-2025-60455",
|
|
49663
51855
|
"CVE-2026-22252",
|
|
49664
51856
|
"CVE-2026-22688",
|
|
51857
|
+
"CVE-2026-24206",
|
|
51858
|
+
"CVE-2026-24207",
|
|
49665
51859
|
"CVE-2026-25592",
|
|
49666
51860
|
"CVE-2026-26015",
|
|
49667
51861
|
"CVE-2026-30615",
|
|
@@ -50306,10 +52500,13 @@
|
|
|
50306
52500
|
"CVE-2023-43472",
|
|
50307
52501
|
"CVE-2024-3094",
|
|
50308
52502
|
"CVE-2024-3154",
|
|
52503
|
+
"CVE-2024-50050",
|
|
50309
52504
|
"CVE-2025-0133",
|
|
50310
52505
|
"CVE-2025-10585",
|
|
50311
52506
|
"CVE-2025-1094",
|
|
50312
52507
|
"CVE-2025-14174",
|
|
52508
|
+
"CVE-2025-23254",
|
|
52509
|
+
"CVE-2025-30165",
|
|
50313
52510
|
"CVE-2025-34291",
|
|
50314
52511
|
"CVE-2025-38352",
|
|
50315
52512
|
"CVE-2025-43300",
|
|
@@ -50317,9 +52514,12 @@
|
|
|
50317
52514
|
"CVE-2025-49844",
|
|
50318
52515
|
"CVE-2025-53773",
|
|
50319
52516
|
"CVE-2025-54136",
|
|
52517
|
+
"CVE-2025-60455",
|
|
50320
52518
|
"CVE-2025-6965",
|
|
50321
52519
|
"CVE-2026-22252",
|
|
50322
52520
|
"CVE-2026-22688",
|
|
52521
|
+
"CVE-2026-24206",
|
|
52522
|
+
"CVE-2026-24207",
|
|
50323
52523
|
"CVE-2026-25592",
|
|
50324
52524
|
"CVE-2026-26015",
|
|
50325
52525
|
"CVE-2026-30615",
|
|
@@ -50546,6 +52746,7 @@
|
|
|
50546
52746
|
"CVE-2024-37079",
|
|
50547
52747
|
"CVE-2024-42009",
|
|
50548
52748
|
"CVE-2024-43468",
|
|
52749
|
+
"CVE-2024-50050",
|
|
50549
52750
|
"CVE-2024-54085",
|
|
50550
52751
|
"CVE-2024-56145",
|
|
50551
52752
|
"CVE-2024-57726",
|
|
@@ -50576,6 +52777,7 @@
|
|
|
50576
52777
|
"CVE-2025-21043",
|
|
50577
52778
|
"CVE-2025-21479",
|
|
50578
52779
|
"CVE-2025-21480",
|
|
52780
|
+
"CVE-2025-23254",
|
|
50579
52781
|
"CVE-2025-24016",
|
|
50580
52782
|
"CVE-2025-24201",
|
|
50581
52783
|
"CVE-2025-24893",
|
|
@@ -50591,6 +52793,7 @@
|
|
|
50591
52793
|
"CVE-2025-27915",
|
|
50592
52794
|
"CVE-2025-27920",
|
|
50593
52795
|
"CVE-2025-29635",
|
|
52796
|
+
"CVE-2025-30165",
|
|
50594
52797
|
"CVE-2025-30397",
|
|
50595
52798
|
"CVE-2025-31125",
|
|
50596
52799
|
"CVE-2025-31277",
|
|
@@ -50666,6 +52869,7 @@
|
|
|
50666
52869
|
"CVE-2025-59389",
|
|
50667
52870
|
"CVE-2025-59689",
|
|
50668
52871
|
"CVE-2025-59718",
|
|
52872
|
+
"CVE-2025-60455",
|
|
50669
52873
|
"CVE-2025-60710",
|
|
50670
52874
|
"CVE-2025-61757",
|
|
50671
52875
|
"CVE-2025-61882",
|
|
@@ -50725,6 +52929,8 @@
|
|
|
50725
52929
|
"CVE-2026-22769",
|
|
50726
52930
|
"CVE-2026-23760",
|
|
50727
52931
|
"CVE-2026-24061",
|
|
52932
|
+
"CVE-2026-24206",
|
|
52933
|
+
"CVE-2026-24207",
|
|
50728
52934
|
