Skip to content

Commit 2094bfe

Browse files
cad-safe-botcad-safe-bot
committed
Auto-Update: 2026-02-26T09:00:11.687090+00:00
1 parent ddca8bc commit 2094bfe

File tree

12 files changed

+596
-20
lines changed

12 files changed

+596
-20
lines changed

‎CVE-2025/CVE-2025-141xx/CVE-2025-14104.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"id": "CVE-2025-14104",
33
"sourceIdentifier": "secalert@redhat.com",
44
"published": "2025-12-05T17:16:03.117",
5-
"lastModified": "2026-02-17T10:15:57.080",
5+
"lastModified": "2026-02-26T08:16:15.540",
66
"vulnStatus": "Awaiting Analysis",
77
"cveTags": [],
88
"descriptions": [
@@ -76,6 +76,10 @@
7676
"url": "https://access.redhat.com/errata/RHSA-2026:2800",
7777
"source": "secalert@redhat.com"
7878
},
79+
{
80+
"url": "https://access.redhat.com/errata/RHSA-2026:3406",
81+
"source": "secalert@redhat.com"
82+
},
7983
{
8084
"url": "https://access.redhat.com/security/cve/CVE-2025-14104",
8185
"source": "secalert@redhat.com"

‎CVE-2025/CVE-2025-149xx/CVE-2025-14963.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22
"id": "CVE-2025-14963",
33
"sourceIdentifier": "trellixpsirt@trellix.com",
44
"published": "2026-02-24T18:29:32.613",
5-
"lastModified": "2026-02-24T21:52:01.367",
5+
"lastModified": "2026-02-26T08:16:15.703",
66
"vulnStatus": "Awaiting Analysis",
77
"cveTags": [],
88
"descriptions": [
99
{
1010
"lang": "en",
11-
"value": "A vulnerability identified in the Trellix HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver (BYOVD) was leveraged to gain access to the critical Windows process memory lsass.exe (Local Security Authority Subsystem Service). The fekern.sys; a driver file associated with Trellix HX Agent (used in all existing HX Agent versions). \u00a0 The vulnerable driver installed in a product or a system running fully functional HX Agent is, itself, not exploitable as the product\u2019s tamper protection restricts the ability to communicate with the driver to only the agent\u2019s processes."
11+
"value": "A vulnerability identified in the HX Agent driver file fekern.sys\u00a0allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver (BYOVD) was leveraged to gain access to the critical Windows process memory lsass.exe\u00a0(Local Security Authority Subsystem Service). The\u00a0fekern.sys\u00a0is a driver file associated with the HX Agent (used in all existing HX Agent versions). The vulnerable driver installed in a product or a system running a fully functional HX Agent is, itself, not exploitable\u00a0as the product\u2019s tamper protection restricts the ability to communicate with the driver to only the Agent\u2019s processes."
1212
}
1313
],
1414
"metrics": {
@@ -60,7 +60,7 @@
6060
"weaknesses": [
6161
{
6262
"source": "trellixpsirt@trellix.com",
63-
"type": "Primary",
63+
"type": "Secondary",
6464
"description": [
6565
{
6666
"lang": "en",

