{"dataset":"vulnerability-watch","sample":[{"cve_id":"CVE-2026-62643","vendor":"roundcube","product":"webmail","affected_versions":">= 1.6.0 < 1.6.17; >= 1.7.0 < 1.7.2","cvss_score":10,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","kev":false,"summary":"In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for CVE-2026-35540 and CVE-2026-48843.","cwes":["CWE-918"],"advisory_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62643","published":"2026-07-14","updated":"2026-10-24","verification":"open-data","paid_placement":false,"source_id":"nvd-cve-api","source_url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-62643","retrieved_at":"2026-10-26T04:29:30.527763+00:00","epss":0.00246},{"cve_id":"CVE-2026-54433","vendor":"roundcube","product":"webmail","affected_versions":"< 1.6.17; >= 1.7.0 < 1.7.2","cvss_score":10,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","kev":false,"summary":"In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click).","cwes":["CWE-79"],"advisory_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54433","published":"2026-07-14","updated":"2026-10-24","verification":"open-data","paid_placement":false,"source_id":"nvd-cve-api","source_url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-54433","retrieved_at":"2026-10-26T04:29:30.527763+00:00","epss":0.00311},{"cve_id":"CVE-2026-110063","vendor":null,"product":null,"affected_versions":null,"cvss_score":10,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","kev":false,"summary":"Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.","cwes":["CWE-59"],"advisory_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110063","published":"2026-10-22","updated":"2026-10-27","verification":"open-data","paid_placement":false,"source_id":"nvd-cve-api","source_url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-110063","retrieved_at":"2026-10-28T05:23:28.391708+00:00","epss":0.00888},{"cve_id":"CVE-2026-110264","vendor":"gitlab","product":"gitlab","affected_versions":"19.5.0; >= 19.0.0 < 19.0.10; >= 19.1.0 < 19.1.9; >= 19.2.0 < 19.2.9; >= 19.3.0 < 19.3.6; >= 19.4.0 < 19.4.3; >= 7.0.0 < 18.11.13","cvss_score":10,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","kev":false,"summary":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.","cwes":["CWE-190"],"advisory_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110264","published":"2026-10-22","updated":"2026-10-31","verification":"open-data","paid_placement":false,"source_id":"nvd-cve-api","source_url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-110264","retrieved_at":"2026-10-31T05:19:31.586607+00:00","epss":0.01305},{"cve_id":"CVE-2026-97229","vendor":"gitlab","product":"gitlab","affected_versions":">= 19.2.0 < 19.2.8; >= 19.3.0 < 19.3.5; >= 19.4.0 < 19.4.2","cvss_score":10,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","kev":true,"summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","cwes":["CWE-190"],"advisory_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97229","published":"2026-10-13","updated":"2026-10-31","verification":"open-data","paid_placement":false,"source_id":"nvd-cve-api","source_url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-97229","retrieved_at":"2026-10-31T05:19:31.586607+00:00","epss":0.26569}],"feedback":{"message":"Not buying? Tell us why in one free call: we use this feedback to provide a better offering. Do not include personal data.","method":"POST","endpoint":"https://agentdatafeed.com/v1/feedback","mcp_tool":"send_feedback","body":{"type":"no_purchase","dataset":"vulnerability-watch","reason":"no_budget | cost_too_high | dataset_usability_uncertain | other","comment":"optional free text, max 500 characters (required when reason is other)"}}}