"CVE-2026-2441",
|
|
50729
52935
|
"CVE-2026-24423",
|
|
50730
52936
|
"CVE-2026-24858",
|
|
@@ -50957,6 +53163,7 @@
|
|
|
50957
53163
|
"CVE-2024-37079",
|
|
50958
53164
|
"CVE-2024-42009",
|
|
50959
53165
|
"CVE-2024-43468",
|
|
53166
|
+
"CVE-2024-50050",
|
|
50960
53167
|
"CVE-2024-54085",
|
|
50961
53168
|
"CVE-2024-56145",
|
|
50962
53169
|
"CVE-2024-57726",
|
|
@@ -50987,6 +53194,7 @@
|
|
|
50987
53194
|
"CVE-2025-21043",
|
|
50988
53195
|
"CVE-2025-21479",
|
|
50989
53196
|
"CVE-2025-21480",
|
|
53197
|
+
"CVE-2025-23254",
|
|
50990
53198
|
"CVE-2025-24016",
|
|
50991
53199
|
"CVE-2025-24201",
|
|
50992
53200
|
"CVE-2025-24893",
|
|
@@ -51002,6 +53210,7 @@
|
|
|
51002
53210
|
"CVE-2025-27915",
|
|
51003
53211
|
"CVE-2025-27920",
|
|
51004
53212
|
"CVE-2025-29635",
|
|
53213
|
+
"CVE-2025-30165",
|
|
51005
53214
|
"CVE-2025-30397",
|
|
51006
53215
|
"CVE-2025-31125",
|
|
51007
53216
|
"CVE-2025-31277",
|
|
@@ -51077,6 +53286,7 @@
|
|
|
51077
53286
|
"CVE-2025-59389",
|
|
51078
53287
|
"CVE-2025-59689",
|
|
51079
53288
|
"CVE-2025-59718",
|
|
53289
|
+
"CVE-2025-60455",
|
|
51080
53290
|
"CVE-2025-60710",
|
|
51081
53291
|
"CVE-2025-61757",
|
|
51082
53292
|
"CVE-2025-61882",
|
|
@@ -51136,6 +53346,8 @@
|
|
|
51136
53346
|
"CVE-2026-22769",
|
|
51137
53347
|
"CVE-2026-23760",
|
|
51138
53348
|
"CVE-2026-24061",
|
|
53349
|
+
"CVE-2026-24206",
|
|
53350
|
+
"CVE-2026-24207",
|
|
51139
53351
|
"CVE-2026-2441",
|
|
51140
53352
|
"CVE-2026-24423",
|
|
51141
53353
|
"CVE-2026-24858",
|
|
@@ -51391,10 +53603,13 @@
|
|
|
51391
53603
|
"CVE-2023-43472",
|
|
51392
53604
|
"CVE-2024-3094",
|
|
51393
53605
|
"CVE-2024-3154",
|
|
53606
|
+
"CVE-2024-50050",
|
|
51394
53607
|
"CVE-2025-0133",
|
|
51395
53608
|
"CVE-2025-10585",
|
|
51396
53609
|
"CVE-2025-1094",
|
|
51397
53610
|
"CVE-2025-14174",
|
|
53611
|
+
"CVE-2025-23254",
|
|
53612
|
+
"CVE-2025-30165",
|
|
51398
53613
|
"CVE-2025-34291",
|
|
51399
53614
|
"CVE-2025-38352",
|
|
51400
53615
|
"CVE-2025-43300",
|
|
@@ -51402,9 +53617,12 @@
|
|
|
51402
53617
|
"CVE-2025-49844",
|
|
51403
53618
|
"CVE-2025-53773",
|
|
51404
53619
|
"CVE-2025-54136",
|
|
53620
|
+
"CVE-2025-60455",
|
|
51405
53621
|
"CVE-2025-6965",
|
|
51406
53622
|
"CVE-2026-22252",
|
|
51407
53623
|
"CVE-2026-22688",
|
|
53624
|
+
"CVE-2026-24206",
|
|
53625
|
+
"CVE-2026-24207",
|
|
51408
53626
|
"CVE-2026-25592",
|
|
51409
53627
|
"CVE-2026-26015",
|
|
51410
53628
|
"CVE-2026-30615",
|
|
@@ -52183,6 +54401,7 @@
|
|
|
52183
54401
|
"CVE-2024-37079",
|
|
52184
54402
|
"CVE-2024-42009",