‎CVE-2026/CVE-2026-16xx/CVE-2026-1692.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"id": "CVE-2026-1692",
3+
"sourceIdentifier": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
4+
"published": "2026-02-26T08:16:18.160",
5+
"lastModified": "2026-02-26T08:16:18.160",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to lure a successfully authenticated user to a malicious website.\n\nThis vulnerability only affects the following two endpoints: GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV40": [
16+
{
17+
"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "4.0",
21+
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear",
22+
"baseScore": 5.3,
23+
"baseSeverity": "MEDIUM",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"attackRequirements": "NONE",
27+
"privilegesRequired": "NONE",
28+
"userInteraction": "PASSIVE",
29+
"vulnConfidentialityImpact": "LOW",
30+
"vulnIntegrityImpact": "LOW",
31+
"vulnAvailabilityImpact": "NONE",
32+
"subConfidentialityImpact": "LOW",
33+
"subIntegrityImpact": "LOW",
34+
"subAvailabilityImpact": "NONE",
35+
"exploitMaturity": "NOT_DEFINED",
36+
"confidentialityRequirement": "NOT_DEFINED",
37+
"integrityRequirement": "NOT_DEFINED",
38+
"availabilityRequirement": "NOT_DEFINED",
39+
"modifiedAttackVector": "NOT_DEFINED",
40+
"modifiedAttackComplexity": "NOT_DEFINED",
41+
"modifiedAttackRequirements": "NOT_DEFINED",
42+
"modifiedPrivilegesRequired": "NOT_DEFINED",
43+
"modifiedUserInteraction": "NOT_DEFINED",
44+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
45+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
46+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
47+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
48+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
49+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
50+
"Safety": "NOT_DEFINED",
51+
"Automatable": "YES",
52+
"Recovery": "USER",
53+
"valueDensity": "NOT_DEFINED",
54+
"vulnerabilityResponseEffort": "MODERATE",
55+
"providerUrgency": "CLEAR"
56+
}
57+
}
58+
]
59+
},
60+
"weaknesses": [
61+
{
62+
"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
63+
"type": "Secondary",
64+
"description": [
65+
{
66+
"lang": "en",
67+
"value": "CWE-1385"
68+
}
69+
]
70+
}
71+
],
72+
"references": [
73+
{
74+
"url": "https://www.pcvue.com/security/#SB2026-2",
75+
"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
76+
}
77+
]
78+
}

‎CVE-2026/CVE-2026-16xx/CVE-2026-1693.json‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{
2+
"id": "CVE-2026-1693",
3+
"sourceIdentifier": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
4+
"published": "2026-02-26T08:16:18.490",
5+
"lastModified": "2026-02-26T08:16:18.490",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV40": [
16+
{
17+
"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "4.0",
21+
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear",
22+
"baseScore": 5.3,
23+
"baseSeverity": "MEDIUM",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"attackRequirements": "NONE",
27+
"privilegesRequired": "NONE",
28+
"userInteraction": "PASSIVE",
29+
"vulnConfidentialityImpact": "LOW",
30+
"vulnIntegrityImpact": "NONE",
31+
"vulnAvailabilityImpact": "NONE",
32+
"subConfidentialityImpact": "LOW",
33+
"subIntegrityImpact": "NONE",
34+
"subAvailabilityImpact": "NONE",
35+
"exploitMaturity": "NOT_DEFINED",
36+
"confidentialityRequirement": "NOT_DEFINED",
37+
"integrityRequirement": "NOT_DEFINED",
38+
"availabilityRequirement": "NOT_DEFINED",
39+
"modifiedAttackVector": "NOT_DEFINED",
40+
"modifiedAttackComplexity": "NOT_DEFINED",
41+
"modifiedAttackRequirements": "NOT_DEFINED",
42+
"modifiedPrivilegesRequired": "NOT_DEFINED",
43+
"modifiedUserInteraction": "NOT_DEFINED",
44+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
45+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
46+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
47+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
48+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
49+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
50+
"Safety": "NOT_DEFINED",
51+
"Automatable": "YES",
52+
"Recovery": "USER",
53+
"valueDensity": "NOT_DEFINED",
54+
"vulnerabilityResponseEffort": "MODERATE",
55+
"providerUrgency": "CLEAR"
56+
}
57+
}
58+
]
59+
},
60+
"weaknesses": [
61+
{
62+
"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
63+
"type": "Secondary",
64+
"description": [
65+
{
66+
"lang": "en",
67+
"value": "CWE-477"
68+
},
69+
{
70+
"lang": "en",
71+
"value": "CWE-1390"
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"url": "https://www.pcvue.com/security/#SB2026-2",
79+
"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
80+
}
81+
]
82+
}

