# References Added by Red Hat CVEs with a reference that Red Hat added. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/references-source/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs with a reference that Red Hat added. Example 4 of 5 in **Filters › Descriptions and References** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `references.source` · `operator` `wildcard` `references.source` is the organization that added the reference, as an e-mail address or a UUID. `wildcard` matches the pattern `*@redhat.com`: `*` stands for any characters. In the response, look at `results[].references[].source`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `references.source` | | `filters.must[0].type` | body | `wildcard` | | `filters.must[0].value` | body | `*@redhat.com` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "references.source", "type": "wildcard", "value": "*@redhat.com" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown; results[].references: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 11687, "results": [ { "id": "CVE-2025-10230", "source_identifier": "user@redhat.com", "published": "2025-11-07T20:15:35Z", "last_modified": "2026-08-31T12:17:52Z", "status": "Deferred", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process." } ], "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2025-10230", "source": "user@redhat.com", "tags": null }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394377", "source": "user@redhat.com", "tags": null }, { "url": "https://www.samba.org/samba/history/security.html", "source": "user@redhat.com", "tags": null }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-10230-detect-samba-vulnerability", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-10230-mitigate-samba-vulnerability", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@redhat.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@redhat.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-78" } ] } ], "configurations": null, "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 78, "owasptop10_2021": "A03 Injection", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "description": "The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.", "capec_id": [ 6, 15, 43, 88, 108 ], "scope": [ "Availability", "Confidentiality", "Integrity", "Non-Repudiation" ], "impact": [ "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Hide Activities", "Modify Application Data", "Modify Files or Directories", "Read Application Data", "Read Files or Directories" ], "detection_method": [ "Architecture or Design Review", "Automated Dynamic Analysis", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Static Analysis", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.39653, "percentile": 0.98555, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@redhat.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2024-3094", "source_identifier": "user@redhat.com", "published": "2024-03-29T17:15:21Z", "last_modified": "2026-06-17T07:43:17Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library." }, { "lang": "es", "value": "Se descubrió código malicioso en los archivos tar ascendentes de xz, a partir de la versión 5.6.0. A través de una serie de ofuscaciones complejas, el proceso de compilación de liblzma extrae un archivo objeto premanipulado de un archivo de prueba disfrazado existente en el código fuente, que luego se utiliza para modificar funciones específicas en el código de liblzma. Esto da como resultado una librería liblzma modificada que puede ser utilizada por cualquier software vinculado a esta librería, interceptando y modificando la interacción de datos con esta librería." } ], "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2024-3094", "source": "user@redhat.com", "tags": [ "Vendor Advisory" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272210", "source": "user@redhat.com", "tags": [ "Issue Tracking", "Vendor Advisory" ] }, { "url": "https://www.openwall.com/lists/oss-security/2024/03/29/4", "source": "user@redhat.com", "tags": [ "Mailing List" ] }, { "url": "https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users", "source": "user@redhat.com", "tags": [ "Vendor Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/10", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/12", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/4", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/5", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/8", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/30/12", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@redhat.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@redhat.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-506" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*", "match_criteria_id": "73F1DAD7-F362-4C5B-B980-2E5313C369DA", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*", "match_criteria_id": "55782A0B-B9C5-4536-A885-84CAB7029C09", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*", "vendor": "tukaani", "product": "xz", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "5.6.0", "affected_versions_last": "5.6.0" }, { "criteria": "cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*", "vendor": "tukaani", "product": "xz", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "5.6.1", "affected_versions_last": "5.6.1" } ], "cwe": [ { "id": 506, "owasptop10_2021": null, "name": "Embedded Malicious Code", "description": "The product contains code that appears to be malicious in nature.", "capec_id": [ 442, 448, 636 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "Execute Unauthorized Code or Commands" ], "detection_method": [ "Automated Static Analysis", "Dynamic Analysis with Manual Results Interpretation", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.85974, "percentile": 0.99719, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2019-3809", "source_identifier": "user@redhat.com", "published": "2019-03-25T18:29:00Z", "last_modified": "2026-06-17T02:35:38Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page." }, { "lang": "es", "value": "Se ha encontrado un error en Moodle, en versiones 3.1 a 3.1.15 y versiones anteriores sin soporte. La funcionalidad ‘‘mybackpack’’ ha permitido establecer la URL de las insignias cuando debería estar restringida la URL del ‘‘backpack’’ de Mozilla Open Badges. Esto ha resultado en la posibilidad de un ataque ciego de SSRF a través de peticiones hechas por la página." } ], "references": [ { "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64222", "source": "user@redhat.com", "tags": [ "Patch", "Vendor Advisory" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3809", "source": "user@redhat.com", "tags": [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url": "https://moodle.org/mod/forum/discuss.php?d=381229#p1536766", "source": "user@redhat.com", "tags": [ "Patch", "Vendor Advisory" ] }, { "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64222", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Vendor Advisory" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3809", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url": "https://moodle.org/mod/forum/discuss.php?d=381229#p1536766", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": null, "cvss_metric_v30": [ { "source": "user@redhat.com", "type": "Secondary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "NONE", "integrity_impact": "LOW", "availability_impact": "LOW", "base_score": 6.5, "base_severity": "MEDIUM", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 2.5 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 7.5, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@redhat.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-352" } ] }, { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-918" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "match_criteria_id": "979D2B8B-FB1F-4802-AAFC-13715A82293F", "version_start_including": "3.1.0", "version_start_excluding": null, "version_end_including": "3.1.15", "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vendor": "moodle", "product": "moodle", "product_type": "a", "vulnerable": true, "version_start_including": "3.1.0", "version_start_excluding": null, "version_end_including": "3.1.15", "version_end_excluding": null, "affected_versions_first": "3.1.0", "affected_versions_last": "3.1.15" } ], "cwe": [ { "id": 352, "owasptop10_2021": "A01 Broken Access Control", "name": "Cross-Site Request Forgery (CSRF)", "description": "The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. ", "capec_id": [ 62, 111, 462, 467 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Non-Repudiation" ], "impact": [ "Bypass Protection Mechanism", "DoS: Crash, Exit, or Restart", "Gain Privileges or Assume Identity", "Modify Application Data", "Read Application Data" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] }, { "id": 918, "owasptop10_2021": "A10 Server-Side Request Forgery (SSRF)", "name": "Server-Side Request Forgery (SSRF)", "description": "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.", "capec_id": [ 664 ], "scope": [ "Access Control", "Confidentiality", "Integrity" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands", "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00861, "percentile": 0.57025, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.0", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [CVSS v2: Scored by the NVD](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-source/) - [KEV Names With Remote Code Execution](/reference/vulnerability/search/examples/cisa-vulnerability-name/) - [CVEs Published by the Apache Software Foundation](/reference/vulnerability/search/examples/source-identifier/) - [CVSS v3.0: Scored by HackerOne](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-source/) - [CVSS v3.1: Scored by Microsoft](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-source/) - [CVSS 4.0: Scored by VulnCheck](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-source/)