|
|
52185
54403
|
"CVE-2024-43468",
|
|
54404
|
+
"CVE-2024-50050",
|
|
52186
54405
|
"CVE-2024-54085",
|
|
52187
54406
|
"CVE-2024-56145",
|
|
52188
54407
|
"CVE-2024-57726",
|
|
@@ -52213,6 +54432,7 @@
|
|
|
52213
54432
|
"CVE-2025-21043",
|
|
52214
54433
|
"CVE-2025-21479",
|
|
52215
54434
|
"CVE-2025-21480",
|
|
54435
|
+
"CVE-2025-23254",
|
|
52216
54436
|
"CVE-2025-24016",
|
|
52217
54437
|
"CVE-2025-24201",
|
|
52218
54438
|
"CVE-2025-24893",
|
|
@@ -52228,6 +54448,7 @@
|
|
|
52228
54448
|
"CVE-2025-27915",
|
|
52229
54449
|
"CVE-2025-27920",
|
|
52230
54450
|
"CVE-2025-29635",
|
|
54451
|
+
"CVE-2025-30165",
|
|
52231
54452
|
"CVE-2025-30397",
|
|
52232
54453
|
"CVE-2025-31125",
|
|
52233
54454
|
"CVE-2025-31277",
|
|
@@ -52303,6 +54524,7 @@
|
|
|
52303
54524
|
"CVE-2025-59389",
|
|
52304
54525
|
"CVE-2025-59689",
|
|
52305
54526
|
"CVE-2025-59718",
|
|
54527
|
+
"CVE-2025-60455",
|
|
52306
54528
|
"CVE-2025-60710",
|
|
52307
54529
|
"CVE-2025-61757",
|
|
52308
54530
|
"CVE-2025-61882",
|
|
@@ -52362,6 +54584,8 @@
|
|
|
52362
54584
|
"CVE-2026-22769",
|
|
52363
54585
|
"CVE-2026-23760",
|
|
52364
54586
|
"CVE-2026-24061",
|
|
54587
|
+
"CVE-2026-24206",
|
|
54588
|
+
"CVE-2026-24207",
|
|
52365
54589
|
"CVE-2026-2441",
|
|
52366
54590
|
"CVE-2026-24423",
|
|
52367
54591
|
"CVE-2026-24858",
|
|
@@ -52681,10 +54905,13 @@
|
|
|
52681
54905
|
"CVE-2023-43472",
|
|
52682
54906
|
"CVE-2024-3094",
|
|
52683
54907
|
"CVE-2024-3154",
|
|
54908
|
+
"CVE-2024-50050",
|
|
52684
54909
|
"CVE-2025-0133",
|
|
52685
54910
|
"CVE-2025-10585",
|
|
52686
54911
|
"CVE-2025-1094",
|
|
52687
54912
|
"CVE-2025-14174",
|
|
54913
|
+
"CVE-2025-23254",
|
|
54914
|
+
"CVE-2025-30165",
|
|
52688
54915
|
"CVE-2025-34291",
|
|
52689
54916
|
"CVE-2025-38352",
|
|
52690
54917
|
"CVE-2025-43300",
|
|
@@ -52692,9 +54919,12 @@
|
|
|
52692
54919
|
"CVE-2025-49844",
|
|
52693
54920
|
"CVE-2025-53773",
|
|
52694
54921
|
"CVE-2025-54136",
|
|
54922
|
+
"CVE-2025-60455",
|
|
52695
54923
|
"CVE-2025-6965",
|
|
52696
54924
|
"CVE-2026-22252",
|
|
52697
54925
|
"CVE-2026-22688",
|
|
54926
|
+
"CVE-2026-24206",
|
|
54927
|
+
"CVE-2026-24207",
|
|
52698
54928
|
"CVE-2026-25592",
|
|
52699
54929
|
"CVE-2026-26015",
|
|
52700
54930
|
"CVE-2026-30615",
|
|
@@ -53001,6 +55231,7 @@
|
|
|
53001
55231
|
"CVE-2024-37079",
|
|
53002
55232
|
"CVE-2024-42009",
|
|
53003
55233
|
"CVE-2024-43468",
|
|
55234
|
+
"CVE-2024-50050",
|
|
53004
55235
|
"CVE-2024-54085",
|
|
53005
55236
|
"CVE-2024-56145",
|
|
53006
55237
|
"CVE-2024-57726",