‎CVE-2026/CVE-2026-16xx/CVE-2026-1694.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"id": "CVE-2026-1694",
3+
"sourceIdentifier": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
4+
"published": "2026-02-26T08:16:18.763",
5+
"lastModified": "2026-02-26T08:16:18.763",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It unnecessarily exposes sensitive information about the server configuration."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV40": [
16+
{
17+
"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "4.0",
21+
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear",
22+
"baseScore": 2.3,
23+
"baseSeverity": "LOW",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "HIGH",
26+
"attackRequirements": "NONE",
27+
"privilegesRequired": "NONE",
28+
"userInteraction": "PASSIVE",
29+
"vulnConfidentialityImpact": "NONE",
30+
"vulnIntegrityImpact": "NONE",
31+
"vulnAvailabilityImpact": "NONE",
32+
"subConfidentialityImpact": "LOW",
33+
"subIntegrityImpact": "NONE",
34+
"subAvailabilityImpact": "NONE",
35+
"exploitMaturity": "NOT_DEFINED",
36+
"confidentialityRequirement": "NOT_DEFINED",
37+
"integrityRequirement": "NOT_DEFINED",
38+
"availabilityRequirement": "NOT_DEFINED",
39+
"modifiedAttackVector": "NOT_DEFINED",
40+
"modifiedAttackComplexity": "NOT_DEFINED",
41+
"modifiedAttackRequirements": "NOT_DEFINED",
42+
"modifiedPrivilegesRequired": "NOT_DEFINED",
43+
"modifiedUserInteraction": "NOT_DEFINED",
44+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
45+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
46+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
47+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
48+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
49+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
50+
"Safety": "NOT_DEFINED",
51+
"Automatable": "YES",
52+
"Recovery": "USER",
53+
"valueDensity": "NOT_DEFINED",
54+
"vulnerabilityResponseEffort": "MODERATE",
55+
"providerUrgency": "CLEAR"
56+
}
57+
}
58+
]
59+
},
60+
"weaknesses": [
61+
{
62+
"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
63+
"type": "Secondary",
64+
"description": [
65+
{
66+
"lang": "en",
67+
"value": "CWE-201"
68+
}
69+
]
70+
}
71+
],
72+
"references": [
73+
{
74+
"url": "https://www.pcvue.com/security/#SB2026-2",
75+
"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
76+
}
77+
]
78+
}

‎CVE-2026/CVE-2026-16xx/CVE-2026-1695.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"id": "CVE-2026-1695",
3+
"sourceIdentifier": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
4+
"published": "2026-02-26T08:16:19.063",
5+
"lastModified": "2026-02-26T08:16:19.063",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to trick a legitimate user into loading content from another site upon unsuccessful user authentication on an unknown application (unknown client_id).\n\nThis vulnerability only affects the error page of the OAuth server."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV40": [
16+
{
17+
"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "4.0",
21+
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear",
22+
"baseScore": 5.3,
23+
"baseSeverity": "MEDIUM",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "LOW",
26+
"attackRequirements": "NONE",
27+
"privilegesRequired": "NONE",
28+
"userInteraction": "PASSIVE",
29+
"vulnConfidentialityImpact": "LOW",
30+
"vulnIntegrityImpact": "LOW",
31+
"vulnAvailabilityImpact": "LOW",
32+
"subConfidentialityImpact": "LOW",
33+
"subIntegrityImpact": "LOW",
34+
"subAvailabilityImpact": "NONE",
35+
"exploitMaturity": "NOT_DEFINED",
36+
"confidentialityRequirement": "NOT_DEFINED",
37+
"integrityRequirement": "NOT_DEFINED",
38+
"availabilityRequirement": "NOT_DEFINED",
39+
"modifiedAttackVector": "NOT_DEFINED",
40+
"modifiedAttackComplexity": "NOT_DEFINED",
41+
"modifiedAttackRequirements": "NOT_DEFINED",
42+
"modifiedPrivilegesRequired": "NOT_DEFINED",
43+
"modifiedUserInteraction": "NOT_DEFINED",
44+
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
45+
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
46+
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
47+
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
48+
"modifiedSubIntegrityImpact": "NOT_DEFINED",
49+
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
50+
"Safety": "NOT_DEFINED",
51+
"Automatable": "YES",
52+
"Recovery": "USER",
53+
"valueDensity": "NOT_DEFINED",
54+
"vulnerabilityResponseEffort": "MODERATE",
55+
"providerUrgency": "CLEAR"
56+
}
57+
}
58+
]
59+
},
60+
"weaknesses": [
61+
{
62+
"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
63+
"type": "Secondary",
64+
"description": [
65+
{
66+
"lang": "en",
67+
"value": "CWE-79"
68+
}
69+
]
70+
}
71+
],
72+
"references": [
73+
{
74+
"url": "https://www.pcvue.com/security/#SB2026-2",
75+
"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
76+
}
77+
]
78+
}

0 commit comments

Comments
 (0)