|
|
@@ -53032,6 +55263,7 @@
|
|
|
53032
55263
|
"CVE-2025-21043",
|
|
53033
55264
|
"CVE-2025-21479",
|
|
53034
55265
|
"CVE-2025-21480",
|
|
55266
|
+
"CVE-2025-23254",
|
|
53035
55267
|
"CVE-2025-24016",
|
|
53036
55268
|
"CVE-2025-24201",
|
|
53037
55269
|
"CVE-2025-24893",
|
|
@@ -53047,6 +55279,7 @@
|
|
|
53047
55279
|
"CVE-2025-27915",
|
|
53048
55280
|
"CVE-2025-27920",
|
|
53049
55281
|
"CVE-2025-29635",
|
|
55282
|
+
"CVE-2025-30165",
|
|
53050
55283
|
"CVE-2025-30397",
|
|
53051
55284
|
"CVE-2025-31125",
|
|
53052
55285
|
"CVE-2025-31277",
|
|
@@ -53123,6 +55356,7 @@
|
|
|
53123
55356
|
"CVE-2025-59389",
|
|
53124
55357
|
"CVE-2025-59689",
|
|
53125
55358
|
"CVE-2025-59718",
|
|
55359
|
+
"CVE-2025-60455",
|
|
53126
55360
|
"CVE-2025-60710",
|
|
53127
55361
|
"CVE-2025-61757",
|
|
53128
55362
|
"CVE-2025-61882",
|
|
@@ -53183,6 +55417,8 @@
|
|
|
53183
55417
|
"CVE-2026-22769",
|
|
53184
55418
|
"CVE-2026-23760",
|
|
53185
55419
|
"CVE-2026-24061",
|
|
55420
|
+
"CVE-2026-24206",
|
|
55421
|
+
"CVE-2026-24207",
|
|
53186
55422
|
"CVE-2026-2441",
|
|
53187
55423
|
"CVE-2026-24423",
|
|
53188
55424
|
"CVE-2026-24858",
|
|
@@ -53516,9 +55752,12 @@
|
|
|
53516
55752
|
"BUG-2026-NIGHTMARE-ECLIPSE-GREENPLASMA",
|
|
53517
55753
|
"CVE-2024-3094",
|
|
53518
55754
|
"CVE-2024-3154",
|
|
55755
|
+
"CVE-2024-50050",
|
|
53519
55756
|
"CVE-2025-10585",
|
|
53520
55757
|
"CVE-2025-1094",
|
|
53521
55758
|
"CVE-2025-14174",
|
|
55759
|
+
"CVE-2025-23254",
|
|
55760
|
+
"CVE-2025-30165",
|
|
53522
55761
|
"CVE-2025-34291",
|
|
53523
55762
|
"CVE-2025-38352",
|
|
53524
55763
|
"CVE-2025-43300",
|
|
@@ -53526,8 +55765,11 @@
|
|
|
53526
55765
|
"CVE-2025-49844",
|
|
53527
55766
|
"CVE-2025-53773",
|
|
53528
55767
|
"CVE-2025-54136",
|
|
55768
|
+
"CVE-2025-60455",
|
|
53529
55769
|
"CVE-2026-22252",
|
|
53530
55770
|
"CVE-2026-22688",
|
|
55771
|
+
"CVE-2026-24206",
|
|
55772
|
+
"CVE-2026-24207",
|
|
53531
55773
|
"CVE-2026-25592",
|
|
53532
55774
|
"CVE-2026-26015",
|
|
53533
55775
|
"CVE-2026-30615",
|
|
@@ -54441,10 +56683,13 @@
|
|
|
54441
56683
|
"CVE-2023-43472",
|
|
54442
56684
|
"CVE-2024-3094",
|
|
54443
56685
|
"CVE-2024-3154",
|
|
56686
|
+
"CVE-2024-50050",
|
|
54444
56687
|
"CVE-2025-0133",
|
|
54445
56688
|
"CVE-2025-10585",
|
|
54446
56689
|
"CVE-2025-1094",
|
|
54447
56690
|
"CVE-2025-14174",
|
|
56691
|
+
"CVE-2025-23254",
|
|
56692
|
+
"CVE-2025-30165",
|
|
54448
56693
|
"CVE-2025-34291",
|
|
54449
56694
|
"CVE-2025-38352",
|
|
54450
56695
|
"CVE-2025-43300",
|
|
@@ -54452,9 +56697,12 @@
|
|
|
54452
56697
|
"CVE-2025-49844",
|
|
54453
56698
|
"CVE-2025-53773",
|
|
54454
56699
|
"CVE-2025-54136",
|
|
56700
|
+
"CVE-2025-60455",
|
|
54455
56701
|
"CVE-2025-6965",
|
|
54456
56702
|
"CVE-2026-22252",
|
|
54457
56703
|
"CVE-2026-22688",
|
|
56704
|
+
"CVE-2026-24206",
|
|
56705
|
+
"CVE-2026-24207",
|
|
54458
56706
|
"CVE-2026-25592",
|
|
54459
56707
|
"CVE-2026-26015",
|
|
54460
56708
|
"CVE-2026-30615",
|
|
@@ -54528,16 +56776,22 @@
|
|
|
54528
56776
|
"rfc_refs": []
|
|
54529
56777
|
},
|
|
54530
56778
|
"related_cves": [
|
|
56779
|
+
"CVE-2024-50050",
|
|
54531
56780
|
"CVE-2025-10585",
|
|
54532
56781
|
"CVE-2025-1094",
|
|
54533
56782
|
"CVE-2025-14174",
|
|
56783
|
+
"CVE-2025-23254",
|
|
56784
|
+
"CVE-2025-30165",
|
|
54534
56785
|
"CVE-2025-34291",
|
|
54535
56786
|
"CVE-2025-38352",
|
|
54536
56787
|
"CVE-2025-43300",
|
|
54537
56788
|
"CVE-2025-49596",
|
|
54538
56789
|
"CVE-2025-54136",
|
|
56790
|
+
"CVE-2025-60455",
|
|
54539
56791
|
"CVE-2026-22252",
|
|
54540
56792
|
"CVE-2026-22688",
|
|
56793
|
+
"CVE-2026-24206",
|
|
56794
|
+
"CVE-2026-24207",
|
|
54541
56795
|
"CVE-2026-25592",
|
|
54542
56796
|
"CVE-2026-26015",
|
|
54543
56797
|
"CVE-2026-30616",
|
|
@@ -54687,17 +56941,23 @@
|
|
|
54687
56941
|
"related_cves": [
|
|
54688
56942
|
"BUG-2026-NIGHTMARE-ECLIPSE-UNDEFEND",
|
|
54689
56943
|
"CVE-2023-43472",
|
|
56944
|
+
"CVE-2024-50050",
|
|
54690
56945
|
"CVE-2025-0133",
|
|
54691
56946
|
"CVE-2025-1094",
|
|
54692
56947
|
"CVE-2025-11837",
|
|
56948
|
+
"CVE-2025-23254",
|
|
56949
|
+
"CVE-2025-30165",
|
|
54693
56950
|
"CVE-2025-34291",
|
|
54694
56951
|
"CVE-2025-49596",
|
|
54695
56952
|
"CVE-2025-53773",
|
|
54696
56953
|
"CVE-2025-54136",
|
|
56954
|
+
"CVE-2025-60455",
|
|
54697
56955
|
"CVE-2025-6965",
|
|
54698
56956
|
"CVE-2026-22252",
|
|
54699
56957
|
"CVE-2026-22688",
|
|
54700
56958
|
"CVE-2026-22778",
|
|
56959
|
+
"CVE-2026-24206",
|
|
56960
|
+
"CVE-2026-24207",
|
|
54701
56961
|
"CVE-2026-25592",
|
|
54702
56962
|
"CVE-2026-26015",
|
|
54703
56963
|
"CVE-2026-30616",
|
|
@@ -55108,6 +57368,7 @@
|
|
|
55108
57368
|
"CVE-2024-37079",
|
|
55109
57369
|
"CVE-2024-42009",
|
|
55110
57370
|
"CVE-2024-43468",
|
|
57371
|
+
"CVE-2024-50050",
|
|
55111
57372
|
"CVE-2024-54085",
|
|
55112
57373
|
"CVE-2024-56145",
|
|
55113
57374
|
"CVE-2024-57726",
|
|
@@ -55136,6 +57397,7 @@
|
|
|
55136
57397
|
"CVE-2025-21043",
|
|
55137
57398
|
"CVE-2025-21479",
|
|
55138
57399
|
"CVE-2025-21480",
|
|
57400
|
+
"CVE-2025-23254",
|
|
55139
57401
|
"CVE-2025-24016",
|
|
55140
57402
|
"CVE-2025-24201",
|
|
55141
57403
|
"CVE-2025-24893",
|
|
@@ -55151,6 +57413,7 @@
|
|
|
55151
57413
|
"CVE-2025-27915",
|
|
55152
57414
|
"CVE-2025-27920",
|
|
55153
57415
|
"CVE-2025-29635",
|
|
57416
|
+
"CVE-2025-30165",
|
|
55154
57417
|
"CVE-2025-30397",
|
|
55155
57418
|
"CVE-2025-31125",
|
|
55156
57419
|
"CVE-2025-31277",
|
|
@@ -55224,6 +57487,7 @@
|
|
|
55224
57487
|
"CVE-2025-59374",
|
|
55225
57488
|
"CVE-2025-59689",
|
|
55226
57489
|
"CVE-2025-59718",
|
|
57490
|
+
"CVE-2025-60455",
|
|
55227
57491
|
"CVE-2025-60710",
|
|
55228
57492
|
"CVE-2025-61757",
|
|
55229
57493
|
"CVE-2025-61882",
|
|
@@ -55534,10 +57798,13 @@
|
|
|
55534
57798
|
"CVE-2023-43472",
|
|
55535
57799
|
"CVE-2024-3094",
|
|
55536
57800
|
"CVE-2024-3154",
|
|
57801
|
+
"CVE-2024-50050",
|
|
55537
57802
|
"CVE-2025-0133",
|
|
55538
57803
|
"CVE-2025-10585",
|
|
55539
57804
|
"CVE-2025-1094",
|
|
55540
57805
|
"CVE-2025-14174",
|
|
57806
|
+
"CVE-2025-23254",
|
|
57807
|
+
"CVE-2025-30165",
|
|
55541
57808
|
"CVE-2025-34291",
|
|
55542
57809
|
"CVE-2025-38352",
|
|
55543
57810
|
"CVE-2025-43300",
|
|
@@ -55545,9 +57812,12 @@
|
|
|
55545
57812
|
"CVE-2025-49844",
|
|
55546
57813
|
"CVE-2025-53773",
|
|
55547
57814
|
"CVE-2025-54136",
|
|
57815
|
+
"CVE-2025-60455",
|
|
55548
57816
|
"CVE-2025-6965",
|
|
55549
57817
|
"CVE-2026-22252",
|
|
55550
57818
|
"CVE-2026-22688",
|
|
57819
|
+
"CVE-2026-24206",
|
|
57820
|
+
"CVE-2026-24207",
|
|
55551
57821
|
"CVE-2026-25592",
|
|
55552
57822
|
"CVE-2026-26015",
|
|
55553
57823
|
"CVE-2026-30615",
|
|
@@ -55816,20 +58086,26 @@
|
|
|
55816
58086
|
"CVE-2023-43472",
|
|
55817
58087
|
"CVE-2024-3094",
|
|
55818
58088
|
"CVE-2024-40635",
|
|
58089
|
+
"CVE-2024-50050",
|
|
55819
58090
|
"CVE-2025-0133",
|
|
55820
58091
|
"CVE-2025-1094",
|
|
55821
58092
|
"CVE-2025-11837",
|
|
55822
58093
|
"CVE-2025-14847",
|
|
55823
58094
|
"CVE-2025-22226",
|
|
58095
|
+
"CVE-2025-23254",
|
|
58096
|
+
"CVE-2025-30165",
|
|
55824
58097
|
"CVE-2025-34291",
|
|
55825
58098
|
"CVE-2025-49596",
|
|
55826
58099
|
"CVE-2025-53767",
|
|
55827
58100
|
"CVE-2025-53773",
|
|
55828
58101
|
"CVE-2025-54136",
|
|
58102
|
+
"CVE-2025-60455",
|
|
55829
58103
|
"CVE-2025-6965",
|
|
55830
58104
|
"CVE-2026-22252",
|
|
55831
58105
|
"CVE-2026-22688",
|
|
55832
58106
|
"CVE-2026-22778",
|
|
58107
|
+
"CVE-2026-24206",
|
|
58108
|
+
"CVE-2026-24207",
|
|
55833
58109
|
"CVE-2026-25592",
|
|
55834
58110
|
"CVE-2026-26015",
|
|
55835
58111
|
"CVE-2026-30615",
|